Whistleblower channel privacy policy

No international transfers have been made or are planned. Otherwise, ADMINISTRADORA DE ARCHIVOS, S.A. would notify the interested parties of this transfer.

The recipients of the data will be, in addition to those relevant by legal obligation (Public Organizations, State Security Forces and Bodies as well as Judges and Courts...), only professional companies that provide services for ADMINISTRADORA DE ARCHIVOS, S.A. for the resolution of the complaint: law firm, etc. with which ADMINISTRADORA DE ARCHIVOS, S.A. signs a data processor contract in accordance with the terms of Regulation (EU) 2016/679 of April 27, 2016 and Organic Law 3/2018, of December 5, on data protection personal and guarantee of digital rights.

You have the right to:

• Get confirmation as to whether ADMINISTRADORA DE ARCHIVOS, S.A. is processing personal data that concerns you or not.
• Access your personal data.
• Request the rectification of inaccurate data.
• Request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Under certain circumstances, you may request the limitation of the processing of your data, in which case we will only keep them for the exercise or defense of claims.
• Under certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. ADMINISTRADORA DE ARCHIVOS, S.A. will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims.
• Request data portability.
• Withdraw the consents provided at any time, without affecting the lawfulness of the treatment based on the consent prior to its withdrawal.
• Complain to the Control Authority the data concerning your person included in our files, or those of professional companies that provide services for ADMINISTRADORA DE ARCHIVOS, S.A., in the terms established in the General Data Protection Regulation (Regulation (EU) 2016/679) and Organic Law 3/2018, of December 5, on the protection of personal data and the guarantee of digital rights.

You can contact, by written request by post, to ADMINISTRADORA DE ARCHIVOS, S.A., with address at Avenida Miralcampo, 7 bis, Polígono Industrial Miralcampo, 19200, Azuqueca de Henares (Guadalajara), Spain; or by email to: dpd@adea.es with an indication of the corresponding request.

Please note that there may be legal obligations that we must comply with and that force us to reject your requests or keep certain information.

Finally, we inform you that you can contact the Spanish Data Protection Agency and other competent public bodies for any claim arising from the processing of your personal data.

We remind you that, if you provide us with data relating to another natural person, you must, prior to their inclusion, inform them of the points contained in this clause.

ADMINISTRADORA DE ARCHIVOS, S.A., undertakes to comply with its obligation of secrecy of personal data and its duty to keep and guard them through technical and organizational security measures that guarantee their security, prevent their alteration, loss, deterioration, treatment or unauthorized access and the possible risks to which they may be exposed according to the terms established in the General Data Protection Regulation (Regulation (EU) 2016/679) and Organic Law 3/2018, of 5 of December, on the protection of personal data and the guarantee of digital rights.

In addition, ADMINISTRADORA DE ARCHIVOS, S.A. is a company certified according to the UNE-ISO/IEC 27001:2014 Information Security Management Systems standard. This implies that it has an implemented management system that generates an important commitment to information security, due to the existence of records and control measures that allow information security to be guaranteed in the organization and that these efforts can be demonstrated. For this reason, we are subject to annual external and internal audits to ensure compliance with this standard.

• Personal Data Collected: Name and surname (when provided), ID card number (when provided), Email address, Telephone number (when provided), Content of the complaint.
• Purpose (Use of Data): The purpose of the processing is to manage your incident notification, carry out the investigation of the reported facts, inform you of the outcome of the procedure, and, where applicable, adopt disciplinary measures and/or take legal or other appropriate actions before the relevant bodies.
• Why we can use them (Legal Basis): The legal basis for the processing is the legitimate interest of ADEA in investigating possible irregular conduct that violates the principles contained in the General Code of Conduct and the applicable regulations, and, in particular, those acts that may constitute a criminal offense and irregularities of an accounting and financial nature.
• Retention period: The data of the person making the communication and of the employees and third parties will be kept in the whistleblowing system for 3 months or for the time strictly necessary to decide on the appropriateness of initiating an investigation into the reported facts. Any personal data that is not necessary for the knowledge and investigation will be immediately deleted. The data of processed complaints will be kept in a restricted manner for a maximum of 10 years. Complaints that have not been acted upon will be recorded in anonymized form, without the blocking obligation provided for in Article 32 of the GDPR applying.

This is the whistleblowing channel implemented by ADEA in order to comply with the provisions of Law 2/2023, of February 20, regulating the protection of persons who report regulatory infractions and the fight against corruption.

Its objective is that all employees, managers, and persons related to ADEA can report any actions or omissions that may constitute violations of the Code of Conduct, internal rules, and national and international law.

The complaint may be made anonymously if desired and will be processed by ADEA's Compliance Committee.

Finally, please be advised that the procedure to be followed is set out in the internal policy called Internal Reporting System.

Data marked with * are required.