Privacy policy
The CAF Group is seriously committed to strict compliance with data protection regulations in the different countries, taking into account the regulatory advances recently produced in some of them and, in particular, in the countries of the European Union, especially a through Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data.
CAF informs about its Privacy Policy, with the purpose of informing website users about the processing of their data, as well as the fundamental principles on personal data protection that it applies. Despite this, certain services may contain conditions of use with provisions regarding the protection of personal data, with a specific Privacy Policy that prevails over this one.
You agree to carefully read this Privacy Policy to inform yourself about the standards and practices adopted by CAF to protect your personal data and to better understand our relationships with third parties who may have access to such data.
In any case, the user is solely responsible for the information provided on the website.
1. Controller of the processing activities
The contact details of the Data Controller are as follows:
- Construcciones y Auxiliar de Ferrocarriles, S.A with registered office at José Miguel Iturrioz Street, 26, Beasain (hereinafter, CAF).
To guarantee adequate management in the processing of your data, CAF has designated a Data Protection Officer, to whom you can contact for any question you may need and who you can contact at the following email address: dpo@caf.net.
2. Purposes of the processing of personal data
The different purposes for processing your personal data are detailed below, as well as the legal basis that support the processing activities:
| Purpose | Additional Information | Legal basis (variable depending on the specific processing activity) |
|---|---|---|
| Manage the data of all people who access the website through the cookies and pixels that will be installed on their devices, as well as maintenance and support of the use of the website and improving their browsing experience. | Manage user web navigation. Data processing to allow easier access and navigation through our digital media. For example, to offer you the version of the web page that best suits the device used. | CAF's legitimate interest* in the use of users' personal data is strictly necessary to guarantee the proper functioning of the website and a correct user experience. Consent in relation to processing of personal data that is not strictly necessary. |
| Manage advertising shipments to clients, data subjects and contact people who may be of interest to you. | Sending commercial and/or advertising communications, such as Newsletters, Information Bulletins, etc. by any means, including electronic communications related to own products or services like those contracted with CAF in the past. | The legitimate interest* for the communications sent to clients, and other contact persons representing legal entities with which CAF maintains commercial relations, is offering them commercial information about our products and services. |
| Management of information requests sent to CAF. | Resolve any question that may arise to users about our products and/or services, providing the corresponding information. | The legitimate interest* of CAF in correctly responding to requests from clients and potential clients (in the framework of receiving requests through social networks, forms, etc.). |
| Management of your registration and sign up through the “Clients” section or the “Suppliers” section. | Register as a CAF Client or Supplier. | Pre-Contractual and/or Contractual Relationship. |
| Management of services contracted with CAF. | Through the Customer Portal, CAF customer representatives can view and manage service orders placed. | Contractual Relationship. |
| Communication to public authorities, regulators, or government bodies. | In cases where it is necessary to transfer the data to third parties to comply with applicable legislation and regulatory obligations. | Legal obligation. |
| Maintain network and information security. | Keep track and control of the information found on the web, guaranteeing the security of the information. | Legitimate interest* of CAF in order to guarantee the security of the information found on the website and that is provided by you. |
*We inform you that your privacy is important to CAF and, in this sense, we have made the appropriate balancing test to verify that your interests, rights and fundamental freedoms do not prevail over ours before applying legitimate interest as a legal basis for the purposes mentioned in this section. You can request a copy of the conclusions of said balancing test at the following email address: dpo@caf.net.
3. Recipients of personal data
The recipients of the data, in addition to the Controller for the processing, may be public bodies and authorities and Courts and Tribunals when there is a legal obligation to provide the data.
Likewise, your personal data may be accessed by trusted companies so that they process them on our behalf within the framework of their provision of services, following our instructions and respecting our Privacy Policy and any other appropriate confidentiality and security measure. These providers are not authorized to use or disclose your personal information except as necessary to provide services on our behalf or to comply with legal requirements.
4. International data transfers
CAF may transfer your personal data to recipients located in countries outside the European Economic Area that may have data protection laws different from European ones. This includes those countries that, according to the European Commission, do not have an adequate level of protection for personal data. You can obtain more information about international transfers made by CAF, along with the safeguards that were applied in each case, by sending an email to dpo@caf.net.
5. Data retention period
The retention period of your data will be determined based on the duration of your relationship with CAF and the legally established periods. In this sense, the criteria that CAF uses to set the retention periods of your data has been determined in accordance with the requirements established in the applicable legislation, regulations, and regulatory guidelines, as well as CAF's operational requirements related to the correct management the existing relationship with the different categories of data subjects. The personal data provided will be kept for the period necessary for the execution of the purposes described in this policy, and as long as deletion is not requested by them, in which case, the personal data will remain blocked for the period necessary to compliance with a legal obligation or for the formulation, exercise and defence of claims that may arise from their processing. Later, it will be deleted.
6. Rights of data subjects
- CAF undertakes to respect the confidentiality of your Personal Data and to guarantee the exercise of your rights, and specifically:
- Access your data: You have the right to access your data to know what personal data we are processing that concerns you.
- Request rectification or deletion of your data: In certain circumstances, you have the right to rectify personal data that you consider inaccurate and that concerns you, and that is subject to processing by CAF, as well as the right to request the deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
- Request the limitation of the processing of your data: In certain circumstances, you will have the right to ask us to limit the processing of your data, in which case we inform you that we will only keep the data on which you have requested limitation in the processing for the exercise or defence of claims.
- To the portability of your data: In certain circumstances, you will have the right to receive the personal data that concerns you, and that you have provided to us, in a structured format of common use and machine reading, as well as to have it transmitted by CAF to another controller.
- Oppose the processing of your data: In certain circumstances and for reasons related to your situation, you will have the right to object to the processing of your data in which case, we would stop processing it unless we must continue to do so for compelling legitimate reasons or for the exercise or the defence of possible claims.
- To exercise these rights, and for any other clarification, the data subject may write to the postal address indicated above or to the following email address: dpo@caf.net. Finally, you can file a claim with the competent data protection supervisory authority (www.aepd.es).
7. Modifications
CAF undertakes to always inform the user if in any case there is a different or new data processing than those mentioned in section 1.2 of this Privacy Policy through the website or by other means, so that you can learn about the new privacy conditions.