a) Purpose and legitimacy of the treatment: Your personal data is necessary for the following purposes:

• Customer/user, accounting, tax and administrative management based on the contractual relationship you maintain with us.
• Compliance with tax and accounting obligations, as there is a legal obligation applicable to Elzaburu.
• Carry out advertising and commercial prospecting activities based on the legitimate interest we have in generating new business and sales opportunities, as well as in building customer loyalty.
• Improve the professional services we offer thanks to the provision of a quality questionnaire to the client and based on the legitimate interest we have in seeking said improvement.

b) Origin and conservation period: The data has been provided to us by you or your legal representative and we will keep them, in general, for the duration of the contractual relationship with you and/or, where appropriate, the legitimate interest referred to is maintained, and subsequently, duly blocked, during the legal period provided for the filing or defense of possible claims.

c) Data typesthat we may process are identification, commercial information, work occupation, economic, financial and insurance, related to transactions and academic or professional.

d) Communication of your data: We may share your data with the following entities and/or people:

• Administrations or public organizations.
• Financial entities.
• Courts and Tribunals, arbitration courts and/or mediators.
• Other entities related to the person responsible (Collaborating firms inside and outside Spain and Correspondents of the firm outside Spain).
• Others (Communication to opposing party or infringer of rights).
• State security forces and bodies (in defense of their rights and interests).

In addition, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• E-goi LDA (email marketing platform)
• NEW MEDIA ENVISION (web hosting)
• Microsoft Ireland Operations Ltd (Office 365)
• Salesforce

e) International data transfers: Your personal data may be transferred to:

• Collaborating firms, located in various countries outside the European Economic Area, these transfers being protected, either by the existence of an Adequacy Decision that declares the place of destination of the data as having a level of protection equivalent to the European one, or because it is a exceptional situation, as the transfer of data is necessary to execute a contract between you and Elzaburu or pre-contractual measures adopted at your request or in your interest.

a) Purpose and legitimacy of the treatment: Your personal data is necessary for the following purposes:

• Management of the relationship with potential clients based on a pre-contractual relationship that you maintain with us.
• Carry out advertising and commercial prospecting activities derived from a pre-contractual relationship with you and the legitimate interest that we have in generating new business and sales opportunities.

b) Origin and conservation period: The data has been provided to us by you or your legal representative or by other sources and we will keep it, in general, while the business opportunity with you is alive and subsequently during the period legally provided for the filing or defense of possible claims.

c) Data types that we can process are identifying and commercial information.

d) Communication of your data: We can share your data with our collaborating Firms inside and outside of Spain and Correspondents of the firm outside of Spain if this is necessary due to the request you have made to us.

In addition, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• Microsoft Ireland Operations Ltd (Office 365)
• Salesforce
• Social Smart Trading

e) International data transfers: Your personal data may be transferred to

• Collaborating firms, located in various countries outside the European Economic Area, these transfers being protected, either by the existence of an Adequacy Decision that declares the place of destination of the data as having a level of protection equivalent to the European one, or because it is a exceptional situation, as the transfer of data is necessary to execute a contract between you and Elzaburu or pre-contractual measures adopted at your request or in your interest.

a) Purpose and legitimacy of the treatment: Your personal data is necessary for the following purposes:

• General supplier and administrative management based on the contractual relationship you have with us.
• Compliance with tax and accounting obligations, as there is a legal obligation applicable to Elzaburu.

b) Origin and conservation period: The data has been provided to us by you or your legal representative or third parties and we will keep it, in general, for the duration of the contractual relationship with you and subsequently during the period legally provided for the filing or defense of possible claims.

c) Data types that we may process are identifying, personal characteristics, social circumstances, commercial, economic, financial and insurance information, related to transactions and academic or professional.

d) Communication of your data: We may share your data with the following entities and/or people:

• Administrations or public organizations.
• Other entities related to the person responsible (Clients).

In addition, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• Microsoft Ireland Operations Ltd (Office 365)
• Salesforce

e) International data transfers: Your personal data may be transferred to

• Elzaburu clients located in various countries outside the European Economic Area, this transfer being covered either by the existence of an Adequacy Decision regarding the country or place of destination of the data or by the transfer being necessary for the execution of a contract or pre-contractual measures between you and Elzaburu or for the conclusion or execution of a contract, in your interest, between Elzaburu and another natural or legal person.

a) Purpose and legitimacy of the treatment: If you have given us your consent, to be able to send you, including electronically, information related to our services, activities and events.

b) Origin and conservation period: The data has been provided to us by you or your legal representative and we will keep it as long as you do not revoke your consent, or oppose the processing or request that you unsubscribe from sending this type of communications.

c) Data types that we use in this treatment are identifying.

d) Communication of your data: We do not transfer your personal data to third parties or entities for their use. However, our following providers may have access to your data by virtue of the service they provide to us:

• E-goi LDA (email marketing platform)
• NEW MEDIA ENVISION (web hosting)
• Microsoft Ireland Operations Ltd (Office 365)
• SALESFORCE.COM SARL

e) International data transfers: They do not occur.

a) Purpose and legitimacy of the treatment: Your personal data is necessary for the selection, incorporation and termination of personnel contracts, based on the legitimate interest we have in finding professional or employment profiles for the firm's jobs.

b) Origin and conservation period: The data has been provided to us by you or your legal representative or by other sources and we will keep it, in general, until the selection process in which the candidate participates is completed and subsequently for a maximum of 1 year for other possible processes that could open.

c) Data types that we can process are identifying, personal, academic or professional characteristics and job occupation.

d) Communication of your data: We do not transfer your personal data to third parties or entities for their use. However, the following suppliers of ours may access your personal data in order to provide us with the contracted service:

• Microsoft Ireland Operations Ltd (Office 365)
• DARWIN PARTNERS SL
• SALESFORCE.COM SARL

e) International data transfers: They are not produced.

a) Purpose and legitimacy of the treatment: We process your personal data to be able to manage our clients' files, finding ourselves legitimized to do so by a legitimate interest of our clients consisting of the legitimate defense of their rights and interests.

b) Origin and conservation period: The data has been provided to us by you or by other sources and we will keep it while the claims, extrajudicial or judicial, or arbitration and/or mediation procedures remain alive and, once these are definitively completed, for an additional period of 5 years exclusively for the possible defense and filing of claims.

c) Data types that we can use in this processing are identification, personal characteristics, social, academic or professional circumstances, job occupation, commercial, economic, financial and insurance information, related to transactions and related to criminal convictions and infractions.

d) Communication of your data: We may share your data with the following entities and/or people:

• Administrations or public organizations.
• Other people or entities related to Elzaburu (clients, suppliers, attorneys, experts...).
• Courts and Tribunals, Arbitration Courts and/or mediators.
• State Security Forces and Bodies.

In addition, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• Microsoft Ireland Operations Ltd (Office 365)
• Salesforce

e) International data transfers: Your personal data may be transferred to:

• Collaborating firms located in various countries outside the European Economic Area, these transfers being covered either by an Adequacy Decision regarding the place of destination of the data, or because the transfer is necessary for the formulation, exercise or defense of claims (art. Art. 49.1 e) RPGD).

a) Purpose and legitimacy of the treatment: Your personal data is necessary to maintain the personal relationship with those who work in the entities with which the firm relates, being necessary for the satisfaction of legitimate interests pursued by Elzaburu consisting of being able to maintain the relationship described.

b) Origin and conservation period: The data has been provided to us by you or your legal representative or by third parties and we will keep them, in general, for the duration of the contractual or business relationship with the entity in which you work and subsequently during the period legally provided for possible defense. and filing of claims.

c) Data types that we can process are identification and job occupation.

d) Communication of your data:We do not transfer your personal data to third parties or entities for their use. However, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• Microsoft Ireland Operations Ltd (Office 365)
• Salesforce

e) International data transfers: They do not occur.

a) Purpose and legitimacy of the treatment: Your personal data is necessary to relate to those who have sufficient capacity to represent our clients, suppliers or collaborators, being necessary for the satisfaction of legitimate interests pursued by Elzaburu consisting of being able to maintain the relationship described.

b) Origin and conservation period: The data has been provided to us by you or your legal representative or by third parties and we will keep them, in general, as long as our relationship with the entity you represent remains and subsequently during the period legally provided for the possible defense and filing of claims. .

c) Data types that we can treat are identifying and representative.

d) Communication of your data: We may share your data with Notaries and Registrars or Public Registries, Courts and Tribunals, arbitration courts and/or mediators and other entities and people related to us (clients, suppliers or collaborators).

In addition, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• Microsoft Ireland Operations Ltd (Office 365)
• Salesforce

e) International data transfers: Your personal data may be transferred to:

• Entities and people related to us (clients, suppliers or collaborators) finding the transfer legitimized because it is necessary either for the celebration or execution of a contract in their interest, or for the formulation, exercise or defense of claims.

a) Purpose and legitimacy of the treatment: your personal data is necessary to adequately provide you with the IP & IT Sensor service, which includes sending the result by e-mail, creating anonymous statistics for a comparative study by sector, as well as, if you request it, sending you by e-mail the positioning of your company in terms of IP & IT in relation to the sector where it carries out its activity and, in any case, make the appropriate follow-up on the service provided and the result obtained from the Sensor.

Please keep in mind that, if you are already a client or if as a result of using this service you become a client/user, the information contained in this privacy notice relating to clients also applies to you.

b) Origin and conservation period: the data has been provided to us by you or your legal representative and we will keep them, in general, as long as it is necessary to maintain the relationship or communication with you and subsequently, duly blocked, for the period that they are necessary as evidence in possible claims in whose case will be kept until their final completion.

c) Data types that we can process are identifying, professional and/or occupational.

d) Communication of your data: Your personal data collected through the IP & IT Sensor will not be shared with third parties or entities for their use. However, the following suppliers of ours may have access to your personal data to provide us with their services:

• Microsoft Ireland Operations Ltd (Office 365)
• SALESFORCE.COM SARL
• Tesys Internet, SLU

e) International data transfers: They are not produced.

a) Purpose and legitimacy of the treatment: Your personal data is necessary for the following purposes:

• Proceed with the organization of the event and its registration in it, as it is necessary for the provision of the service.
• Invite you to possible future conferences or events that may be of interest to you, based on our legitimate interest in establishing a relationship of trust with you by keeping you informed about the activities of this firm.

b) Origin and conservation period: The data has been provided to us by you or your legal representative and we will keep it, in general, as long as you do not object to the processing and subsequently, duly blocked, during the period legally provided for the possible defense and filing of claims.

c) Data types that we can process are identification and job occupation.

d) Communication of your data: We do not transfer your personal data to third parties or entities for their use. However, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• ENVISION NEW MEDIA (web hosting)
• E-goi LDA (e-mail marketing platform)
• Microsoft Ireland Operations Ltd (Office 365)
• SALESFORCE.COM SARL

e) International data transfers: They are not produced.

a) Purpose and legitimacy of the treatment: Your personal data is necessary to process and respond to the communication made by you based on the legitimate interest in providing adequate service to our clients and users.

b) Origin and conservation period: The data has been provided to us by you or your legal representative and we will keep it as long as it is necessary to respond to your communication and subsequently during the period legally provided for the possible defense and filing of claims.

c) Data typesthat we can process are identification and job occupation.

d) Communication of your data: We do not transfer your personal data to third parties or entities for their use. However, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• ENVISION NEW MEDIA (web hosting)
• Microsoft Ireland Operations Ltd (Office 365)
• SALESFORCE.COM SARL

e) International data transfers: They are not produced.

a) Purpose and legitimation of the treatment: in the event that you. go to one of our firm's facilities, Elzaburu will process your data for security purposes, including the recording of your image for video surveillance purposes, based on the legitimate interest that the firm has in being able to carry out identification, control and security within its facilities, which coincides with the public interest.

b) Origin and conservation period: Your data will be kept for these purposes for a maximum period of one month from when it is collected, except in those cases in which it must be kept to prove the commission of acts that threaten the integrity of people, property or facilities.

c) Data types that we can process are identifying you, including the capture of your image.

d) Communication of your data: We may share your data with the following entities and/or people:

• State Security Forces and Bodies
• Courts and Tribunals and other conflict resolution bodies
• Insurance companies and insurance intermediaries
• Third parties involved in a possible claim related to video recorded images

In addition, the following suppliers of ours may have access to your personal data depending on the services they provide to us:

• Securitas Direct España, SA

e) International data transfers: They do not occur.

a) Purpose and legitimacy of the treatment: We will process your personal data to process your complaint, carry out the relevant internal investigation in order to supervise the possible commission of criminal or irregular acts in accordance with the external and internal regulations applicable to ELZABURU, and, where appropriate, undertake administrative or judicial actions. that are appropriate.
We are legitimate for this processing of your data based on the provisions of Law 02/2023, regulating the protection of people who report regulatory infractions and the fight against corruption, due to the existence of a public interest in the systems. of internal complaints, as well as because it is necessary for our legitimate interest in supervising possible illegal or irregular activities that may affect the company, and in certain cases for compliance with other legal obligations.
b) Conservation period: We will keep your personal information until the end of the investigations if the facts have not been proven as long as they are not necessary for other purposes or for evidentiary purposes of due control and supervision in the prevention of crimes. If the facts are proven, the data will be kept as long as it is necessary for the company to exercise its rights in court. However, your data will only be kept in our Internal Information System for 3 months and in accordance with applicable regulations.
c) Who we share your data with: Your data will be treated with the utmost confidentiality and only in the event that the reported event gives rise to administrative or judicial actions, the data provided may be communicated to the competent authorities for investigation and sanction (Courts and tribunals or other resolution bodies). of conflicts, State Security Forces and Corps or Prosecutor's Office), as well as the relevant persons involved in the subsequent investigation.
On the other hand, the following suppliers of ours may need to access some of your personal data that we use in order to provide us with their services: • Consulting and legal advisory firms to defend our interests and rights.
• Attorneys for legal representation in judicial proceedings.
• Our provider of the technological solution for our Internal Information System. ELZABURU applies strict controls in the selection and contracting of its suppliers, in order to guarantee that they will only be able to access your personal data for the sole purpose of providing us with the contracted service, following our instructions, applying strict protection measures and without being able to use them for no other purpose nor, in general, share them with third parties.
d) International data transfers:
In relation to the indicated purpose, your data will not be processed or accessible from outside the European Economic Area (EEA), except in the event that we must process a claim and/or legal action outside EEA territory, sharing your data with our advisors. and representatives in the place where the procedure is carried out, as well as with the competent public organizations in said destination. The transfer of your data is legitimized because it is necessary for reasons of public interest and/or for the formulation, exercise or defense of claims.