PRIVACY POLICY

Understand how we protect and manage your personal data.

Select a policy to learn how we process your personal data.

WebsiteBrowsing, forms and communications.

PRIVACY POLICY WEBSITE

The PLAIN CONCEPTS Group is committed to protecting your privacy and to complying with data protection legislation, in particular the General Data Protection Regulation (hereinafter, GDPR) and the personal data protection legislation applicable in each country where the different companies of the PLAIN CONCEPTS Group are established. Any processing of personal data carried out by PLAIN CONCEPTS will be performed in accordance with the principles of lawfulness, fairness, transparency and purpose limitation, always for specified, explicit and legitimate purposes. PLAIN CONCEPTS undertakes to keep its data up to date and to retain it only for as long as necessary to fulfil the purposes of the processing.

This website is owned by PLAIN CONCEPTS, S.L.U. (hereinafter, PLAIN CONCEPTS), an entity of Spanish nationality with its registered office in Spain (a State belonging to the European Union and the European Economic Area), Controller of the personal data collected through this website. You may consult the information relating to the entity that manages the website by accessing the link entitled Legal Notice which is included at the foot of the web page.

This Privacy Policy informs you of the manner in which PLAIN CONCEPTS will process your personal data as a result of using this website.

By using this website, you accept the collection, processing, transfer, retention and other aspects relating to the processing of your personal data in accordance with this Privacy Policy and its terms. If you do not fully agree with them, you should not use this website.

Any update or amendment to this Privacy Policy will be communicated to you through this website.

1.- Who is the controller of your personal data?

The Controller is PLAIN CONCEPTS, S.L.U. (a company belonging to the PLAIN CONCEPTS Group) with tax ID (CIF): B24532178 and registered office at C/ Gran Vía Don Diego López de Haro, 1, 8th floor, 48001 Bilbao (Biscay), Spain.

If you have any doubt relating to the processing of your personal data, do not understand, or need this Privacy Policy translated into another language, you may contact us at the address gdpr@plainconcepts.com.

We also inform you that PLAIN CONCEPTS has an appointed Data Protection Officer (hereinafter, DPO), whom you may contact at the address dpo@leasba.com.

2.- What personal data do we process and how do we obtain it?

For the purposes of this Privacy Policy, “personal data” is considered to be any information that identifies you or that could be used to identify you.

The personal data processed by PLAIN CONCEPTS are:

That which you provide to us when completing the necessary fields in the contact forms for the correct handling of your enquiry and/or request and any other data you may voluntarily provide in each of the contact forms on the website.
That which you may provide to us through the various email accounts or other means of communication made available to you on the website for contacting PLAIN CONCEPTS.
That which you provide to us to register for the Newsletter service. PLAIN CONCEPTS will only process the personal data necessary to fulfil the purpose of registering for the service; this data is your name and email address.
Data relating to the user's activity on the platform, including information generated as a result of your interaction with the available features and content.

3.- For what purpose do we process your data?

PLAIN CONCEPTS will process your personal data for the following purposes:

To respond to and deal with any enquiries or requests you may make.
To manage your subscription to the PLAIN CONCEPTS Newsletter, and therefore to send you, by electronic means, information of interest about conferences, events, projects, activities, news and any other information of interest regarding PLAIN CONCEPTS.
To respond to your application for a job vacancy through the relevant contact form and to carry out the necessary steps for processing your application (In this case, the Recruitment Privacy Policy will apply, which you will accept before submitting your application).
For sending commercial communications by electronic means.
To manage and analyse the user's activity on the platform, as well as their interaction with the available features and content, in order to ensure correct functioning and improve the user experience.
To use it for any other purpose required or permitted by the applicable legislation or when you have given your express consent.

4.- What is the legal basis for the processing of your personal data?

The legal bases, in accordance with Article 6 of the GDPR, for the processing of your personal data are as follows:

Consent of the data subject (you) (Art. 6.1.a GDPR): for the processing of your personal data for the Newsletter subscription, the sending of commercial communications and the processing of the data you provide through the contact forms made available to you on the website, the legal basis that legitimises the processing is your consent, which you give by accepting this Privacy Policy when ticking the box I have read and accept the Privacy Policy or similar.
Compliance with a legal obligation (Art. 6.1.c GDPR): some of your personal data may be processed in order to comply with legal obligations in force that apply to PLAIN CONCEPTS. When this happens, you will be informed of the details of the processing, as well as of the rule requiring the specific processing.
Legitimate interest of PLAIN CONCEPTS (Art. 6.1.f GDPR): when you contact PLAIN CONCEPTS through any means of communication made available to you on the website (email, telephone number, social media), the legal basis that legitimises the processing is our legitimate interest in dealing with and responding to your request, enquiry or request for information. PLAIN CONCEPTS has a legitimate interest in managing and analysing users' activity on the platform, ensuring its correct functioning and improving the user experience.

5.- To whom will your data be disclosed?

Your personal data may be disclosed to the following groups:

Organisations or persons directly related to the Controller (Service providers): for reasons of business or professional collaboration or the engagement of services. With all those organisations, companies or persons with whom a relationship involving the disclosure of personal data is established, the requisite Data Processing Agreement will be signed, setting out the obligations regarding security and the purposes of the processing.

If any of these companies, organisations or persons are located in countries outside the EEA (European Economic Area) that do not have sufficient and adequate personal data protection guarantees, or where no adequacy decision exists and this entails a risk to the privacy of the personal data, PLAIN CONCEPTS will ensure that it has appropriate measures in place and will sign the Standard Contractual Clauses (SCCs) in accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 OF 4 JUNE 2021, so that your data is protected at all times on identical or similar terms to those provided for under European legislation.

Companies belonging to the PLAIN CONCEPTS Group: your personal data may be disclosed to other companies belonging to the PLAIN CONCEPTS Group where necessary for internal administration purposes or for the provision of specific services necessary for the proper development and performance of the processing activities. Some of the Group companies are established outside the European Economic Area (EEA), which may involve international transfers of personal data. Such transfers are regulated and described in greater detail in section 7 of this document, relating to international data transfers.

6.- For how long will we retain your data?

The data will be retained for as long as the data subject does not exercise their right to erasure, or for as long as necessary to maintain the purpose of the processing. However, the data will be retained for the relevant period in order to comply with legal obligations, for the applicable limitation periods to address any liabilities arising during the processing. In this case, the data will be retained duly blocked until the limitation period for any legal liabilities associated with the processing has expired. Where the data is erased, this will be done applying appropriate security measures to guarantee its complete destruction.

7.- Transfer of data to third countries

For the purposes of sending the Newsletter and other commercial communications, managing your requests and collecting data from forms and emails, it may be necessary for some data to be transferred to non-European countries (to which you consent by accepting this Policy), such as the USA, in respect of which there is a European Commission adequacy decision (EU-US Data Privacy Framework decision of 10 July 2023).

Specifically, data transfers to third countries may take place when using the services of the provider ActiveCampaign, LLC, which may, in accordance with its Privacy Policy (https://www.activecampaign.com/legal/privacy-policy) transfer information to other Group affiliates and external entities located outside the European Economic Area that provide services to it under a contract. Such transfers are carried out on the basis of the Adequacy Decisions approved by the European Union. However, this company has incorporated Standard Contractual Clauses (SCCs) into the contracts entered into between the parties, approved by the European Commission, which enable secure processing in accordance with current data protection regulations.

Furthermore, some of the companies of the PLAIN CONCEPTS group are located outside the European Economic Area, which entails an international transfer of data. Specifically, to the following Group companies:

PLAIN CONCEPTS CORP INC. (United States of America): the USA offers an adequate level of personal data protection, as there is a European Commission adequacy decision in this regard (EU-US Data Privacy Framework decision of 10 July 2023).
PLAIN CONCEPTS UK LTD (United Kingdom): the safeguard for this international data transfer is based on the existence of a European Commission Adequacy Decision: Commission Implementing Decision (EU) 2021/1772 of 28 June 2021.

8.- What are your rights?

The data subject (you) may exercise the rights afforded to them under the current data protection legislation. In particular:

Right of access to your personal data: You have the right to obtain confirmation from the controller as to whether or not your personal data is being processed, and whether an international transfer of that data is taking place.
Right to rectification of inaccurate or erroneous data: You have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.
Right to erasure (“right to be forgotten”): You have the right to obtain the erasure of your personal data without undue delay when:

The personal data is no longer necessary in relation to the purpose for which it was collected.
The data is out of date.
The data subject withdraws consent. This withdrawal of consent will not affect the lawfulness of processing carried out previously on the basis of the relevant legal ground.
It has been used unlawfully.

Right to data portability: you have the right to have the controller transmit your data to another controller, which will be done in a structured, commonly used and machine-readable format where the processing is carried out by automated means.
Right to restriction of processing: in certain circumstances, you may request the restriction of the processing of your data, in which case it will only be retained, duly blocked, for the exercise or defence of claims.
Right to object: you may object to the processing of your personal data in certain circumstances and on grounds relating to your particular situation. In this case, PLAIN CONCEPTS will cease to process such personal data, except where there are compelling legitimate grounds or for the exercise or defence of possible claims.

The data subject may exercise their rights by sending an email to the address gdpr@plainconcepts.com, indicating the reason for your request and the right you wish to exercise. Where we consider it necessary, because there are reasonable doubts as to your identity, we may ask you for a copy of a document proving your identity. You may also send a communication to the Data Protection Officer by emailing dpo@leasba.com.

In those cases where you feel that your rights concerning the protection of your personal data have been infringed, especially where you have not obtained satisfaction in the exercise of your rights, you may lodge a complaint with the supervisory authority for data protection, specifically the Spanish Data Protection Agency, through its website: www.aepd.es.

Since the PLAIN CONCEPTS Group processes data in different EU Member States, your main point of contact may be a supervisory authority of another EU Member State, whose contact details you can find at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

9.- Links to other websites

The PLAIN CONCEPTS websites may contain links to other websites, which we may consider useful to you. However, PLAIN CONCEPTS is not responsible for the content published on such websites, nor for their Privacy Policies. PLAIN CONCEPTS recommends that you carefully review the Privacy Policies before using these websites, to ensure that you agree with the information being collected.

10.- Policy on use by minors

This website is not directed at minors in accordance with the applicable legislation in force. Parents, guardians or legal representatives will be solely responsible for all actions carried out on this website by any minors in their care, including the completion of forms with the personal data of such minors and, where applicable, the ticking of the boxes accompanying them.

11.- Security Measures

PLAIN CONCEPTS applies all the security measures required by personal data protection legislation, with the aim of protecting your rights and freedoms. PLAIN CONCEPTS applies the measures necessary to guarantee the confidentiality of the personal data of all persons under its responsibility.

12.- Privacy Policy Modifications

PLAIN CONCEPTS reserves the right to amend or update this Privacy Policy at any time. Should any clause of this Privacy Policy be annulled or deemed void, the remaining conditions will not be affected, retaining full validity and effect in accordance with the legislation in force at any given time.

13.- Information on Cookies

This website may use Cookies. For further information, please see our Cookie Policy.

EventsRegistration and participation in our events.

PRIVACY POLICY FOR EVENTS

This website is owned by PLAIN CONCEPTS, S.L.U. (hereinafter, PLAIN CONCEPTS), an entity of Spanish nationality with its registered office in Spain (a State belonging to the European Union and the European Economic Area), controller of the personal data collected through this website. You may consult the information relating to the entity that manages the website by accessing the link entitled Legal Notice which is included at the foot of the web page.

This Privacy Policy informs you about how PLAIN CONCEPTS will process your personal data as a result of your participation in a PLAIN CONCEPTS event.

Please read the following information carefully and make sure you understand it. If you are going to attend the event accompanied by other people, before providing PLAIN CONCEPTS with the personal data of your companions, make sure you inform them about the processing of their personal data in accordance with this Privacy Policy.

Any update or amendment to this Privacy Policy will be communicated to you through this website.

1. Who is the Controller of your personal data?

We also inform you that PLAIN CONCEPTS has an appointed Data Protection Officer (hereinafter, DPO), whom you may contact at the address dpo@leasba.com.

2. What personal data do we process and how do we obtain it?

The personal data processed by PLAIN CONCEPTS are that which you provide to us when completing the event registration form or application, or in connection with any PLAIN CONCEPTS event in which you have taken part. Where applicable, PLAIN CONCEPTS will process your image and/or voice where you appear in the photographs or videos taken during the event.

PLAIN CONCEPTS may also process data relating to disabilities or food allergies or intolerances that you may provide, taking into account the specific characteristics of the event and in order to ensure a satisfactory level of care.

3. For what purpose do we process your personal data?

PLAIN CONCEPTS will process your personal data for the following purposes:

Registration and sending of the invitation to the event and, where applicable, sending of the satisfaction survey.
Management of your involvement, participation or collaboration in the event.
Access control at the venue where the event takes place.
For the purpose of promoting the PLAIN CONCEPTS brand, the creation and/or editing of photographs and videos taken during the event for their subsequent dissemination in lawful media and on PLAIN CONCEPTS' social media profiles.

4. What is the legal basis for the processing of your personal data?

The legal bases, in accordance with Article 6 of the GDPR, for the processing of your personal data are as follows:

For the purposes mentioned in points a), b) and c) of the previous section, the legal basis is the legitimate interest of PLAIN CONCEPTS (Art 6.1.f GDPR), for the correct management of your participation and attendance at the event you have requested, to guarantee the security of the premises where the event takes place, and, where applicable, to gauge attendees' level of satisfaction.
For the collection of images and/or voice recordings taken during the event, point d) of the previous section, we distinguish between:

Wide shots – (where you are not identifiable): The legal basis is the legitimate interest of PLAIN CONCEPTS (Art 6.1.f GDPR), for the advertising and promotion of the PLAIN CONCEPTS brand.
Close-up shots – (where you are identifiable): The legal basis is your consent (Art 6.1.a GDPR) which will be requested from you on a case-by-case basis. By giving your consent, you will be authorising the transfer/licensing of your image and/or voice rights free of charge, for use in all known lawful media, present or future, and without geographical limitation. You may withdraw your consent at any time; however, the withdrawal of consent can never be retroactive, and will therefore not affect the lawfulness of the processing based on consent prior to its withdrawal. These close-up shots may be taken directly by the PLAIN CONCEPTS team or by contracted third parties.

5. To whom will your data be disclosed?

Your personal data may be disclosed to the following groups:

Companies belonging to the PLAIN CONCEPTS group: In some cases, your personal data will be disclosed to other companies belonging to the PLAIN CONCEPTS group, for internal administration purposes, where the event is international in nature and requires the involvement of all or some of the Group companies. Accordingly, by registering, or where applicable purchasing a ticket, for your participation in the event, and by accepting this Policy, you are giving your explicit consent for your data to be disclosed to the companies belonging to the group, always in accordance with the purposes described above.
Sponsors/Partners/Collaborating companies: Some events may be organised jointly with other companies in the sector, with which a collaboration agreement is in place, and attendees' data may be disclosed to these companies or organisations in order to inform you about the products or services they provide, as well as to carry out marketing activities related to them. By accepting this Policy, you confirm that you are aware of these disclosures and give your consent to your data being disclosed to these companies.
Companies or organisations directly related to the controller: Your data may be disclosed to external service providers directly related to PLAIN CONCEPTS (processors), which are necessary for the organisation and running of the event, such as security companies, owners of the venues or premises where the event takes place, catering services, companies responsible for issuing accreditations, companies responsible for taking and editing photographs, etc. PLAIN CONCEPTS has signed the corresponding data processing agreements with all these companies (processors), setting out the obligations regarding security and the purposes of the processing.
Social media: PLAIN CONCEPTS may make posts on the company's social media profiles, where your image and/or voice will be processed. If you are directly identifiable, your prior consent will be requested, in accordance with section 4 of this privacy policy, and you will be informed of the details of this processing. These will process your data in accordance with the rules and privacy policy established for that purpose by each of them.

Any international data transfers to these and other recipients are analysed in point 7 of this Policy.

6. For how long do we retain your data?

PLAIN CONCEPTS will retain your personal data for the management of, and access to, the event, until it has ended. Your image and/or voice will be retained until you exercise the right to erasure or withdraw your consent in accordance with section 4. However, the data will be retained for the relevant period in order to comply with legal obligations, for the applicable limitation periods to address any liabilities arising during the processing. In this case, the data will be retained duly blocked until the limitation period for any legal liabilities associated with the processing has expired.

7. International data transfers

The following data transfers to third countries outside the European Union may exist:

Sponsors/Partners/Collaborating companies: These collaborators may be located outside the European Economic Area, meaning that international data transfers will take place. Where there is no European Commission adequacy decision in respect of the third country, PLAIN CONCEPTS will ensure that appropriate safeguards are in place so that the data is protected on identical or similar terms to those provided for under European legislation, for example through Standard Contractual Clauses.
Companies or organisations directly related to the Controller: Where any of these companies is located outside the European Economic Area and an international data transfer takes place to a third country, which in some cases entails certain risks to your privacy due to the absence of a European Commission adequacy decision, PLAIN CONCEPTS will ensure that appropriate safeguards are in place, such as Standard Contractual Clauses, so that the data is protected on identical or similar terms to those provided for under European legislation.
Eventbrite: Specifically, PLAIN CONCEPTS uses the Eventbrite platform for the entire process of managing, the management of free and paid ticketing for the events it organises. The processing of your personal data through this platform will be carried out in accordance with Eventbrite's privacy policy, which you can find at the following link:

https://www.eventbrite.es/help/es/articles/460838/politica-de-privacidad-de-eventbrite/.

Eventbrite will act as processor of your personal data and is subject to a data processing agreement (DPA), incorporated into the terms and conditions of the service acquired by PLAIN CONCEPTS. This agreement includes Eventbrite's legal obligations as processor in accordance with the GDPR, which you can consult at the following link: https://www.eventbrite.es/help/es/articles/429030/anexo-de-procesamiento-de-datos-para-organizadores/.

Eventbrite physically stores personal data in the United States of America, meaning that an international transfer of data takes place to a third country outside the European Economic Area. The United States has a European Commission adequacy decision (EU-US Data Privacy Framework decision of 10 July 2023).

Social media: Some of the social media platforms used by PLAIN CONCEPTS involve international data transfers to third countries. These will process your data in accordance with the rules and privacy policy established for that purpose by each of them.
Companies belonging to the PLAIN CONCEPTS group: Some of the companies of the PLAIN CONCEPTS group are located outside the European Economic Area, which entails an international transfer of data. Specifically, to the following Group companies:

PLAIN CONCEPTS CORP INC. (United States of America): the USA offers an adequate level of personal data protection, as there is a European Commission adequacy decision in this regard: EU-US Data Privacy Framework decision of 10 July 2023.
PLAIN CONCEPTS UK LTD (United Kingdom): the safeguard for this international data transfer is based on the existence of a European Commission Adequacy Decision: Commission Implementing Decision (EU) 2021/1772 of 28 June 2021.

8. What are your rights?

The data subject may exercise the rights afforded to them under the current data protection legislation. In particular:

Right of access to your personal data: You have the right to obtain confirmation from the controller as to whether or not your personal data is being processed and whether an international transfer of that data is taking place.
Right to rectification of inaccurate or erroneous data: You have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.
Right to erasure (“right to be forgotten”): You have the right to obtain the erasure of your personal data without undue delay when:

The personal data is no longer necessary in relation to the purpose for which it was collected.
The data is out of date.
The data subject withdraws consent. This withdrawal of consent will not affect the lawfulness of processing carried out previously on the basis of the relevant legal basis.
It has been used unlawfully.

Right to data portability: you have the right to have the controller transmit your data to another controller, which will be done in a structured, commonly used and machine-readable format where the processing is carried out by automated means.
Right to restriction of processing: in certain circumstances, you may request the restriction of the processing of your data, in which case it will only be retained, duly blocked, for the exercise or defence of claims.
Right to object: you may object to the processing of your personal data in certain circumstances and on grounds relating to your particular situation. In this case, PLAIN CONCEPTS will cease to process such personal data, except where there are compelling legitimate grounds or for the exercise or defence of possible claims.

9. Security Measures

10. Privacy Policy Modifications

Suppliers and partnersOur relationship with suppliers and partners.

PRIVACY POLICY FOR SUPPLIERS AND PARTNERS

The PLAIN CONCEPTS Group is committed to the protection of your privacy and to compliance with the legislation on the protection of personal data, specifically with the General Data Protection Regulation (hereinafter, GDPR) and the personal data protection legislation applicable in each country where the different companies of the PLAIN CONCEPTS Group are domiciled. The processing of personal data carried out by PLAIN CONCEPTS will be carried out in accordance with the principles of lawfulness, fairness and transparency, always in accordance with specific, explicit and legitimate purposes. PLAIN CONCEPTS undertakes to keep your data up to date and to keep them only for the time necessary to comply with the purposes of the processing, the legal provisions and the deadlines for demanding possible liabilities arising from the processing.

PLAIN CONCEPTS has implemented the necessary technical and organisational measures to protect your data against accidental loss, alteration, unauthorised use or disclosure. It has also established procedures to react to any security incident that may affect your personal data.

This Privacy Policy applies to the management of the personal data of the Suppliers and/or Potential Suppliers, as well as the personal data of their representatives and contact persons, in the event that the Suppliers and/or Potential Suppliers are legal entities.

Please read this Policy carefully and make sure you understand the information it contains.

Any updates and/or modifications made to this Privacy Policy will be communicated to you in a timely manner through this website.

1.- Who is responsible for the processing of your personal data?

The Data Controller of your data is the company of the Plain Concepts Group with which you have a contractual relationship and whose data appear in the contractual documentation.

Company	Address
Plain Global Solutions S.L.	C/ Gran Vía Don Diego Lopez Haro 1 8º (Bilbao) – Spain.
Plain Concepts S.L.U.	C/ Gran Vía Don Diego Lopez Haro 1 8º (Bilbao) – Spain.
Plain Concepts UK LTD	Delta Place, 27 Bath Road, Cheltenham, Gloucestershire GL53 7TH (U.K.).
Plain Concepts Corporation INC	8201 164th Ave Ne, Redmond, WA 98052 (USA) .
Plain Concepts GmbH	c/o KRIEGER GmbH Steuerberatungsgesellschaft, Berliner Straße 51, 60311 Frankfurt am Main (Germany).
Plain Concepts RO S.R.L.	Bucureşti Sectorul 1, Calea VICTORIEI, Nr. 145, MODUL 1.25, Etaj 1, Cod poștal 10072 (Romania).
Ardanis Technologies Ltd,	The Greenway, Ardilaun Court, 112-114 St. Stephens Green, Dublin 2 D02 TD28 (Ireland).
Ardanis Portugal, Lda	Rua de Candido dos Reis n. 81 4050-152 – Porto (Portugal).
Apiumhub S.L.	Calle Consell de Cent, 333 – P. 7 8007- Barcelona. (Spain).
Apium Education S.L	Calle Consell de Cent, 333 – P. 7 8007- Barcelona. (Spain).

Where the contract is entered into by Plain Concepts UK LDT, Plain Concepts Corporation INC, Plain Concepts GmbH, Plain Concepts RO S.R.L., Apiumhub S.L., Apium Education S.L., Ardanis Technologies Ltd and Ardanis Portugal Lda, Plain Concepts S.L.U. will act as joint data controller.

If you have any questions about who is responsible for your data, you can send an inquiry to the email address: gdpr@plainconcepts.com.

PLAIN CONCEPTS has a Data Protection Officer (DPO), who you can contact by sending an email to dpo@leasba.com in order to resolve any questions regarding this Privacy Policy.

2.- What personal data do we process and how do we obtain it?

The personal data processed by PLAIN CONCEPTS come from the data subject, who provides them during the registration process in the Register of Suppliers and, where appropriate, throughout the contracting process and throughout the term of the contractual relationship.

The personal data that are processed by PLAIN CONCEPTS are:

Identification data: name and surname, postal and email address, telephone number, NIF/DNI/NIE, passport or any other similar identity document and signature.
Commercial data or conditions: services provided, activities and business and, where applicable, commercial licenses.
Data relating to transactions of goods and services: financial transactions, compensation, etc.
Bank details: such as, for example: account number.
Employment data: Profession, job position, training, qualifications.

If you do not provide us with the personal data requested, it is likely that we will not be able to register you in the Register of Suppliers, comply with the contractual relationship, manage the activity and comply with legal obligations.

Likewise, PLAIN CONCEPTS, in accordance with its internal procedure for managing suppliers and potential suppliers and in compliance with the established guidelines on risk management, may obtain information from third parties.

3.- For what purposes are personal data processed?

The personal data that is requested and collected by PLAIN CONCEPTS is strictly necessary to comply with the following purposes:

Participation in the supplier qualification and selection process within the framework of its risk management standards and procedures.
Periodic verification of compliance with all the requirements required to be a Supplier of PLAIN CONCEPTS, as well as the appropriate economic and financial situation.
Management of the contractual relationship with suppliers in all its aspects.
Internal management and communication between the Group's organisations on matters relating to supplier relations.
Administrative, collection and payment management.
Sending commercial communications related to sustainability, ethics and compliance.
Comply with legal obligations and requirements from government and judicial bodies.

4.- What is the legitimacy for the processing of your data?

The legal basis for processing your data is different depending on the purpose for which the data is intended:

Performance of a contract (art. 6.1 b) GDPR): for the purposes of paragraphs a), b), c) and e), the legal basis is the performance of a contract to which you are a party or for the application of pre-contractual measures, in particular in the case of the qualification and selection process of suppliers.
Compliance with legal obligations (art. 6.1.c) GDPR): for the purposes of section g), the legitimacy is based on compliance with the legal obligations imposed on PLAIN CONCEPTS.
Legitimate interest of the controller (art. 6.1 f) GDPR): the legitimacy for the purpose set out in section d), is based on the legitimate interest of PLAIN CONCEPTS in the management of the present and future relationship with you as a representative of a supplier, legal person or contact person, or as a natural person.
Consent of the data subject (art. 6.1.a) GDPR): the legitimacy for the purpose set out in section f), is based on the consent granted by you for the sending of commercial communications.

On the basis of legitimate interest and in accordance with Recital 48 GDPR, all entities that are part of the PLAIN CONCEPTS Group may communicate data with each other for internal administrative purposes, supplier control, relationship management and risk management.

5.- To whom will your data be communicated?

Your personal data, whether natural person or representative or contact person in the case of a legal person, may be communicated to third parties and relevant bodies when necessary for the fulfilment of the purposes set out above.

Specifically, the data will be communicated to:

Public records.
Tax Administration.
Other Public Administration bodies.
Banks and financial institutions.
Insurance companies.
Organisations or persons directly related to the Data Controller (Service Providers): for needs of business, professional collaboration or contracting of services. With all those organizations, companies or persons with whom a relationship is established that involves the communication of personal data, the mandatory Data Processing Contract will be signed where the obligations in terms of security and purposes of the processing are specified.

If any of these companies, organizations or individuals are located in countries outside the EEA (European Economic Area) that do not have sufficient and adequate data protection safeguards or there is no adequacy decision and this poses a risk to the privacy of personal data, PLAIN CONCEPTS will ensure that it has the appropriate measures in place and that it signs the Standard Contractual Clauses (SCCs) in accordance with the DECISION COMMISSION IMPLEMENTING ACT (EU) 2021/914 OF 4 JUNE 2021, SO THAT YOUR DATA IS PROTECTED AT ALL TIMES IN TERMS IDENTICAL OR SIMILAR TO THOSE PROVIDED FOR IN EUROPEAN REGULATIONS.

PLAIN CONCEPTS Group Companies: Some of the group companies are established outside the European Economic Area (EEA), which may involve international transfers of personal data. Such transfers are regulated and described in more detail in section 6 of this document, concerning international data transfers.

6.- International data transfers

In the processing of personal data relating to the management of suppliers, international transfers to third countries may take place, in particular to:

PLAIN CONCEPTS GROUP COMPANIES OUTSIDE THE EEA: the transfer of data to companies located in third countries is carried out for the purpose of collaboration between the different companies of the Group, administration, execution and development of projects for the provision of services to customers.

The personal data that are subject to transfer are only the personal identification and professional data that are essential for internal administrative purposes, supplier control, relationship management and risk management.

Therefore, international data transfers are planned to the following companies in the Group:

PLAIN CONCEPTS CORP INC. (United States of America): U.S. The US has an adequate level of protection for personal data, as there is an adequacy decision by the European Commission (EU- USA Data Privacy Framework Decision of 10 July 2023).
PLAIN CONCEPTS UK LTD (United Kingdom): The guarantee for this international transfer of data is based on the existence of an Adequacy Decision of the European Commission: Commission Implementing Decision (EU) 2021/1772 of 28 June 2021.

7.- How long do we keep your data?

PLAIN CONCEPTS will keep your personal data for the duration of the current commercial relationship. In addition, for the sending of commercial communications, they will be maintained as long as you do not withdraw your consent to them. This, without prejudice to the retention of the data during the period established to comply with the legally established obligations and to deal with possible claims that may arise in relation to the processing of the data. During this period of time, the data will be kept duly blocked.

8.- What are your rights?

The data subject may exercise the rights available to them under applicable data protection legislation under current data protection legislation. Specifically:

Right of access to your personal data: You have the right to obtain confirmation from the controller as to which of your personal data is being processed or not and whether an international transfer of your personal data is taking place.
Right to rectification of inaccurate or erroneous data: You have the right to obtain without undue delay from the controller the rectification of inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed for you, including by means of an additional statement.
Right to erasure ("right to be forgotten"): You have the right to obtain erasure of your personal data without undue delay where:

The personal data is no longer necessary in relation to the purpose for which it was collected.
The data is out of date.
The consent is withdrawn by the data subject. This withdrawal of consent will not affect the lawfulness of the processing that has been previously carried out on the basis of the corresponding legitimation.
Have been used unlawfully.

Right to data portability: you have the right to have the Data Controller transmit your data to another Data Controller, which will be carried out using a structured format that is commonly used and machine-readable when the processing is carried out by automated means.
Right to restriction of processing: in certain circumstances, you may request the limitation of the processing of your data, in which case it will only be kept duly blocked for the exercise or defence of claims.
Right to object: You may object to the processing of your personal data in certain circumstances and for reasons relating to your particular situation. In this case, PLAIN CONCEPTS will stop processing said personal data, except in those cases in which there is an overriding legitimate interest or the exercise or defence of possible claims.

The data subject may exercise their rights by sending an email to the gdpr@plainconcepts.com address, indicating the reason for their request and the right they wish to exercise. If we consider it necessary, because there are reasonable doubts as to whether we can identify you, we may ask you to copy a document proving your identity. You can also send a communication to the Data Protection Officer by sending an email to dpo@leasba.com.

In those cases in which you feel that your rights regarding the protection of your personal data have been violated, especially when you have not obtained satisfaction in the exercise of your rights, you can file a complaint with the Data Protection Supervisory Authority, specifically the Spanish Data Protection Agency, through its website: www.aepd.es.

As the PLAIN CONCEPTS Group processes data in different EU Member States, your main point of contact may be a Supervisory Authority of another EU Member State, where you can find the relevant contact details at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

9. Security Measures

PLAIN CONCEPTS applies all the security measures required by the regulations on the protection of personal data, with the aim of protecting your rights and freedoms. PLAIN CONCEPTS applies the necessary measures to guarantee the confidentiality of the personal data of all persons under its responsibility.

10.- Use of Artificial Intelligence in the processing of your personal data

PLAIN CONCEPTS may use Artificial Intelligence (AI) systems as a support tool in certain processes related to supplier management, such as supplier qualification and evaluation, risk analysis or document management, in accordance with Regulation (EU) 2024/1689 establishing harmonised standards on Artificial Intelligence.

The use of AI systems by PLAIN CONCEPTS is subject, in any case, to the following guarantees:

Human oversight: no decision that produces legal effects on you or significantly affects you will be taken in an exclusively automated manner, without the possibility of human intervention.
Minimisation and purpose: AI systems will only process personal data that is strictly necessary for the purposes described in this Policy.
Transparency: where a processing includes an AI system that may affect you, PLAIN CONCEPTS will provide you with additional information on how it works, upon request via dpo@leasba.com.
AI providers: when PLAIN CONCEPTS uses external providers of Artificial Intelligence services for the processing of personal data, they will act as data processors in accordance with Article 28 of the GDPR, having previously evaluated their data processing conditions.
Rights: You may exercise the rights described in section 8 above, including, where applicable, the right to request human intervention or to challenge a decision based solely on automated processing that produces legal effects on You.

Likewise, if You, as a Supplier and/or Potential Supplier, use Artificial Intelligence systems in the provision of your services that involve the processing of personal data on behalf of PLAIN CONCEPTS, you must previously inform PLAIN CONCEPTS of this and ensure that such use complies with the GDPR and Regulation (EU) 2024/1689.

11. Privacy Policy Modifications

PLAIN CONCEPTS reserves the right to modify or update this Privacy Policy at any time. In the event that any clause of this Privacy Policy is annulled or considered null and void, the rest of the conditions will not be affected, and will remain in full force and effect, in accordance with the regulations in force applicable at all times.

RecruitmentApplications and recruitment processes.

RECRUITMENT PRIVACY POLICY

The PLAIN CONCEPTS Group is committed to protecting your privacy and to complying with data protection legislation, in particular the General Data Protection Regulation (hereinafter, GDPR) and the personal data protection legislation applicable in each country where the different companies of the PLAIN CONCEPTS Group are established. Any processing of personal data carried out by PLAIN CONCEPTS will be performed in accordance with the principles of fairness, lawfulness, adequacy and transparency, always for specified, explicit and legitimate purposes. PLAIN CONCEPTS undertakes to keep its data up to date and to retain it only for as long as necessary to fulfil the purposes of the processing, the applicable legal provisions and the periods during which any liability arising from the processing may be demanded.

PLAIN CONCEPTS has implemented the technical and organisational measures necessary to protect its data against accidental loss, alteration, unauthorised use or disclosure. It has likewise established procedures to respond to any security incident that may affect your personal data.

This Privacy Policy informs you about how PLAIN CONCEPTS will process your personal data for the staff recruitment process. PLAIN CONCEPTS uses Workable, an online application provided by Workable Software Limited, to assist with our recruitment process. We use Workable to process personal information as a data processor on our behalf. Workable is only entitled to process your personal data in accordance with the instructions of PLAIN CONCEPTS.

Please read this Policy carefully and make sure you understand the information it contains.

Any update and/or amendment made to this document will be communicated to you in a timely manner for your information.

1. Who is the controller of your personal data?

The Controller, as manager of the recruitment process, is PLAIN CONCEPTS, S.L.U. (a company belonging to the Plain Concepts Group) with tax ID (CIF): B24532178 and registered office at C/ Gran Vía Don Diego López de Haro, 1, 8th floor, 48001 Bilbao (Biscay), Spain.

PLAIN CONCEPTS, S.L.U. manages the recruitment process for its own applications and for those of the following companies of the PLAIN CONCEPTS corporate Group:

Company	Address
Plain Concepts Corporation INC.	8201 164th Ave Ne, Redmond, WA 98052 (USA).
Plain Concepts UK LTD.	Delta Place, 27 Bath Road, Cheltenham, Gloucestershire GL53 7TH (U.K.).
Plain Concepts GmbH.	c/o KRIEGER GmbH Steuerberatungsgesellschaft, Berliner Straße 51, 60311 Frankfurt am Main (Germany).
Plain Concepts RO S.R.L.	Bucureşti Sectorul 1, Calea VICTORIEI, Nr. 145, MODUL 1.25, Etaj 1, postal code 10072 (Romania).
Apiumhub S.L.	Calle Consell de Cent, 333 – P. 7 8007- Barcelona. (Spain).
Apium Education S.L.	Calle Consell de Cent, 333 – P. 7 8007- Barcelona. (Spain).
Ardanis Technologies, Ltd	The Greenway, Ardilaun Court, 112-114 St. Stephens Green, Dublin 2 D02 TD28 (Ireland).
Ardanis Portugal, Lda	Rua de Candido dos Reis n. 81 4050-152 – Porto (Portugal).

If you have any doubt as to who is the Controller of your data, you may send an enquiry to the following email address: gdpr@plainconcepts.com.

PLAIN CONCEPTS has a Data Protection Officer (DPO), whom you may contact by sending an email to dpo@leasba.com in order to resolve any query relating to this Privacy Policy.

2. What personal data do we process and how do we obtain it?

The personal data processed by PLAIN CONCEPTS comes from the data subject, who provides it in the registration form for the relevant job offer.

The personal data processed by PLAIN CONCEPTS is:

Curriculum Vitae.
Name and Surname(s).
Email Address.
Telephone Number.
Any other personal data that the data subject may enter or attach in the registration form.

PLAIN CONCEPTS may request and process additional data, should you be successful in the recruitment process, such as: identity and/or passport number, social security number, bank details, family details, etc. In addition, PLAIN CONCEPTS may request or process any personal data necessary to complete the recruitment process, depending on the applicable legal obligations of the country where the Group company with the open vacancy is located.

If you do not provide us with the personal data requested, we may not be able to register you as a job candidate, manage your participation in the recruitment processes, deal with your application, comply with our legal obligations or manage our activity.

We ask that you update your personal data whenever it changes, and that you always provide accurate information, since we must hold your current information.

3. For what purposes is the personal data processed?

Your personal information will be processed for the following purposes:

To manage the recruitment processes for which you apply.
Should you be successful in the recruitment process, the additional data that PLAIN CONCEPTS requests or processes will be used to prepare all the administrative arrangements prior to and necessary for the employment engagement.
Your inclusion in a database of potential candidates (talent pool).
To invite you to take part in recruitment processes that match your professional profile.

4. What is the legal basis for the processing of your data?

The legal basis for the processing of your data is:

Consent, which you give by accepting this Policy (Article 6.1.a GDPR), for the purposes set out in points c) and d) of the previous point.
For the performance of a contract to which the data subject is party, or for the application of pre-contractual measures (Article 6.1.b GDPR), for the purposes set out in points a) and b) of the previous point.

5. To whom will your data be disclosed?

Personal data will be disclosed to the following recipients:

Companies belonging to the PLAIN CONCEPTS Group: personal data may, in certain cases, be disclosed to some or all of the companies forming part of the Group in order to manage different aspects of the recruitment process. Some of the Group companies are located outside the European Economic Area (EEA), which entails an international data transfer, which is analysed in detail in section six (6) of this Policy.
Organisations or persons directly related to PLAIN CONCEPTS: for reasons of business or professional collaboration or the engagement of services for the management of the staff recruitment process (Service providers). With all those organisations, companies or persons with whom a relationship involving the disclosure of personal data is established, the requisite Data Processing Agreement will be signed, setting out the obligations regarding security and the purposes of the processing.

Specifically:

Workable Software Limited.

PLAIN CONCEPTS uses Workable as a provider for the management of the staff recruitment process. In this case, Workable acts as a data processor and will process your data in accordance with its terms of use, which you may consult at the following link: https://www.workable.com/terms .

As an integral part of this Policy, supplementary information regarding the processing of your personal data when using the Workable service is added. You may find this information as Annex 1 to this document.

Factorial.

Once the recruitment process has been completed and if you have been selected, your data will be

transferred to the Human Resources management platform "FACTORIAL" owned by

EVERYDAY SOFTWARE, S.L. Once the employment relationship with you has been formalised, the

Employee Privacy Policy will apply.

6. International data transfers.

Data transfers to third countries outside the European Union are envisaged in the following cases:

Organisations or persons directly related to PLAIN CONCEPTS: If any of these companies, organisations or persons receiving the data for reasons of business or professional collaboration or the engagement of services for the management of the staff recruitment process (Service providers) are located in countries outside the EEA that do not offer sufficient and adequate personal data protection guarantees, or where no adequacy decision exists and this entails a risk to the privacy of the personal data, PLAIN CONCEPTS will ensure that it has appropriate measures in place and will sign the Standard Contractual Clauses (SCCs) in accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 OF 4 JUNE 2021, so that your data is protected at all times on identical or similar terms to those provided for under European legislation.

Specifically:

WORKABLE platform.

WORKABLE states the following: The data we collect from you and process using the Workable Services may be transferred to, and stored at, a destination outside the United Kingdom or the European Economic Area ("EEA"). It may also be processed by staff operating outside the United Kingdom or the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the fulfilment of your orders, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storage or processing.

In particular, your data may be accessible to i) Workable staff in the USA, or ii) Workable's hosting service provider, which may store it on servers in the USA as well as in the EU. The United States offers an adequate level of personal data protection, as there is a European Commission adequacy decision in this regard (EU-US Data Privacy Framework decision of 10 July 2023).

A Data Processor Agreement has been signed between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its data processors. These data processor agreements are designed to help safeguard your privacy rights and to provide you with remedies in the unlikely event of any misuse of your personal data.

For further information:

You may consult the following link: https://www.workable.com/terms.
Or send an enquiry to the following email address: support@workable.com.

PLAIN CONCEPTS Group companies outside the EEA: the transfer of data to companies located in third countries is carried out for the purpose of collaboration and management between the different companies of the Group.

Accordingly, international data transfers to the following Group companies are envisaged:

− PLAIN CONCEPTS CORP INC. (United States of America): the USA offers an adequate level of personal data protection, as there is a European Commission adequacy decision in this regard (EU-US Data Privacy Framework decision of 10 July 2023).

− PLAIN CONCEPTS UK LTD (United Kingdom): the safeguard for this international data transfer is based on the existence of a European Commission Adequacy Decision: Commission Implementing Decision (EU) 2021/1772 of 28 June 2021.

7. For how long do we retain the data?

The data will remain in the system for a period of 12 months. Once this period has elapsed, the personal data will be blocked until the limitation period for any legal liabilities associated with the processing has expired, after which it will be deleted. However, this 12-month period may be renewed whenever the data is updated or there is any kind of interaction with the candidate.

8. What are the rights of the data subject?

The data subject (you) may exercise the rights afforded to them under the current data protection legislation. In particular:

Right of access to your personal data: You have the right to obtain confirmation from the controller as to whether or not your personal data is being processed and whether an international transfer of that data is taking place.
Right to rectification of inaccurate or erroneous data: You have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.
Right to erasure (“right to be forgotten”): You have the right to obtain the erasure of your personal data without undue delay when:

The personal data is no longer necessary in relation to the purpose for which it was collected.
The data is out of date.
The data subject withdraws consent. This withdrawal of consent will not affect the lawfulness of processing carried out previously on the basis of the relevant legal ground.
It has been used unlawfully.

Right to data portability: you have the right to have the controller transmit your data to another controller, which will be done in a structured, commonly used and machine-readable format where the processing is carried out by automated means.
Right to restriction of processing: in certain circumstances, you may request the restriction of the processing of your data, in which case it will only be retained, duly blocked, for the exercise or defence of claims.
Right to object: you may object to the processing of your personal data in certain circumstances and on grounds relating to your particular situation. In this case, PLAIN CONCEPTS will cease to process such personal data, except where there are compelling legitimate grounds or for the exercise or defence of possible claims.

9. Security Measures

10. Privacy Policy Modifications

ANNEX 1

WORKABLE PRIVACY NOTICE

PLAIN CONCEPTS, S.L.U. (a company belonging to the Plain Concepts Group) with tax ID (CIF): B24532178 and registered office at C/ Gran Vía Don Diego López de Haro, 1, 8th floor, 48001 Bilbao (Biscay), Spain (hereinafter, PLAIN CONCEPTS), is committed to protecting and respecting your privacy. This Privacy Notice (an integral part of the Recruitment Privacy Policy) sets out the basis on which we will process the personal data you provide to us, in connection with our staff recruitment processes through the WORKABLE platform. Please read the following carefully to understand our views and practices regarding your personal data and how we will process it.

For the purposes of the General Data Protection Regulation ("GDPR"), the Controller is PLAIN CONCEPTS and the Processor is WORKABLE.

We use WORKABLE, an online application provided by Workable Software Limited, to assist with our recruitment process. We use WORKABLE to process personal information as a data processor on our behalf. WORKABLE is only entitled to process your personal data in accordance with the instructions given by PLAIN CONCEPTS.

When you apply for a vacancy published by PLAIN CONCEPTS, the provisions of this WORKABLE Privacy Notice (ANNEX 1) will apply to our processing of your personal information in addition to the foregoing provisions of our Recruitment Privacy Policy.

Your personal information

Information we collect from you:

We collect and process all or some of the following types of information about you:

Information you provide when you apply for a position. This includes information provided through an online job site, by email, in person at interviews and/or by any other method.
In particular, we process personal data such as name, email address, address, telephone number, date of birth, qualifications, experience, information relating to your employment history, the skills experience you provide to us, as well as your video should you conduct your interview using the Video Interview feature.
If you contact us, we may keep a record of that correspondence.
A record of your progress through any recruitment process we may carry out.
Details of your visits to the Workable website, including but not limited to traffic data, location data, weblogs and other communication data, the site that referred you to the Workable website and the resources you access.

Information we collect from other sources:

Workable gives us the ability to link the data you provide to us with other publicly available information about you that you have posted on the internet; this may include sources such as LinkedIn and other social media profiles.

Workable's technology allows us to search various databases, some publicly available and some not, which may include your personal data (including your CV or résumé), in order to find potential candidates to fill our vacancies. Where we find you in this way, we will obtain your personal data from these sources.

We may receive your personal data from a third party who recommends you as a candidate for a specific job offer or for our business in general.

Legal basis:

Legal basis for the processing.
We rely on legitimate interest as the legal basis on which we collect and use your personal data. Our legitimate interests are staff recruitment for our business.

Purposes of the processing

We use the information we hold about you in the following ways:

To consider your application in respect of a role for which you have applied.
To consider your application in respect of other roles.
To communicate with you regarding the recruitment process.
To improve any information we receive from you with information obtained from third-party data providers.
To find suitable candidates to fill our job vacancies.
To help our service providers (such as Workable and its processors and data providers) and partners (such as the job sites through which you have submitted your application) to improve their services.

Automated decision-making/profiling:

We may use Workable's technology to select suitable candidates for our consideration on the basis of criteria expressly identified by us, or typical in relation to the position for which you applied. The process of searching for suitable candidates is automatic; however, any decision as to whom we will hire to fill the vacancy will be taken by our staff.

Disclosure of your information:

As set out above, we pass your information to our external service providers, including Workable, who use it only in accordance with our instructions and as required by law.

Where you have applied for a job offer through another service provider, we may disclose data similar to the disposition data defined above to that service provider. The service provider will be the data controller of this data and will therefore be responsible for complying with all applicable laws regarding the use of that data after we transfer it.

How we store your personal data

Security:

We take appropriate measures to ensure that all personal data is kept secure, including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those who process your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected personal data security breach. We will notify you and any applicable regulator of a suspected personal data security breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means; therefore, any transmission is at your own risk.

Where we store your personal data:

When we store your personal data on our own systems, it is stored in the EEA.

The data we collect from you and process using the Workable Services may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the fulfilment of your orders, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storage or processing.

In particular, your data may be accessible to i) Workable staff in the USA, or ii) Workable's hosting service provider may store it on servers in the USA as well as in the EU. The USA does not have the same data protection laws as the United Kingdom and the EEA. A Data Processor Agreement has been signed between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its data processors. These data processor agreements are designed to help safeguard your privacy rights and to provide you with remedies in the unlikely event of any misuse of your personal data.

If you would like further information, please contact us (see 'Contact' below). Otherwise, we will not transfer your personal data outside the United Kingdom or EEA, or to any organisation (or subordinate bodies) governed by public international law or set up under any agreement between two or more countries.

CustomersManaging our relationship with customers.

CUSTOMER PRIVACY POLICY

The PLAIN CONCEPTS Group (hereinafter also referred to as PLAIN CONCEPTS) is committed to the protection of your privacy and to compliance with the legislation on the protection of personal data, in particular with the General Data Protection Regulation (hereinafter referred to as the GDPR) and the personal data protection legislation applicable in each country where the various companies of the PLAIN CONCEPTS Group are domiciled. The processing of personal data carried out by PLAIN CONCEPTS will be carried out in accordance with the principles of lawfulness, fairness, transparency and purpose limitation, always in accordance with specific, explicit and legitimate purposes. PLAIN CONCEPTS undertakes to keep your data up to date and to keep them only for the time necessary to comply with the purposes of the processing, the legal provisions and the deadlines for demanding possible liabilities arising from the processing.

This Privacy Policy applies to the management of customers' personal data, as well as the data of their representatives and contact persons, in the event that the customers are legal entities.

Please read this Policy carefully and make sure you understand the information it contains.

Any updates and/or modifications made to this Privacy Policy will be communicated to you in a timely manner through this website.

1.- Who is responsible for the processing of your personal data?

The Data Controller of your data is the company of the PLAIN CONCEPTS Group with which it has a contractual relationship and whose data appear in the contractual documentation.

Company	Address
Plain Global Solutions S.L.	C/ Gran Vía Don Diego Lopez Haro 1 8º (Bilbao) – Spain.
Plain Concepts S.L.U.	C/ Gran Vía Don Diego Lopez Haro 1 8º (Bilbao) – Spain.
Plain Concepts UK LTD	Delta Place, 27 Bath Road, Cheltenham, Gloucestershire GL53 7TH, United Kingdom.
Plain Concepts Corporation INC	8201 164th Ave Ne, Redmond, WA 98052 (USA) USA).
Plain Concepts GmbH	c/o KRIEGER GmbH Steuerberatungsgesellschaft, Berliner Straße 51, 60311 Frankfurt am Main, Germany.
Plain Concepts RO S.R.L.	Bucureşti Sectorul 1, Calea VICTORIEI, Nr. 145, MODUL 1.25, Etaj 1, Cod poștal 10072 (Romania).
Ardanis Technologies Ltd	The Greenway, Ardilaun Court, 112-114 St. Stephens Green, Dublin 2 D02 TD28 (Ireland).
Ardanis Portugal Lda	Rua de Candido dos Reis n. 81 4050-152 – Porto (Portugal).
Apiumhub S.L.	Carrer del Comte d'Urgell, 240, 6B, Eixample, 08036 Barcelona (Spain).
Apium Education S.L.	Carrer del Comte d'Urgell, 240, 6B, Eixample, 08036 Barcelona (Spain).

Where the services are provided by Plain Concepts UK LTD, Plain Concepts Corporation INC, Plain Concepts GmbH, Plain Concepts RO S.R.L., Ardanis Technologies Ltd, Ardanis Portugal Lda, Apiumhub S.L. and Apium Education S.L., Plain Concepts S.L.U. will act as a joint controller.

If you have any questions about who is responsible for your data, you can send an inquiry to the email address: gdpr@plainconcepts.com.

PLAIN CONCEPTS has a Data Protection Officer (DPO), who you can contact by sending an email to dpo@leasba.com in order to resolve any questions regarding this Privacy Policy.

2.- What personal data do we process and how do we obtain it?

The personal data processed by PLAIN CONCEPTS come from the data subject, who provides them at the time of requesting the services and throughout the contractual relationship with the Data Controller.

The personal data that may be processed by PLAIN CONCEPTS, for merely illustrative and non-exhaustive purposes, and only when necessary in each case, are:

Identification data: name and surname, postal and electronic address, telephone number, NIF/DNI/NIE, passport or any other similar identity document and electronic signature/signature.
Commercial information: Activities and businesses, business licenses.
Goods and services transactions: Goods and services supplied or received by the affected party, financial transactions.
Bank details: For example, account number.
Employment Details: Profession, Job Titles.

Depending on the specifications of the service provided, other personal data may be processed, always in accordance with the purpose pursued and detailed, where appropriate, in the corresponding Data Processing Contract signed with the client.

If you do not provide us with the personal data requested, it is likely that we will not be able to provide the services contracted by the client, comply with the contractual relationship, manage the activity and comply with legal obligations.

3.- For what purposes are personal data processed?

The personal data that is requested and collected by PLAIN CONCEPTS is strictly necessary to comply with the following purposes:

Provision of contracted services.
Tax, accounting and administrative management of the client.
Management of other aspects of the contractual relationship with customers.
Management and internal communication between the Group's organisations on matters relating to customer relations.
Sending commercial and/or promotional communications, including electronically.
Sending satisfaction surveys to measure customer loyalty and optimize our services.
Comply with legal obligations and requirements from government and judicial bodies.

4.- What is the legitimacy for the processing of your data?

The legal basis for processing your data is different depending on the purpose for which the data is intended:

Performance of a contract or pre-contractual measures (Art. 6.1 b) GDPR): for the purposes of paragraphs a), b) and c), the legal basis is the performance of a contract to which you are a party or for the application of pre-contractual measures, where applicable.
Legitimate interest of the controller (art. 6.1 f) GDPR): the legal basis for the purposes set out in sections d), e) and f) is based on the legitimate interest of PLAIN CONCEPTS in the management of the relationship, both present and future, with you as a representative of a client, legal entity or contact person.
Compliance with legal obligations (art. 6.1.c) GDPR): for the purposes of section g), the legal basis is based on compliance with the legal obligations imposed on PLAIN CONCEPTS.

By virtue of legitimate interest and in accordance with Recital 48 GDPR, all entities that are part of the PLAIN CONCEPTS Group may communicate data with each other for internal administrative purposes and customer management.

5.- To whom will your data be communicated?

Your personal data, as a natural person, representative or contact of the legal client, may be communicated to third parties and relevant bodies when necessary for the fulfilment of the purposes set out above.

Specifically, the data will be communicated to:

Public records.
Tax Administration.
Other Public Administration bodies.
Banks and financial institutions.
Insurance companies.
Organisations or persons directly related to the Data Controller (Service Providers): for needs of business, professional collaboration or contracting of services. With all those organizations, companies or persons with whom a relationship is established that involves the communication of personal data, the mandatory Data Processing Contract will be signed where the obligations in terms of security and purposes of the processing are specified.

PLAIN CONCEPTS Group Companies: Some of the group companies are established outside the European Economic Area (EEA), which may involve international transfers of personal data. Such transfers are regulated and described in more detail in section 6 of this document, concerning international data transfers.

6.- International data transfers

In the processing of personal data relating to customer management, transfers to third countries are envisaged, in particular to:

PLAIN CONCEPTS GROUP COMPANIES OUTSIDE THE EEA: the transfer of data to companies located in third countries is carried out for the purpose of collaboration between the different companies of the Group, administration, execution and development of projects for the provision of services to customers.

The personal data that are subject to transfer are only the personal identification and professional data that are essential for internal administrative and customer management purposes.

Therefore, international data transfers are planned to the following companies in the Group:

PLAIN CONCEPTS CORP INC. (United States of America): U.S. The US has an adequate level of protection for personal data, as there is an adequacy decision by the European Commission (EU- USA Data Privacy Framework Decision of 10 July 2023).
PLAIN CONCEPTS UK LTD (United Kingdom): The guarantee for this international transfer of data is based on the existence of an Adequacy Decision of the European Commission: Commission Implementing Decision (EU) 2021/1772 of 28 June 2021.

7.- How long do we keep your data?

PLAIN CONCEPTS will keep your personal data for the duration of the current contractual relationship. This, without prejudice to the retention of the data during the period established to comply with the legally established obligations and to deal with possible claims that may arise in relation to the processing of the data. During this period of time, the data will be kept duly blocked.

8.- What are your rights?

The data subject may exercise the rights available to them under applicable data protection legislation. Specifically:

Right of access to your personal data: You have the right to obtain confirmation from the controller as to which of your personal data is being processed or not and whether an international transfer of your personal data is taking place.
Right to rectification of inaccurate or erroneous data: You have the right to obtain without undue delay from the controller the rectification of inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed for you, including by means of an additional statement.
Right to erasure (“right to be forgotten”): You have the right to obtain erasure of your personal data without undue delay where:

The personal data is no longer necessary in relation to the purpose for which it was collected.
The data is out of date.
The consent is withdrawn by the data subject. This withdrawal of consent will not affect the lawfulness of the processing that has been previously carried out on the basis of the corresponding legitimation.
Have been used unlawfully.

Right to data portability: you have the right to have the Data Controller transmit your data to another Data Controller, which will be carried out using a structured format that is commonly used and machine-readable when the processing is carried out by automated means.
Right to restriction of processing: in certain circumstances, you may request the limitation of the processing of your data, in which case it will only be kept duly blocked for the exercise or defence of claims.
Right to object: You may object to the processing of your personal data in certain circumstances and for reasons relating to your particular situation. In this case, PLAIN CONCEPTS will stop processing said personal data, except in those cases in which there is an overriding legitimate interest or the exercise or defence of possible claims.

9. Security Measures

10.- Use of Artificial Intelligence in the processing of your personal data

PLAIN CONCEPTS may use Artificial Intelligence (AI) systems as a support tool in the provision of its services and in the management of the relationship with its customers, such as attention and support, service quality analysis or document management, in accordance with Regulation (EU) 2024/1689 establishing harmonised standards in the field of Artificial Intelligence.

The use of AI systems by PLAIN CONCEPTS is subject, in any case, to the following guarantees:

Human oversight: no decision that produces legal effects on you or significantly affects you will be taken in an exclusively automated manner, without the possibility of human intervention.
Minimisation and purpose: AI systems will only process personal data that is strictly necessary for the purposes described in this Policy.
Transparency: when a processing includes an AI system that may affect you, PLAIN CONCEPTS will provide you with additional information on its operation, upon request through dpo@leasba.com.
AI providers: when PLAIN CONCEPTS uses external providers of Artificial Intelligence services for the processing of personal data, they will act as data processors in accordance with Article 28 of the GDPR, having previously evaluated their data processing conditions.
Rights: You may exercise the rights described in section 8 above, including, where applicable, the right to request human intervention or to challenge a decision based solely on automated processing that produces legal effects on You.

If in the provision of the contracted services the use of Artificial Intelligence systems involves the processing of personal data on behalf of the client, such use will be regulated in the corresponding Data Processing Agreement (DPA), including, where appropriate, the specific applicable conditions.

Cookie	Duration	Description
__cfduid	1 year	The cookie is used by cdn services like CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
__cfduid	29 days 23 hours 59 minutes	The cookie is used by cdn services like CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
__cfduid	1 year	The cookie is used by cdn services like CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
__cfduid	29 days 23 hours 59 minutes	The cookie is used by cdn services like CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
_ga	1 year	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_ga	1 year	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_ga	1 year	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_ga	1 year	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_gat_UA-326213-2	1 year	No description
_gat_UA-326213-2	1 year	No description
_gat_UA-326213-2	1 year	No description
_gat_UA-326213-2	1 year	No description
_gid	1 year	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
_gid	1 year	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
_gid	1 year	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
_gid	1 year	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
attributionCookie	session	No description
cookielawinfo-checkbox-analytics	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Analytics" category .
cookielawinfo-checkbox-necessary	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-necessary	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-non-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Non Necessary".
cookielawinfo-checkbox-non-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Non Necessary".
cookielawinfo-checkbox-non-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Non Necessary".
cookielawinfo-checkbox-non-necessary	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Non Necessary".
cookielawinfo-checkbox-performance	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to store the user consent for cookies in the category "Performance".
cppro-ft	1 year	No description
cppro-ft	7 years 1 months 12 days 23 hours 59 minutes	No description
cppro-ft	7 years 1 months 12 days 23 hours 59 minutes	No description
cppro-ft	1 year	No description
cppro-ft-style	1 year	No description
cppro-ft-style	1 year	No description
cppro-ft-style	session	No description
cppro-ft-style	session	No description
cppro-ft-style-temp	23 hours 59 minutes	No description
cppro-ft-style-temp	23 hours 59 minutes	No description
cppro-ft-style-temp	23 hours 59 minutes	No description
cppro-ft-style-temp	1 year	No description
i18n	10 years	No description available.
IE-jwt	62 years 6 months 9 days 9 hours	No description
IE-LANG_CODE	62 years 6 months 9 days 9 hours	No description
IE-set_country	62 years 6 months 9 days 9 hours	No description
JSESSIONID	session	The JSESSIONID cookie is used by New Relic to store a session identifier so that New Relic can monitor session counts for an application.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
viewed_cookie_policy	1 year	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
viewed_cookie_policy	1 year	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
VISITOR_INFO1_LIVE	5 months 27 days	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface.
wmc	9 years 11 months 30 days 11 hours 59 minutes	No description

Cookie	Duration	Description
__cf_bm	30 minutes	This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
sp_landing	1 day	The sp_landing is set by Spotify to implement audio content from Spotify on the website and also registers information on user interaction related to the audio content.
sp_t	1 year	The sp_t cookie is set by Spotify to implement audio content from Spotify on the website and also registers information on user interaction related to the audio content.

Cookie	Duration	Description
_hjAbsoluteSessionInProgress	1 year	No description
_hjAbsoluteSessionInProgress	1 year	No description
_hjAbsoluteSessionInProgress	1 year	No description
_hjAbsoluteSessionInProgress	1 year	No description
_hjFirstSeen	29 minutes	No description
_hjFirstSeen	29 minutes	No description
_hjFirstSeen	29 minutes	No description
_hjFirstSeen	1 year	No description
_hjid	11 months 29 days 23 hours 59 minutes	This cookie is set by Hotjar. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjid	11 months 29 days 23 hours 59 minutes	This cookie is set by Hotjar. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjid	1 year	This cookie is set by Hotjar. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjid	1 year	This cookie is set by Hotjar. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInPageviewSample	1 year	No description
_hjIncludedInPageviewSample	1 year	No description
_hjIncludedInPageviewSample	1 year	No description
_hjIncludedInPageviewSample	1 year	No description
_hjSession_1776154	session	No description
_hjSessionUser_1776154	session	No description
_hjTLDTest	1 year	No description
_hjTLDTest	1 year	No description
_hjTLDTest	session	No description
_hjTLDTest	session	No description
_lfa_test_cookie_stored	past	No description

Cookie	Duration	Description
loglevel	never	No description available.
prism_90878714	1 month	No description
redirectFacebook	2 minutes	No description
YSC	session	YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages.
yt-remote-connected-devices	never	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.
yt-remote-device-id	never	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.
yt.innertube::nextId	never	This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen.
yt.innertube::requests	never	This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen.