1. Data controller
In compliance with the duty to inform laid down in Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, "GDPR") and in Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (hereinafter, "LOPDGDD"), the identification details of the data controller are as follows:
- Company name
- Labrax Soluciones, S.L.
- Tax ID (CIF)
- B-70334529
- Registered office
- Calle Emilio González López 51, bajo, 15011 A Coruña (Spain)
- soporte@labraxsoluciones.com
- Telephone
- +34 981 928 655
- Data protection contact
- privacidad@labraxsoluciones.com
Labrax Soluciones, S.L. is not required to appoint a Data Protection Officer under Article 37 of the GDPR. However, it makes the above address available to data subjects for any queries or to exercise their data protection rights.
2. Purposes, legal bases and retention periods
Labrax Soluciones, S.L. (hereinafter, "Labrax") processes the personal data collected through the Website for the purposes, on the legal bases and for the retention periods set out below:
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to requests for commercial information received through the contact form or direct channels. | Consent of the data subject (Art. 6.1.a GDPR), which may be withdrawn at any time. | Until the request has been dealt with and, at most, two (2) years from the last contact with the data subject, unless the request gives rise to a contractual relationship, in which case the period in the next row applies. Once that period has elapsed, the data are erased from the management system. |
| Management of the commercial relationship with City Councils that contract the Labrax service. | Performance of a contract (Art. 6.1.b GDPR). | Throughout the contractual relationship and, thereafter, for the applicable statutory retention periods (6 years, Art. 30 of the Commercial Code). |
| Compliance with legal, accounting and tax obligations. | Compliance with a legal obligation (Art. 6.1.c GDPR). | For the statutory periods laid down in each case (generally 4-6 years). |
| Sending commercial communications about Labrax software and Labrax services. | Legitimate interest with regard to existing clients (Art. 6.1.f GDPR and Art. 21.2 LSSI) or consent in all other cases. | Until the data subject exercises their right to object or withdraws consent. |
| Management of job applications and recruitment processes based on the CV and data sent through the job application form or to the address talento@labraxsoluciones.com. | Consent of the data subject (Art. 6.1.a GDPR), given by voluntarily submitting their application and which may be withdrawn at any time. | Candidates' data are kept for a maximum of one (1) year from receipt, so that the data subject can be considered for future recruitment processes. Once that period has elapsed, they are erased unless the candidate renews their consent. |
The two-year period runs from the last contact with the data subject, not from the date of registration: any recorded interaction with that person restarts the count. When it expires, the data are erased —not anonymised—, deleting the record and the recorded activities. Notwithstanding the above, Labrax maintains an unalterable audit log, required by the Spanish National Security Framework (ENS), which proves that the data existed and were erased and which, in some entries, may contain the value of fields from the record; that log does not form part of the commercial management system, serves to comply with a legal obligation (Art. 6.1.c GDPR) and is subject to its own retention period.
3. Personal data processed
The personal data that may be processed through the Website are, in general:
- Identification data: first name, surname, institutional position.
- Contact data: institutional email address, telephone.
- Professional data: City Council or entity to which they belong.
- Job applicant data: when taking part in a recruitment process, the candidate's identification and contact data (first name, surname, email, telephone) and the information contained in the CV that the data subject chooses to provide (education, professional experience, qualifications and other CV data).
- Browsing data: only the technical storage that remembers the decision about the cookie notice; the Website does not use measurement or third-party cookies, in accordance with the Cookie Policy.
Labrax does not request special category data (racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, etc.) through this Website. When submitting applications, data subjects are advised not to include in their CV any special category data or third-party data not needed for the recruitment process. If the candidate chooses to provide them voluntarily, they will be deemed to have expressly consented to their processing for the sole purpose of taking part in that process (Art. 9.2.a GDPR).
4. Recipients of the data
The personal data processed will not be disclosed to third parties, except:
- Where required by law.
- Processors that provide services to Labrax (hosting, email and CRM tools), with which Labrax has the corresponding data processing agreements in accordance with Article 28 GDPR.
No international data transfers outside the European Economic Area (EEA) are planned. Should any take place, Labrax will adopt appropriate safeguards in accordance with Chapter V of the GDPR (adequacy decisions, standard contractual clauses, etc.).
5. Rights of the data subject
Everyone has the right to obtain confirmation as to whether Labrax is processing personal data concerning them. In particular, data subjects may exercise the following rights:
Withdrawal of consent
Where processing is based on the data subject's consent (for example, requests for information, sending commercial communications or taking part in recruitment processes), the data subject has the right to withdraw that consent at any time, as easily as it was given and without having to justify their decision. Withdrawal of consent will not affect the lawfulness of processing carried out before it. To withdraw consent, simply send a message to privacidad@labraxsoluciones.com; for commercial communications by email, this can also be done via the unsubscribe link included in each message.
How to exercise your rights
Data subjects may exercise their rights of access, rectification, erasure, objection, restriction, portability, not to be subject to automated decisions and to withdraw consent free of charge, by contacting Labrax Soluciones, S.L. and quoting the reference "Data protection":
- By email to: privacidad@labraxsoluciones.com
- By post to: Calle Emilio González López 51, bajo, 15011 A Coruña (Spain).
In the request, the data subject must identify themselves and state specifically which right they wish to exercise. Labrax may request additional information only where strictly necessary to verify the applicant's identity and only where there are reasonable doubts about it, in accordance with Article 12.6 of the GDPR; an ID card will not be required where identity can be proven by other means.
Labrax will respond to requests within a maximum of one (1) month of receipt, which may be extended by a further two months in cases of particular complexity or a high number of requests, informing the data subject of the extension beforehand, in accordance with Article 12.3 of the GDPR.
Before lodging a complaint with the supervisory authority, the data subject may contact Labrax's data protection contact (privacidad@labraxsoluciones.com), in accordance with Article 37 of the LOPDGDD.
Official AEPD forms
To make it easier to exercise their rights, data subjects may use the official request templates provided by the Spanish Data Protection Agency. Once completed, they should be sent to Labrax through the channels indicated above:
- Form for exercising the right of access (PDF)
- Form for exercising the right to rectification (PDF)
- Form for exercising the right to erasure (PDF)
- Form for exercising the right to object (PDF)
- Form for exercising the right to restriction of processing (PDF)
- Form for exercising the right to data portability (PDF)
You can also find full information about your rights and the available templates on the AEPD's official website: AEPD templates and forms.
6. Complaints to the supervisory authority
Data subjects may lodge a complaint with the Spanish Data Protection Agency (AEPD), particularly where they have not obtained satisfaction in exercising their rights:
- Website: www.aepd.es. Electronic office: https://sedeagpd.gob.es
- Address: C/ Jorge Juan 6, 28001 Madrid.
- Telephone: 901 100 099 / 912 663 517.
7. Security measures
Labrax has adopted the technical and organisational measures necessary to ensure a level of security appropriate to the risk of the processing, in accordance with Article 32 GDPR. In particular, Labrax meets the requirements of the Spanish National Security Framework (ENS) High category, in accordance with Royal Decree 311/2022, applicable to services provided to public administrations.
The measures include, among others: encryption of data in transit and at rest, role-based access control, activity logging, regular backups and specific data protection training for staff.
8. Automated decisions and profiling
Labrax does not take individual automated decisions, including profiling, that produce legal effects concerning the data subject or similarly significantly affect them, through this Website.
9. Changes
Labrax reserves the right to modify this Privacy Policy, in whole or in part, by publishing any change in this same section. In the event of substantial changes, users will be informed through the Website or, where appropriate, by email.
