PRIVACY POLICY - JOB SITE

Introduction

PERSÁN is firmly committed to protecting the privacy of your personal information. This statement explains how PERSÁN processes the personal information (i.e., information about you as an individual) that you submit and that it collects through Workday.

“PERSÁN” and/or the “Organization” refers to the companies that directly and indirectly make up the Persan Group and that have published a position for which you are applying. Each company is an independent legal entity. For more information, see Annex 1 of this Policy.

This Privacy Policy is governed by the applicable legislation according to the location of the entity responsible for processing personal data within the Persan Group. Specifically, within the European Union and the European Economic Area, Regulation (EU) 2016/679 General Data Protection Regulation (“GDPR”) applies.

When collecting and using personal data, our Policy collects only what we need, and our goal is to be transparent about why and how we process personal data. We may use the personal data you provide to us for any of the purposes described in this Privacy Policy or as otherwise stated at the time of collection. The term “personal information” also refers to “personal data.”

By using Workday and providing us with personal information, you acknowledge that you have read this Privacy Policy and, to the extent that your consent is necessary and valid under applicable law, you consent to the collection, use, and disclosure of such personal information, including any sensitive personal information you may choose to provide, in accordance with this Policy.

Who is responsible for processing users’ personal data?

The data controller for the personal information you submit through Workday is the independent legal entity that is part of the Persan Group and has posted the position you are applying for, as detailed in Annex 1.

How did we obtain your personal data?

The personal data we process at PERSÁN may have been collected from (i) any of the existing forms; (ii) through the voluntary submission of your resume or other information by email or post to the contact addresses provided by PERSÁN; (iii) by delivery in person at the work centers, when there is a channel enabled for this purpose; and/or (iv) by importing or incorporating professional information from third-party services or platforms when this functionality is available and the interested party activates it (for example, professional networks such as LinkedIn).

In general, in processes managed through forms, all personal data requested is necessary to participate in the personnel selection and/or internal promotion processes that we carry out, and it is therefore mandatory to provide it. If you do not do so, you will not be able to participate in these processes.

In cases of voluntary submission of a resume or information through channels other than the form, only the data necessary to evaluate the application and manage, where appropriate, communications associated with the process will be processed.

In all cases, the information required by data protection regulations will be provided to the interested party at the time of collection or, where appropriate, at a later time in accordance with applicable regulations, using mechanisms that allow for the verification of compliance with the duty to inform.

The categories of data processed are:

• Identifying data.
• Personal characteristics data.
• Employment data.
• Academic and professional data.

In general, data classified by the General Data Protection Regulation as “special categories of data” (health, religion, ideology, trade union membership, etc.) is not processed. PERSÁN will not ask you to provide sensitive personal information through Workday, except to the extent that the collection of such information is necessary in accordance with applicable law.

However, if the data subject voluntarily includes information of this nature in their resume or in the documentation provided, such data will be processed only to the extent necessary for the management of their application and with the guarantees required by applicable regulations.

Please note that the receipt and management of job applications and resumes, even when documented or filed on paper, constitutes the processing of personal data when the information is organized or used for personnel selection (e.g., orderly storage, evaluation, and comparison of applications).

By uploading and/or sending such sensitive personal data to PERSÁN, you express your consent to the processing of data by PERSÁN for the purposes of carrying out the specific mandate and thereby give your consent in accordance with applicable data protection legislation.

For what purpose and on what legal basis does PERSÁN process users’ personal data?

Any personal information you submit through Workday will be provided and disclosed to PERSÁN and may be provided and disclosed to other entities that are part of the Persan Group to assist in their recruitment and employment activities.

At PERSÁN, we process your personal data with the utmost respect and compliance with applicable regulations on personal data protection.

1) External candidate selection processes

The personal data provided by candidates participating in selection processes for possible incorporation into the company will be processed for the following purposes:

• Creation and maintenance of the candidate’s profile on the recruitment platform, as well as the comprehensive management of their participation in active or future selection processes, including the receipt, organization, and updating of the professional, academic, and curricular information provided.

Legal basis for processing: implementation of pre-contractual measures at the request of the data subject [Article 6.1 b) GDPR].

• Assessment and comparison of applications, which may involve the analysis of the professional profile by human resources personnel and, where appropriate, by managers of the area or organizational unit where the vacancy is located, as well as the conduct of interviews, technical tests, competency assessments, or other selection mechanisms.

Legal basis for processing: implementation of pre-contractual measures at the request of the data subject [Article 6.1 b) GDPR].

• Management of communications with the candidate, including contact to arrange interviews, tests, meetings, or to report on the status of the selection process, by any means of communication enabled.

Legal basis for processing: implementation of pre-contractual measures at the request of the data subject [Article 6.1 b) GDPR].

• In the event of selection by PERSÁN and acceptance of the offer by the candidate, collection and management of the necessary documentation to process their registration in the Organization’s systems, for the purpose of preparing the formalization of the employment relationship.

Legal basis for processing: application of pre-contractual measures and compliance with legal obligations [Articles 6.1 b) and 6.1 c) GDPR].

• In the event of selection by PERSÁN and once the offer has been accepted by the candidate, sending of informative or welcome communications with relevant information for their incorporation.

Legal basis for processing: application of pre-contractual measures at the request of the data subject [Article 6.1 b) GDPR].

• If not selected, retention of the candidate’s profile for consideration in future selection processes in line with their professional profile, as well as the sending of automatic notifications about new opportunities, when the data subject has given their consent.

Legal basis for processing: consent of the data subject, which will be given by checking the box provided for this purpose when applying for the selection process [Article 6.1 a) GDPR].

The data obtained in the context of the selection processes will be processed exclusively for the purposes described in this Policy and will not be used for different and incompatible purposes (for example, commercial or advertising actions unrelated to the management of the application). Any processing for a different purpose will require the corresponding legal basis and, where appropriate, the consent of the data subject, without participation in the process being conditional on the acceptance of ancillary purposes.

In particular, no commercial or promotional communications will be sent by email or other equivalent electronic means of communication using the contact details provided for the management of the application, unless such communications have been requested or expressly authorized by the data subject, in accordance with the legally required terms, and without refusal to receive them affecting their participation in the process.

2) Employee promotion and internal mobility processes

The personal data of employees participating in internal promotion, functional mobility, or internal vacancy coverage processes will be processed for the following purposes:

• Management of employee participation in internal promotion or mobility processes, including the identification of their professional profile, internal career path, training, and skills, as well as their suitability for available vacancies.

Legal basis for processing: the Organization’s legitimate interest in the management and planning of human resources and the professional development of its staff [Article 6.1 f) GDPR] in relation to the execution of the existing employment relationship or the application of pre-contractual measures at the request of the data subject [Article 6.1 b) GDPR].

• Evaluation of the employee’s performance and suitability for the position, which may involve reviewing their internal professional history, interviews, aptitude tests, or objective assessments linked to the promotion process.

Legal basis for processing: legitimate interest of the controller [Article 6.1 f) GDPR], in relation to the performance of the existing employment relationship [Article 6.1 b) GDPR].

• Communication with the employee to inform them about the progress of the promotion process, arrange interviews or tests, and notify them of resolutions or decisions taken.

Legal basis for processing: performance of the employment relationship [Article 6.1 b) GDPR].

• If selected, administrative management of the change of position, category, duties, or working conditions, including updating internal systems and processing the necessary documentation.

Legal basis for processing: performance of the employment contract and compliance with legal obligations [Articles 6.1 b) and 6.1 c) GDPR].

If you decide to contact us through a different channel, or if you decide to send us your CV or application in any other way, we will consider that by contacting us and/or sending us your CV or application, you are giving us your consent to process your personal data for that purpose and in accordance with the provisions of this Privacy Policy.

The management of selection processes also means that we will contact you by email, phone call, or text message regarding vacancies and selection processes related to the preferences and interests you indicated during registration, for the proper management of selection processes, even if you have not actively applied for any job offers.

We inform you that we will only process your personal data for the purposes mentioned above and that, under no circumstances, will automated decisions be made based on your profile.

How long will we keep your personal data?

We will keep your personal data for as long as necessary for the purposes for which it was collected, including as required by applicable law or regulation. 

With regard to the resumes we receive, even if your application is unsuccessful, we will keep them for a period of two (2) years from the end of the last process in which you participated or from the last update of your profile, so that we can consider your application in the selection processes we organize during that period, after which they will be deleted.

In other cases, we will process your data for the time necessary to manage your request and/or service and in accordance with the applicable regulations.

What obligations do we comply with regarding the personal data we process?

We comply with the principles required by the applicable regulations in accordance with local data protection legislation.

In this regard, we will take these principles into account during all phases, processing, and actions to which we subject the personal data for which we are responsible.

These principles are:  

• Principle of lawfulness, fairness, and transparency, which implies, as its name suggests, that we will only have the right to process data in a “lawful, fair, and transparent manner in relation to the data subject.”
• Principle of purpose limitation. This principle requires that data collected will only be processed for “specific, explicit, and legitimate purposes.” This principle also implies that such data may not be further processed “in a manner incompatible with those purposes.”

The prohibition on processing data for incompatible purposes does not apply to the processing of such data for “archiving purposes in the public interest, scientific and historical research purposes or statistical purposes.”

• Principle of data minimization. This obligation entails the duty of the Data Controller and all personnel working for them to process only data that is “adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.”
• Principle of accuracy. This principle is reflected in the need to process personal data that is accurate and, therefore, up to date. We therefore ask that, if any of the personal data you provided us with when we began our relationship has changed, you please let us know as soon as possible so that we can process only personal data that is up to date and current.

You can access your Workday profile at any time to review or update your personal information.

• Principle of storage limitation. This principle requires that personal data processed—in such a way as to allow the identification of data subjects—be kept only for as long as necessary for the purposes of processing personal data.
• Principle of integrity and confidentiality. This obligation involves the adoption of all measures—technical, organizational, or otherwise—necessary to ensure “adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.”
• Principle of Accountability. In practice, fulfilling this duty of accountability (also known as active responsibility or accountability) means that we must take an active and preventive—rather than reactive—approach to potential risks, threats, and/or inappropriate processing of personal data from the outset and throughout all stages of processing.

For this reason, all our staff are aware of the importance of this principle of accountability, which involves adopting preventive measures, proactive attitudes and actions that benefit, at all times, the maximum respect for the fundamental right to personal data protection of the data subject.

This principle of accountability involves extensive documentation work that allows for the traceability of all actions taken to fulfill this active responsibility by all PERSÁN staff.

• Principle of lawfulness of processing. All processing of personal data must be lawful and, in this regard, includes six legal bases that make the processing of personal data lawful.

These bases are made up of the following factual assumptions:

1. You have given your consent to the processing of your personal data for one or more specific purposes;
2. the processing is necessary for the performance of a contract to which you are party or for the implementation of pre-contractual measures at your request;
3. the processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary to protect your vital interests or those of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

 

 

To whom will users’ personal data be disclosed?

PERSÁN will not transfer your personal data. It will only transfer your personal data if required to do so by law. When we transfer or share personal data, we establish contractual agreements and security mechanisms that comply with our data protection, confidentiality, and security standards and with applicable laws and regulations.

The Persan Group is made up of independent legal entities located in Europe, Latin America, and the United States, among other locations, as detailed in Annex 1.

Therefore, the following data communications may be made:

• External candidate selection processes

• • Candidate data may be communicated to other companies in the Persan Group, including national or international subsidiaries, when these entities participate in the selection process, are the final recipients of the position offered, or manage vacancies that may be in line with the candidate’s professional profile.

In any case, these communications will be limited to the data strictly necessary for the evaluation of the application and to assess the possible incorporation of the interested party.

Legal basis for the communication of data: application of pre-contractual measures at the request of the interested party [Article 6.1 b) GDPR].

• Employee promotion and internal mobility processes
  • The data of employees participating in internal promotion or mobility processes may be communicated to other companies in the Persan Group when necessary for the centralized management of human resources, the filling of internal vacancies, or the evaluation of applications for positions located in other entities of the Organization.

Such communications shall be limited to relevant and necessary information and personal data (professional profile, internal experience, skills) and shall be carried out for the purpose of assessing the employee’s suitability for the position and managing their possible promotion or mobility.

Legal basis for the communication of data: legitimate interest of the data controller in the management and organization of its business structure and the professional development of its staff [Article 6.1 f) GDPR], in relation to the execution of the employment relationship [Article 6.1 a) GDPR].

• If the process involves an effective change of company within the Persan Group, the data necessary for the formalization and management of the new employment relationship will be communicated to the destination entity.

Legal basis for the communication of data: performance of the employment contract and compliance with legal obligations (Articles 6.1 b) and 6.1 c) GDPR).

• External organizations that provide services to us. We also inform you that PERSÁN works with several entities that provide services requiring access to personal data. These entities are therefore data processors for PERSÁN, with whom we have signed the corresponding data processing agreement in accordance with the provisions of Article 28.3 of the General Data Protection Regulation.
• Other disclosures of information. We may also disclose personal information to third parties for regulatory compliance purposes and/or as set forth in this Policy. We may also disclose your personal information to law enforcement, regulatory, and other government agencies, as well as professional bodies and other third parties, as required and/or in accordance with applicable law or regulation. This includes disclosures outside the country or region where you are located. PERSÁN may also review and use your personal information to determine whether its disclosure is necessary or permitted.

What security measures has PERSÁN taken to protect your data?

At PERSÁN, we take all measures within our power to ensure the security and confidentiality of all personal data we process. These measures are both physical and logical, technical and organizational in nature, and necessary depending on the data we process. Of course, the measures are adopted with the aim of guaranteeing the security, confidentiality, and integrity of all the personal data we process to prevent its alteration, loss, unauthorized processing, and/or access, taking into account the state of technology, the nature of the data stored, and the risks to which it is exposed, whether from human action or from the physical or natural environment.

Among the security measures (by way of summary) that we adopt are: ongoing training of all our employees, use of secure passwords and frequent password changes, backups, encrypted transmission of personal data, control of access to personal data based on needs, security audits, hiring of data processors who offer the necessary security and strict compliance with data protection regulations, physical security measures for access control (keys, locks, etc.), certified destruction of confidential information, use of official programs that guarantee security in the processing of personal data, and, of course, all those offered by technology that are consistent with the risks identified for the processing of personal data carried out by PERSÁN.

In this regard, we ask that you do everything in your power to prevent yourself from becoming a victim of any of the attacks that, unfortunately, take place on the Internet. To this end, we remind you not to click on any links whose origin you are unsure of, not to provide bank details or passwords electronically or by telephone, to use a secure password (combining letters, numbers, and special characters), and to change it frequently (at least once a year). Likewise, if you have any doubts about PERSÁN requesting data and/or any other type of action, please consult us first at gdpr@persan.es before taking any action.

What rights do users have as data subjects?

As the owner of your personal data, either on your own behalf or through a legal or voluntary representative, you may exercise certain rights under applicable local law in relation to the personal information we hold about you. Specifically, you may have the right of access, rectification, restriction of processing, erasure, objection, and the right to data portability.

We briefly explain what each of these rights consists of:

• Right of access: You have the right to know what personal data about you is being processed.
• Right to rectification: You have the right to rectify any personal data about you that is incorrect or out of date (e.g., change of email address, error in contact telephone number, change of postal address or account number).
• Right of erasure: You have the right to request that personal data relating to you be However, if there is a reason that prevents this (contractual relationship, legal requirements, etc.), upon receiving your request, you will be informed whether your right of erasure can be granted or not.
• Right to restriction of processing: You have the right to request that we cease certain processing of your personal data. However, as with the right to erasure, if there is a justified reason for not being able to comply with your request, we will inform you in a clear, simple, and transparent manner.
• Right to data portability: You have the right to request a copy of the personal data being processed about you, provided that you have provided it and that it is in a structured, commonly used, and machine-readable format. You may also choose whether you want this data to be provided to you or to another data controller.
• Right to object: You may exercise this right to object to certain processing of personal data that is being carried out. However, as with the right to erasure and restriction, if there are legitimate reasons that require processing and/or legal obligations, you will be informed of this in a simple and transparent manner.
• Right not to be subject to automated decisions: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise these rights, please contact us by email at gdpr@persan.es, indicating “Data Protection Rights” in the subject line, or, if you prefer, by post to the registered office of the Persan Group entity that is the Data Controller (i.e., the Persan Group member company to which you have submitted your application), specifying which right you wish to exercise. We may ask you for a copy of your passport or identity document if we need to verify your identity.

We will process requests in accordance with applicable law and within a reasonable time frame. We recommend that you include a clear and precise description of your request.

However, prior to submitting such a complaint, you may (and we ask that you do so) forward your complaint to our DPO, who will be happy to resolve your issue as soon as possible. You can contact our DPO at the following email address: gdpr@persan.es.

Which body can you file a data protection complaint with?

We inform you that you can lodge a data protection complaint with the local supervisory authority responsible for data protection matters, in accordance with applicable legislation.

For selection processes carried out through the company PERSÁN, S.A., you may contact the Spanish Data Protection Agency. All the information is available on their website: www.aepd.es.

However, prior to filing such a complaint, you may (and we ask that you do so) forward your complaint to our DPO, who will be happy to resolve your issue as quickly as possible. You can contact our DPO at the following email address: gdpr@persan.es.

Changes to the Privacy Policy

This Privacy Policy was approved on February 16^th of 2026. We may update its content at any time by publishing an updated version here. The new modified Privacy Policy will be effective as of the revision date. Therefore, we recommend that you review this Policy periodically to stay informed about how we protect your information.

Additional information depending on your country/region

We would also like to inform you of the specific provisions of the country/region that may apply to the processing of your data. These provisions are described in detail in the Annex 2 to this Privacy Policy and apply to our processing of your personal data only to the extent that they may be necessary for full compliance with applicable data protection laws. If the country/region-specific provisions cease to be mandatory due to possible legislative changes under applicable data protection laws, they will no longer apply to the processing of the employee’s personal data.

The provisions of this Privacy Policy shall prevail over the Country/Region Specific Provisions in Annex. 2, unless required by applicable data protection laws and, in particular, applicable national data protection laws.

ANNEX 1

LIST OF ENTITIES RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

PERSÁN, S.A.

Address: Calle Pino Albar, No. 2 – Postal Code 41016 Seville.

Tax ID number: A-91.380.014.

Registration details: registered in the Seville Mercantile Registry on Page SE-57,934, Volume 3,957, and Folio 190.

Email: info@persan.es

Phone: (+34) 954 99 83 50.

PERSÁN FOUNDATION

Address: Calle Pino Albar, nº 2 -C.P. 41016 Seville.

Tax ID number: G-91.625.939.

Registration details: registered in the Andalusian Register of Foundations under number SE/1156.

Email: fundacion@persan.es

Phone: (+34) 954 997 974.

PERSAN POLSKA, S.A.

Address: Innowacyjna 10, 55-330 Wróblowice (Poland).

Tax ID number: 527-272-39-10.

REGION: 360126239.

Registration number in the Commercial Register: 0000529846.

Wroclaw-Fabryczna District Court; VI Division of the Commercial Register.

Email: info@persan.es

Phone: (+48) 71 37 00 599.

PERSAN FRANCE, S.A.S.

Address: 235 Rue Charles de Gaulle, Plaine de l’Ain Industrial Park. 01150, Saint Vulbas, France.

RCS: 891 336 976.

Email: office.fr@persan.es

Phone: (+33) 474 342 200.

PERSAN SWISS, A.G

Address: CSC Corporate Services (Suisse) GmbH, Zahlerweg 6, 6300 Zug.

CHE – 460.477.158.

PERSÁN LATAM, S.A.S.

Address: CR78 11 C 58 to 4 of 908. Bogotá, Colombia.

Tax ID: 901324723-6.

GADECO CORPORATIVA, S.L.

Address: C/ Infante Don Carlos, 16. 41004 Seville.

Tax ID: B-91.891.762.

Registration details: registered in the Seville Mercantile Registry on Page SE-87128. 2nd entry, Volume 5,274 and Folio 50.

E-mail: ADMINISTRACION@GRUPOALEA.ES

Phone: (+34) 609 519 540.

 

AVENIDA DE ITALIA 17, S.L.

Address: Av. Innovacion. Edif. Sierra Este. 1st Floor. Module 6. 41020 Seville.

Tax ID: B-91089037.

Registration details: registered in the Seville Mercantile Registry on Page SE-42372, Volume 3,161, and Folio 143.

E-mail: ADMINISTRACION@GRUPOALEA.ES

Phone: (+34) 609 519 540.

 

VEINVER GLOBAL INVESTMENT, S.L.

Address: Calle Pino Albar, nº 2 – Postal Code 41016 Seville.

Tax ID: B-90106550.

Registration details: registered in the Seville Mercantile Registry on Page SE-99528, Volume 5787, and Folio 190.

E-mail: ADMINISTRACION@GRUPOALEA.ES

Phone: (+34) 609 519 540.

 

AGROIBERICA DE SERVICIOS, S.A.

Address: Av. Innovación. Edif. Sierra Este. 1st Floor. Module 6. 41020 Seville.

Tax ID: A-90241159.

Registration details: registered in the Seville Mercantile Registry on Page SE-107869, 2nd entry, Volume 6127, and Folio 158.

E-mail: ADMINISTRACION@GRUPOALEA.ES

Phone: (+34) 609 519 540.

ANNEX 2

SPECIFIC PROVISIONS BY COUNTRY/REGION

Additional specific provisions for the processing of data originating from:

France

Section “What rights do users have as data subjects?”:

You also have the right to determine the rules governing the use of your data after your death.

Mexico

Section “To whom will users’ personal data be disclosed?”:

The transfer of personal data between Persan Group companies does not require your consent, as Persan Group companies are governed by privacy policies and binding rules in accordance with Article 37. III of the Federal Law on Protection of Personal Data Held by Private Parties.

Section “What rights do users have as data subjects?”:

To find out the procedures, requirements, and deadlines for exercising your rights (access, rectification, cancellation, and objection), limitation/communication, and/or revocation of your consent, please send an email to gdpr@persan.es .

If you deem it necessary, you may file a complaint with the National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI), the authority in charge of data protection in Mexico.

United Kingdom

Section “To whom will users’ personal data be disclosed?”:

For efficiency of service, some of the providers mentioned are located in territories outside the United Kingdom that do not provide a level of data protection comparable to that of the United Kingdom. In such cases, we inform you that we transfer your data with adequate safeguards and always maintain the security of your data, as we use the most appropriate tools for international data transfer, such as Standard Contractual Clauses or any other complementary measures that may be applicable.

Switzerland

Section “What rights do users have as data subjects?”:

We inform you that you have the right to lodge a complaint with the supervisory authority responsible for data protection, in particular with the Spanish Data Protection Agency (www.aepd.es) and, if the company you work for is located in Switzerland or if you have permanent residence in this country, with the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html).