Privacy Policy

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the General Data Protection Regulation (GDPR), with Organic Law 3/2018 of December 5, on Data Protection and Digital Rights Guarantee, and with the rest of the applicable legislation in Spain on personal data protection, we inform you of the following:

Who is the data controller of your data?

The personal data provided when filling out and submitting the forms published on this website will be processed by BII INTERNATIONAL ASSOCIATES SL (hereinafter GAT GROUP) NIF B98147788 in its capacity as Data Controller.

For what purposes and on what legal grounds do we process your data?

• • Handling general information inquiries made by the client through the contact form. Legal basis: Consent of the data subject (Art. 6.1 a) GDPR).

• • Contracting professional services. Legal basis: Consent of the data subject (Art. 6.1 a) GDPR).

• • Fulfillment of obligations arising from professional service contracts signed between GAT GROUP and its clients. Legal basis: Performance of a contract (Art. 6.1 b) GDPR).

• • Compliance with legal obligations – accounting, tax, and administrative – derived from the contractual relationship between GAT GROUP and its clients. Legal basis: Legal obligation (Art. 6.1 c) GDPR) according to the General Tax Law; VAT Law; Commercial Code, among others.

• • Management of the commercial relationship established between GAT GROUP and its respective clients, including sending newsletters or other commercial formats via any medium – including electronic – related to products/services similar to those originally contracted. Legal basis: Legitimate interest (Art. 6.1 f) GDPR); as well as for sending commercial information via any medium – including electronic – related to products or services offered by other companies in the group when consent has been obtained. Legal basis: Consent of the data subject (Art. 6.1 a) GDPR).

• • To improve the quality of the service provided to the USER. Legal basis: Legitimate interest (Art. 6.1 f) GDPR).

• • Management of resumes received based on the needs of GAT GROUP's HR department. Legal basis: Consent of the data subject (Art. 6.1 a) GDPR).

• • Management of users on the backgroundspain.com platform. Legal basis: Consent of the data subject (Art. 6.1 a) GDPR).

To whom will your personal data be communicated?

GAT GROUP may share your personal data with external auxiliary service providers bound by contractual agreements as data processors, such as legal/tax/accounting advisors, agencies, IT service providers, financial institutions, collection agencies, and other auxiliary services. These entities will process your data under our instructions. When legally appropriate, your data may be disclosed to third parties such as public administration bodies and judicial authorities in the exercise of their functions. Only if you have given explicit consent, the various entities within GAT GROUP may exchange data among themselves for the purpose of sending you commercial communications.

How long will we keep your data?

The personal data provided to fulfill obligations arising from the contractual relationship between any of the entities of GAT GROUP and their respective clients will be kept throughout the duration of the contractual relationship and, once it has ended, they will be retained as long as the legally applicable statute of limitations periods are in effect.

Personal data obtained through the employment application and resume form will be kept for a maximum period of 1 year.

Personal data obtained through the contact form will only be kept for the time necessary to respond to the request for information.

However, if you have given your explicit consent to receive information and commercial prospecting, your data will be retained until you express your wish to revoke that consent.

For profiles created on the backgroundspain.com platform, data is retained for a maximum period of 6 months following the end of the verification process.

What security measures will be applied to your personal data?

The processing of personal data will be carried out adopting the technical and organizational measures necessary to prevent loss, misuse, alteration, and unauthorized access, considering the state of technology, the nature of the data, risk analysis performed, and measures derived from information system management in accordance with ISO/IEC 27001:2023 and ISO/IEC 27002 standards.

How can you exercise your rights regarding your personal data?

To revoke consent, as well as to exercise rights of access, rectification, cancellation, deletion, opposition, restriction, portability, and non-automation of decisions, you can send a written request to:

GAT GROUP
Calle Las Norias, 92, Ground Floor, Office I,
28221 Majadahonda, Madrid, Spain
Contact email: privacy@grupogat.com

Whom should you contact for questions regarding the protection of your personal data?

For questions related to your personal data, you can contact our Data Protection Officer (DPO): privacy@grupogat.com.

Additionally, if your rights have not been properly addressed, you can lodge a complaint with the Spanish Agency for Data Protection (AEPD) through their website www.aepd.es.

Mandatory or optional nature of the data requested

The mandatory fields in each form are identified as such. Failure to provide this information may prevent contact with the user and, if applicable, the inability to provide the requested information and/or service.

User commitments

The user guarantees that they are over 18 years old and that the information provided is accurate and truthful. Furthermore, they agree to inform us of any changes to the supplied information by sending an email to privacy@grupogat.com, specifying the information that needs to be modified. Additionally, the USER commits to diligently safeguarding their passwords and personal identification codes and to promptly notify us in case of loss, theft, or unauthorized access. Until such communication occurs, the Data Controller will be exempt from any liability that may arise from the improper use by unauthorized third parties of these passwords and identification codes. If any responsibilities arise from a breach of these conditions by the USER, they will be responsible for the consequences of such breach.