Personal data processing

The FCC Group (FCC Servicios Medio Ambiente) processes the personal data of different data subjects in various areas of activities, which is informed at each time and place corresponding to the processing, as required by REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR). Therefore, in order to make the stricter information requirements of the GDPR and the concision and comprehension in the way it is presented, FCC has decided, as recommended by the Spanish Data Protection Agency, to adopt a layered information model.

Therefore, this section contains the second layer of the information policy regarding the protection of personal data in different areas of the processing of personal data carried out by FCC Servicios Medio Ambiente.

The mentioned personal data processing are related to the following:

Clients of the FCC Group

Additional information on the processing of Personal Data
Controller The FCC Group Company that contracts with the Client
Purposes / Lawfulness Customer relationship management. GDPR: 6.1 b) processing is necessary for the performance of a contract to which the data subject is party 
Manage invoicing, charges and payments related to the services contracted by the Client.
To deal with any incidents that may occur, as well as to carry out satisfaction surveys on the product or service contracted. To provide the services and information requested, whether by web, post or telephone.
To maintain a direct relationship with the Customer for advertising, promotional and/or statistical purposes. GDPR: 6.1 f) for the purposes of the legitimate interests pursued by the controller or by a third party
To record telephone conversations with Customer Services in order to guarantee a better quality of service and, on certain occasions, to guarantee the contracting process. In addition, e-mails may report a confirmation of their receipt and reading.
Recipients FCC Group companies belonging to the real estate, construction, cement, public services management, integral water cycle, urban waste management and environment-related activities sectors in order to manage the relationship with the Customer. FCC Group companies are all those companies or entities that have any FCC Group company as their parent company for the purposes of article 42 of the Commercial Code and, specifically, the companies listed in the memorandum of the latest consolidated annual accounts of FCC Servicios Medio Ambiente Holding, S.A.U published on the website www.fccma.es. In the event that you have contracted with an FCC Servicios Medio Ambiente Company located in a country outside the European Union (and which has not been declared as having an adequate level of protection by the European Commission), the appropriate measures will be taken to comply with the applicable regulations regarding international transfers of personal data. You can request further information about the recipients of your data by sending an email to protecciondedatosma@fcc.es indicating the specific processing or use about which you would like information.
Storage period

The personal data provided will be kept as long as the contractual relationship is maintained, their deletion is not requested by the Client and they must not be deleted due to being necessary for the fulfilment of a legal obligation or for the formulation, exercise and defence of claims.

If the Client exercises the right of erasure, the data will be kept blocked at the disposal of the Administration of Justice for the legally established periods in order to attend to possible liabilities arising from the processing of the same.
Rights of data subjects (Clients)

Data subjects may exercise their rights of access, rectification, erasure, portability, limitation or opposition and other rights provided for in the applicable regulations, by sending a letter identified with the reference "Data Protection" with a photocopy of the Customer's National Identity Card to: FCC Servicios Medio Ambiente Holding, S.A.U, Compliance and Data Protection Department, at Avenida del Camino de Santiago, 40 - 28050 Madrid; or by e-mail to protecciondedatosma@fcc.es.

Customers have the right to complain to the Supervisory Authority. (Spanish Data Protection Agency www.aepd.es).
Suppliers Likewise, the service providers of the FCC Company with which you have contracted may also have access to your data, solely for the provision of the service that the Client has contracted. You may request further information on the recipients of your data by sending an e-mail to protecciondedatosma@fcc.es, indicating the specific processing or use for which you would like information.

Third parties personal data

In the event that the personal data provided belong to a third party, the Client guarantees that he/she has informed the third party of this Privacy Policy and that you have sufficient legitimacy to provide your data to FCC Servicios Medio Ambiente for the aforementioned purposes. Likewise, the Client guarantees that the data provided are accurate and updated, and shall be liable for any direct or indirect damage or harm that may be caused as a result of non-compliance with this obligation.

Video-surveillance

Additional information on the processing of Personal Data
Controller

FCC Servicios Medio Ambiente Holding, S.A.U, CIF A85484905, General Services and Corporate Security Department. Avenida del Camino de Santiago, 40, 28050. Madrid. Web www.fccma.es and contact at protecciondedatosma@fcc.es
Purpose Manage access to and security of the building.
Lawfulness

GDPR: 6.1 f) Purpose based on the legitimate interest of the Controller.
Recipients State Security Forces and Corps and Judges, Courts and the Public Prosecutor's Office for the investigation of possible illegal or criminal acts in compliance with current legislation. There is no international transfer of personal data.
Storage period 30 calendar days from collection.
Rights of data subjects (Clients)

Data subjects may exercise their rights of access, rectification, erasure, portability, limitation or opposition and other rights provided for in the applicable regulations, by sending a letter identified with the reference "Data Protection" with a photocopy of the Customer's National Identity Card to: FCC Servicios Medio Ambiente Holding, S.A.U, Compliance and Data Protection Department, at Avenida del Camino de Santiago, 40 - 28050 Madrid; or by e-mail to protecciondedatosma@fcc.es.

Customers have the right to complain to the Supervisory Authority. (Spanish Data Protection Agency www.aepd.es).

Selection processes and curriculum vitae

Additional information on the processing of Personal Data
Controller

The FCC Group Company that receives your curriculum vitae (FCC SERVICIOS MEDIO AMBIENTE HOLDING, S.A.U.)
Purpose Manage the database of curricular data received not related to open selection processes, for possible inclusion in future processes of any FCC Servicios Medio Ambiente Company.
Manage the recruitment processes in any FCC Servicios Medio Ambiente Company: including selection of CVs, interviews, selection tests, communication of results to candidates.
Lawfulness

GDPR: 6.1 f) Purpose based on the legitimate interest of the Controller.
Recipients FCC Group companies belonging to the real estate, construction, cement, public services management, integral water cycle, urban waste management and environment-related activities sectors in order to manage the relationship with the Customer. FCC Group companies are all those companies or entities that have any FCC Group company as their parent company for the purposes of article 42 of the Commercial Code and, specifically, the companies listed in the memorandum of the latest consolidated annual accounts of FCC Servicios Medio Ambiente Holding, S.A.U. published on the website www.fccma.es. In the event that you have contracted with an FCC Servicios Medio Ambiente Company located in a country outside the European Union (and which has not been declared as having an adequate level of protection by the European Commission), the appropriate measures will be taken to comply with the applicable regulations regarding international transfers of personal data. You can request further information about the recipients of your data by sending an email to protecciondedatosma@fcc.es indicating the specific processing or use about which you would like information.
Storage period Duration of the process or 12 months after the end of the process if not selected.
Rights of data subjects

Data subjects may exercise their rights of access, rectification, erasure, portability, limitation or opposition and other rights provided for in the applicable regulations, by sending a letter identified with the reference "Data Protection" with a photocopy of the Customer's National Identity Card to: FCC Servicios Medio Ambiente Holding, S.A.U Compliance and Data Protection Department, at Avenida del Camino de Santiago, 40 - 28050 Madrid; or by e-mail to protecciondedatosma@fcc.es.

Data subjects have the right to withdraw their consent. Identification shall be made in the same way.

Customers have the right to complain to the Supervisory Authority. (Spanish Data Protection Agency www.aepd.es).
Suppliers Likewise, the service providers of the FCC Servicios Medio Ambiente Company with which the latter has contracted, such as LinkedIn or Infojobs, may also have access to your personal data, solely for the provision of the FCC Servicios Medio Ambiente Company's personnel recruitment service. You may request further information on the recipients of your data by sending an e-mail to protecciondedatosma@fcc.es, indicating the specific processing or use for which you would like information.
Source of the data In some cases, the FCC Servicios Medio Ambiente Company may receive your curriculum data from local councils, educational centres, etc. with which it has signed commercial agreements or service contracts, which will include a regulation on the processing of personal data in accordance with the regulations in force. Likewise, FCC Servicios Medio Ambiente may extract curricular data from LinkedIn and Infojobs in the event that the interested party has authorised them to do so.

 

Whistleblowing line

Additional information on the processing of Personal Data
Controller

FCC Fomento de Construcciones y Contratas, S.A., with CIF A28037224, Avenida del Camino de Santiago 40 28050. Madrid. 
Web: www.fcc.es 
Contact at protecciondedatos@fcc.e
Purposes / Lawfulness Analyse, investigate and resolve the events described, as well as manage the suggestions received to improve internal control, in accordance with the provisions of the Code of Ethics and Conduct and the Harassment Protocol and the Whistleblowing line Procedure and other internal regulations that develop them. GDPR: 6.1 c) the processing is necessary for compliance with a legal obligation applicable to the controller.
GDPR: 6.1 e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Recipients i) Administrative/judicial/criminal bodies, Security Forces and Corps, ii) FCC persons in charge of managing and carrying out the investigation, enquiry and sanction of the event (if necessary), the Compliance Officer of the FCC Group (or of any business area of the FCC Group), the Compliance Committee and iii) personnel with management and control functions of the FCC Human Resources Department or of the Company in which the Employee provides his/her services (in the event that there is an event that may be susceptible to action). For further information, see the "Additional Information" section.
International Data Transfers FCC has one of its technology service providers located outside the European Economic Area, specifically in Mexico. In these cases, where there is no comparable level of data protection as in Europe, we inform you that we transfer your data with the appropriate guarantees and always ensuring the security of your data, under the protection of standard contractual clauses.
Data storage

The processed personal data will be deleted within three months of their entry, except when they are necessary for the investigation of the conduct reported. Likewise, once the procedure has been completed, they will be blocked and subsequently erased once the time limit for any actions that may arise has expired.
Rights of data subjects 

Data subjects may exercise their rights of access, rectification, erasure, portability, limitation or opposition and other rights provided for in the applicable regulations, by sending a letter identified with the reference "Data Protection" with a photocopy of the Customer's National Identity Card to: FCC Fomento de Construcciones y Contratas, S.A, Compliance and Data Protection Department, at Avenida del Camino de Santiago, 40 - 28050 Madrid; or by e-mail to protecciondedatos@fcc.es.

Customers have the right to complain to the Supervisory Authority. (Spanish Data Protection Agency www.aepd.es).

v. January 2021