Information about personal data processing
Data Controller: The personal data you provide will be processed by Sacyr, S.A. (henceforth SACYR or the company), with registered offices at Calle Condesa de Venadito, 7, 28027, Madrid, as the data controller
Purpose of the processing: Your personal data will be processed in order to manage your submission, conduct an investigation of the reported events, adopt the relevant corrective measures, and notify you the results of the procedure.
You should know, in relation to the possibility of send anonymous complaints, that the company will investigate them properly, provided they contain sufficient information to do so.
Lawfulness of processing: User consent, manifested through the submission of a query or complaint form, coupled with the check of the box that indicates that you have understood and accept the processing of your personal data in the terms provided in this privacy policy, and the fact that processing is necessary to operate on behalf of the public interest to prosecute infractions or crimes that could affect Sacyr, are the legitimate bases for personal data processing.
Retention data period: The data will be retained for the period necessary to reach a decision about launching an investigation into the reported events. Data will be kept no longer than is necessary to conduct the investigation and in any case the company will respect article 24.4 of the Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantías de los derechos digitales.
The company also reserves the possibility, in order to be able to execute its defense rights with all guarantees, to keep the complaint files duly blocked for the statute of limitations that applies in each case to the criminal offense reported.
In the event that a conflict of interest is notified through this Channel, the files will be kept for a period of 3 years from the end of the investigation, a period during which the data may be useful to fulfill the purpose described in the SACYR’s Conflicts of Interest Protocol.
Recipients or categories of recipients of the personal data: Personal data will be treated confidentially. Access to this data will be limited exclusively to those who perform internal control and compliance functions, or the processors designated for that purpose.
However, that the identity of the complainant will in any case be reserved, it is possible that in order to investigate and clarify the facts duly reported, your data may be communicated to:
- Authorities and Public Administrations who may intervene in the investigation or potential legal proceedings.
- Individuals who may be involved in the investigation itself, if the proper management of this depends on it, in a proportional, adequate, and suitable manner.
- Third parties that may provide the Sacyr Group support for this Channel: data hosting platforms, people to whom the investigation may be delegated, lawyers and other advisors.
Exercise of data rights: At any time, you may exercise your rights of access, rectification, erasure, objection, restriction, and portability about your personal data by post at the address indicated or by email at protecciondedatos@sacyr.com, including a copy of your national identification document and identifying yourself as a user of the Complaints Channel. In the event you consider your data protection rights violated, you may contact the Sacyr Group’s Data Protection Officer (dpo@sacyr.com) or file a claim with the Spanish Data Protection Agency (www.aepd.es).
Additional information: If you need to ask for additional information on any specific aspect of the processing of your data within the framework of this Channel, you can contact dpo@sacyr.com at any time.