The Controller of the processing is PLAIN CONCEPTS, S.L.U. (Company belonging to PLAIN CONCEPTS Group) with CIF: B24532178 and established in  C/ Gran Vía Don Diego López de Haro 1º, 8ª planta. 48001 Bilbao (Vizcaya). España.

If you have any doubts regarding the processing of your personal data, do not understand or need a translation of this Privacy Policy into another language, please contact gdpr@plainconcepts.com 

We also inform you that PLAIN CONCEPTS has a designated Data Protection Officer (hereinafter DPO), who can be contacted through the address dpo@leasba.com 

In this Privacy Policy, “personal data” means any information that identifies you or can be used to identify you.

The personal data processed by PLAIN CONCEPTS are:

1. Those that you provide to us by completing the forms you fill in or through the different email accounts made available on the website for contact with Plain Concepts.
2. The data you provide for your registration to the Newsletter service. Plain Concepts will process only the personal data necessary to fulfil the purposes of registration for the service. These data are your name and email address.
3. The data that you may provide in each of the forms where your personal data is collected (e.g. Job offers, Events or Complaints Channel). In each of these forms you will find specific information about the necessary data, the purposes for which they will be used, the third parties to whom, if applicable, they may be transferred, the legitimacy of the processing, etc.

PLAIN CONCEPTS will process your personal data for the following purposes:

1.  Answer and attend to any queries or request you may have.
2. Manage your subscription to the Plain Concepts Newsletter, and therefore, send you by electronic means information of interest about congresses, events, projects, activities, news, and any other information of interest about Plain Concepts.
3. To answer you request to apply for a job position and to carry out the necessary steps for the processing of your application (in this case, the Privacy Policy that you will accept before sending your application will be applicable).
4. To send commercial communications.
5. To use them for any other purpose required or permitted by applicable legislation or when you have given your express consent.

The legal basis in accordance with the article 6 RGPD for the processing of your personal data is as follows:

1. Consent of the subject (you) (art. 6.1 a) RGPD): for the processing of your personal data in the subscription of the newsletter and to respond to the requests or queries that you may make, the legal basis that legitimises the processing is your consent that you are giving by accepting this Privacy Policy r the consent that you are giving by contacting with us and, therefore, the need for such processing to attend and respond to the query or request for information that you make.
2. Compliance with a legal obligation (art. 6.1 c) RGPD): some processing of your personal data may be processed in compliance with a legal obligation that are applicable to Plain Concepts. When this occur, you will be informed about the details of the processing and also of the law requiring the specific processing.
3. Legitimate interest of Plain Concepts (art. 6.1 f) RGPD): Plain Concepts may have a legitimate interest in processing your data, to analyse the usability of the website, as well as your satisfaction, as this may be of benefit to you.

Your personal data may be transferred to the following groups:

1. Service suppliers: if necessary, Plain Concepts may transfer your personal data to the appropriate supplier for the development and implementation of the purposes of processing. In these cases, Plain Concepts, as the data Controller, has signed the confidentiality and data processing contracts required by current legislation.
2. Companies belonging to Plain Concepts Group: It is possible that your data may be transferred to one of the companies of the Group for internal administration purposes or to provide specific services necessary for the development and execution of the processing.

Data will be kept until the subject does not exercise her/his right to erasure or for the time necessary to maintain the purpose of the processing. However, the data will be kept for the corresponding term to comply with legal obligations, during the applicable limitation periods to meet possible liabilities arising from the processing. In this case, data will be kept duly blocked until the limitation period of the possible legal liabilities associated with the processing has elapsed. In the case that they are erased, appropriate security measures shall be applied to ensure their destruction.

It may be necessary for the sending of the Newsletter to transfer some data to non-European countries (which you consent to by accepting this Policy) such as the USA where data protection laws may be less stringent than in the EU.

Specifically, data transfers to third countries (USA and Australia) are foreseen when using the services of the provider ACTIVECAMPAIGN, LLC, to carry out commercial communications and email marketing campaigns. However, this company has incorporated Standard Contractual Clauses (SCC) in the contracts signed between the parties, in accordance with European regulations, which allow for secure processing in accordance with current data protection regulations.

Some of the group companies are established outside the European Economic Area, which entails an international transfer of data. Specifically, to the following group companies:

• Plain Concepts Australia PTD Ltd. (Australia)
• Plain Concepts UK Ltd. (United Kingdom)
• Plain Concepts Corp Inc. (USA)

Some of these countries lack an adequate level of personal data protection (specifically USA and Australia) and such transfers may be a risk to your privacy. Therefore, by consenting to this Privacy Policy, either by subscribing to the Newsletter, or by contacting Plain Concepts or, where necessary, requesting your consent to specific processing, you are agreeing and giving your explicit consent to transfers to these two countries where the companies belonging to the Group are established and always in accordance with the purposes described above.

The data subject (you) may exercise your rights under the current data protection legislation:

• Right of access: you have the right to obtain from the Controller confirmation as to whether your personal data are being processed, are being transferred to a third country or to an international organisation.
• Right to rectification of the wrong or inaccurate data: you have the right to obtain, without undue delay from the Controller, the rectification of inaccurate personal data concerning you. Having regard to the purpose of the processing, you shall have the right to have incomplete personal data supplemented, including by means of an additional statement.
• Right to erasure or cancellation: you have the right to obtain the erasure of your personal data without undue delay when:

1. The data are no longer necessary in relation to the purpose for which it was collected.
2. The data are out of date.
3. You withdraw your consent to the processing. This withdrawal of consent shall not affect the lawfulness of the processing previously carried out.
4. The data have been used unlawfully.

• Right to data portability: you have the right to have your data transferred by he Controller to another Controller of the same data subject, in a structured, commonly used, and machine-readable format, where the processing is carried out by automated means.

• Right to restriction of the processing: in certain circumstances, you may request the restriction of the processing of your data, in which case the data will only be kept for the purpose of pursuing or defending claims. 

• Right to object: in certain circumstances and for reasons relating to your situation. In this case, PLAIN CONCEPTS will stop processing such personal data except compelling legitimate reasons, or the exercise or defence of possible claims. 

You will exercise your rights sending an email to gdpr@plainconcepts.com, indicating the reason for your request and the right you wish to exercise. If we consider it necessary to identify you, we may request a copy of a document proving your identity. You may also send a communication to the Data Protection Officer by sending an email to dpo@leasba.com 

In those cases where you feel that your rights concerning the protection of your personal data have been violated, where you haven’t obtained satisfaction in the exercise of your rights, you may lodge a complaint with the Data Protection Supervisory Authority, specifically with the Spanish Data Protection Agency, trough its website: www.aepd.es 

As the Plain Concepts Group processes data in different EU Member States, its main point of contact may be a Supervisory Authority in another EU Member State, whose contact details can be found at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm. 

Plain Concepts websites may contain links to other websites, which we may consider to be useful to you. However, Plain Concepts is not responsible for the content posted on such websites, nor for the privacy policies of such websites.  Plain Concepts recommends that you carefully review the Privacy Policies before using these websites to ensure that you are comfortable with the information that is collected.

This website is not intended for minors in accordance with current applicable legislation. Parents, guardians, or legal representatives shall be solely responsible for all acts carried out on this website by minors in their care, including the completion of forms with the personal data of such minors and the ticking, where appropriate, of the boxes that accompany them.

Plain Concepts applies all the required security measures by the personal data protection regulations, to protect your rights and freedoms. Plain Concepts applies the necessary measures to ensure the confidentiality of personal data of all persons under its responsibility.

Plain Concepts reserves the right to modify or update this Privacy Policy at any time. In the event that any clause of this Privacy Policy is annulled or considered null and void, the rest of the conditions will not be affected, retaining their full validity and validity, in accordance with the current regulations applicable at all times.

This website may use Cookies. For more information, please consult our Cookies Policy.

1. WHO IS THE CONTROLLER OF THE PROCESSING OF YOUR PERSONAL DATA?

The Controller of the processing is PLAIN CONCEPTS S.L.U., with C.I.F.: B24532178 and registered office at Calle Ledesma 10 bis, 3º, 48001-Bilbao (Spain). PLAIN CONCEPTS has designated a Data Protection Officer (DPO), whom you can contact by sending an e-mail to dpo@leasba.com to resolve any questions regarding this Privacy Policy.

2. WHAT PERSONAL DATA DO WE PROCESS AND HOW DO WE OBTAIN THEM?

The personal data processed by PLAIN CONCEPTS is the data you provide when you fill in the registration form or application form for the event or in the framework of any other PLAIN CONCEPTS event in which you have participated. If applicable, PLAIN CONCEPTS will process your image and/or your voice that appears in the photographs or videos taken during the event. PLAIN CONCEPTS can also process the data relating to disabilities or food allergies that you may submit to PLAIN CONCEPTS according to the specific characteristics of the event and in order toensure a satisfactory service.

3. FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

PLAIN CONCEPTS will process tour personal data for the following purposes:

a) Inscription and sending of the invitation to the event, and where appropriate, sending of
the satisfaction survey.
b) Management of your involvement, participation or collaboration in the event.
c) Access control at the place where the event take place.
d) With the purpose to promotion PLAIN CONCEPTS brand, the creation and/or editing of
photographs and videos taken during the event for subsequent broadcasting in legal
media and on PLAIN CONCEPTS social media profiles.

4. WHICH IS THE LEGITIMATION FOR THE PROCESSING OF YOUR PERSONAL DATA?

The legal basis in accordance with the article 6 GDPR for the processing of your personal data is as follows:

For the purposes mentioned in letters a), b) and c) above, the legal basis is the legitimate interests of PLAIN CONCEPTS (art. 6.1 f) GDPR), for the appropriate management of your participation and attendance to the event you have applied, to ensure the security of the facilities where the events take place and, where appropriate, to know the degree of satisfaction of the participants.

For the gathering of images taken during the event, letter d) of the previous paragraph we differentiate:

− General shots: the legal basis is the legitimate interest of PLAIN CONCEPTS (art. 6.1 f) GDPR), for the advertising and promotion of the PLAIN CONCEPTS brand.
− Close-ups: (where the person can be directly recognised): the legal basis is your consent to attend the event. With your attendance you will be authorizing the transfer of your image rights free of charge, for use in all known, present, or future legal media and without geographical limitation. These close-ups may be taken directly by the PLAIN CONCEPTS team or by contracted third parties.

5. TO WHOM WILL YOUR DATA BE COMMUNICATED?

Your personal data may be communicated to the following groups:

a) Companies of the PLAIN CONCEPTS Group: in some cases, your personal data will be communicated to other companies of the PLAIN CONCEPTS Group for internal administration purposes if the event is of an international nature and requires the participation of all or some of the companies of the group.

Some of the group’s companies are located outside the European Economic Area (EEA), which entails an international data transfer. Some of these countries don’ have an adequate level of personal data protection (the USA and Australia) and such transfers may be a risk to your privacy. Therefore, with your registration or, if applicable, with the purchase of the ticket and/or your participation in the event, you are accepting and giving your explicit consent for the transfers to be made to the aforementioned two countries where the companies of the group are located and always in accordance with the purposes described above.

Therefore, international data transfers to the following companies of the group are foreseen:

• Plain Concepts Australia PTD LTD (Australia).
• Plain Concepts UK LTD (United Kingdom).
• Plain Concepts CORP INC (USA).

b) Sponsors/Partners: some events may be organised jointly with other companies in the sector with which there is a collaboration agreement and there may be a transfer of attendees’ data to these companies or organisations for the purpose of providing information about the products or services they provide, as well as to carry out marketing activities related to them.

For this reason, you will be informed in advance of such transfers and if there are international transfers of data to third countries that lack adequate guarantees, requesting your explicit consent to carry them out.

c) Companies or organizations directly related to the Controller: your data may be communicated to external services providers that are directly related to PLAIN CONCEPTS, which are necessaries for the organisation and development of the event,such a security companies, owners of the venues or spaces where the event takes place, catering services, companies in charge of issuing accreditations, photography, and video companies…etc.
With all of these companies (processors) PLAIN CONCEPTS has signed the corresponding contracts for the processing of personal data, which specific obligations in terms of security and purpose s of the processing. In the event that one of these companies is located outside the European Economic Area and there is an international transfer of data to a third country which, in some cases, involves certain risks to your privacy due to lack of an adequacy decision ad adequate safeguards, PLAIN CONCEPTS will ensure that appropriate measures are in force to ensure that your data is protected in the country and organisation of destination country and organisation in the same or similar terms to those foreseen I the European regulations.

d) EVENTBRITE: PLAIN CONCEPTS uses Eventbrite for whole management process, free acquisition, and purchase of tickets for the events. The processing of your personal data through this platform will be carried out in accordance with the Eventbrite’s Privacy
Policy which you can consult in the following link:

https://www.eventbrite.co.uk/support/articles/en_US/Troubleshooting/eventbrite-privacy-policy?lg=en_GB

Eventbrite will be the processor of your personal data and is subject to a data processing agreement (DPA), which is incorporated in the term and conditions of the service purchased by PLAIN CONCEPTS.
This agreement includes Eventbrite’s legal obligations as processor of the personal data in accordance with the GDPR, that can be viewed at the following link:

https://www.eventbrite.co.uk/support/articles/en_US/Troubleshooting/data-processing-addendum-for-organizers lg=en_GB

Eventbrite stores personal data in the United States, thus resulting in an international transfer of data to a third country outside the European Economic Area. To ensure that the personal data can be legally transferred, Eventbrite agrees that it will be bound by the Standard contractual Clauses (“STCs”) issued pursuant to Commission Implementing Decision (EU) 2021/194 of 4 June 2021. Eventbrite has signed such clauses which can be consult at the following link:  https://cdn.evbstatic.com/s3-s3/static/images/en_US/legal_policies/Eventbrite_Organizer_Standard_Contractual_Cl
auses.pdf

PLAIN CONCEPTS has also signed Eventbrite’s STCs for evidence of proof and to ensure that the international transfer takes place in strict compliance with the GDPR. You can consult PLAIN CONCEPTS at any time to find out about the specific safeguards that have been put in place for the protection of your personal data.

e) Social media: PLAIN CONCEPTS, may make publications on the company’s social media profiles, where your image and/or voice will be treated. If you are directly recognised, you will be asked for your prior consent, in accordance with section 4 of this privacy policy, and you will be informed of the details of this processing. PLAIN CONCEPTS will
process the data in each social media in accordance with the regulations and privacy policy established for this purpose by each of them, informing you that some of the social media used by PLAIN CONCEPTS contemplate the international transfer of data to third countries.

6. HOW LONG DO WE KEEP YOUR DATA?

PLAIN CONCEPTS will keep your personal data for the management and access to the event until the end of the same. Your image and voice will be kept until you exercise your right of deletion or withdraw your consent in accordance with section 4 above.

Nevertheless, the data will be kept for the corresponding period to comply with legal obligations and during the applicable prescription periods to deal with possible liabilities arising from the processing. In this case, the data will be kept duly blocked until the prescription period of the possible legal liabilities associated with the processing has elapsed.

7. WHAT ARE YOUR RIGHTS?

You can exercise your rights under current data protection regulations (access, rectification and deletion of your data, data portability, limitation or opposition to their processing, the right no to be subject to automate decisions, as well as the right to obtain clear and transparent information on the processing of data), you may send a communication by e-mail to the address: gdpr@plainconcepts.com attaching a copy of your National Identity Document or equivalent, or
send a communication to the Data Protection Delegate at the e-mail dpo@leasba.com.You also have the right to make a reclamation to the Spanish Data Protection Agency via its website www.aepd.es.

The data controller responsible for managing the selection process is PLAIN CONCEPTS S.L.U. (a company belonging to the Plain Concepts Group) with VAT number: B24532178 and registered address at C/ Gran Vía Don Diego Lopez Haro 1 8º (Bilbao) – Spain. PLAIN CONCEPTS S.L.U. manages the selection process for its own job vacancies as well as for the following companies within the Plain Concepts business group: 

If you have any doubts about who is the data controller for your data, you can send an inquiry to the email address gdpr@plainconcepts.com   

PLAIN CONCEPTS has a Data Protection Officer (DPO) whom you can contact by sending an email to dpo@leasba.com in order to resolve any questions regarding this Privacy Policy. 

The personal data processed by PLAIN CONCEPTS is provided directly by the data subject who provides it in the registration form for the corresponding job offer. 

The personal data processed by PLAIN CONCEPTS includes: 

• Curriculum Vitae 
• First and Last Name 
• Email Address 

• Phone Number 
• Any other personal data that the data subject may enter or attach in the registration form. 

PLAIN CONCEPTS may request or process additional data if you pass the selection process, such as identification number, social security number, passport information, banking details, family data, etc. Additionally, PLAIN CONCEPTS may request or process personal data necessary to complete the selection process based on the current legal obligations in the country where the Group Company with the open vacancy is located. 

If you do not provide the requested personal data, we may not be able to consider your application for employment, manage your participation in the selection process, address your request, fulfill our legal obligations, or manage our activities. 

We kindly request that you update your personal data as it changes and always provide accurate information, as we need to have your current information. 

Your personal information will be processed for the following purposes:  

1. Managing the selection process for which you apply.  

1. If you pass the selection process, the additional data requested or processed by PLAIN CONCEPTS will be used to prepare all necessary administrative arrangements prior to employment.  

1. Inclusion in a database of potential candidates.  

1. Inviting you to participate in selection processes that match your professional profile. 

The legal basis for processing your data is:  

1. Consent, which you provide by accepting this Policy (Article 6.1.a GDPR), for the purposes outlined in points c) and d) above.  

1. The performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6.1.b GDPR), for the purposes outlined in points a) and b) above. 

The personal data will be disclosed to the following recipients: 

1. Companies belonging to the PLAIN CONCEPTS Group: Personal data may be disclosed, in certain cases, to one or all the companies that are part of the Group for the purpose of managing different aspects of the selection process. Some of the group companies are located outside the European Economic Area (EEA), which involves an international data transfer, which is detailed in point six (6) of this Policy. 

1. Organizations or individuals directly related to PLAIN CONCEPTS: Due to business collaboration, professional needs, or service providers involved in the management of the selection process (Suppliers). With all organizations, companies, or individuals with whom a relationship is established involving the communication of personal data, the necessary Data Processing Agreements will be signed, specifying security obligations and the purposes of processing. 

If any of these companies, organizations, or individuals are located in countries outside the EEA that do not provide sufficient and adequate data protection guarantees, or if there is no adequacy decision, and this poses a risk to the privacy of personal data, PLAIN CONCEPTS will ensure that appropriate measures are in place and will sign Standard Contractual Clauses (SCCs) in accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021, to ensure that your data is protected at all times on terms identical or similar to those provided for in European regulations. 

Specifically:  

• Workable: PLAIN CONCEPTS uses Workable as a provider for managing the selection process. Workable Software Limited operates as a data processor in this case and will process your data in accordance with its terms of use, which you can review at the following link: https://www.workable.com/terms. As an integral part of this Policy, additional information regarding the processing of your personal data when using the Workable service can be found in an Annex to this document. 

•  Factorial: Once the selection process is completed and you have been selected, your data will be transferred to the Human Resources management platform “FACTORIAL” owned by EVERYDAY SOFTWARE, S.L. Once the employment relationship is established with you, the Employee Privacy Policy will apply. 

Transfers to third countries are foreseen in the following cases: 

1. PLAIN CONCEPTS Group subsidiaries outside the EEA: Data transfers to subsidiaries located in third countries are carried out for collaboration and management purposes among the different Group companies. 

Therefore, international data transfers are foreseen to the following Group companies: 

• PLAIN CONCEPTS CORP (USA). The guarantee for this international data transfer is based on the necessity of the performance of a contract between the data subject and the data controller (Article 49.1.b of the GDPR). 
•  PLAIN CONCEPTS UK LTD (United Kingdom). The guarantee for this international data transfer is based on the existence of an Adequacy Decision by the Commission dated 28 June 2021. 

1. WORKABLE Platform:  

Workable states: 

The data we collect from you and process using the Workable Services may be transferred to and stored at a destination outside the United Kingdom or the European Economic Area (“EEA”). It may also be processed by staff operating outside the United Kingdom or the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, fulfilling your orders, processing your payment details, and providing support services. By submitting your personal data, you agree to this transfer, storing, or processing. 

In particular, your data may be accessible to i) Workable staff in the United States, or ii) Workable’s hosting service provider may store it on servers in the United States as well as the EU. The United States does not have the same data protection laws as the United Kingdom and the EEA. A Data Processing Agreement has been signed between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its data processors. These Data Processing Agreements are designed to help safeguard your privacy rights and provide you with remedies in the unlikely event of misuse of your personal data. 

If you would like more information, please contact us (see ‘Contact’ below). Otherwise, we will not transfer your personal data outside the United Kingdom or the EEA or to any organization (or subordinated bodies) governed by public international law or established under any agreement between two or more countries. 

For more information: 

• You can visit the following link: https://www.workable.com/terms 
• Or you can send an inquiry to the following email address: support@workable.com 

Your data will be stored in the system for a period of 12 months. After this period, your personal data will be deleted. However, this timeframe may be extended if there are any updates to your data or any interaction with the candidate takes place. 

The data subject can exercise the rights granted to them by current data protection regulations, including: 

• Right of access to personal data: The data subject has the right to obtain confirmation from the data controller as to whether their personal data is being processed, transferred to a third country, or to an international organization. 
• Right to rectification of inaccurate or incorrect data: The data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning them. Considering the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing an additional statement. 
•  Right to erasure or cancellation: The data subject has the right to obtain the erasure of their personal data without undue delay when: 

1. The data is no longer necessary for the purposes for which it was collected. 

1. The data is outdated. 

1. The data subject withdraws their consent, and this withdrawal does not affect the lawfulness of the previous processing. 

1. The data has been unlawfully processed. 

• Right to data portability: The data subject has the right to have their data transmitted to another data controller, in a structured, commonly used, and machine-readable format, where the processing is carried out by automated means. 
•  Right to restriction of processing: In certain circumstances, the data subject can request the restriction of the processing of their data, in which case it will only be retained for the exercise or defense of legal claims. 

•  Right to object: to the processing of personal data in certain circumstances and for reasons related to their particular situation. In this case, PLAIN CONCEPTS will cease to process such personal data, except for compelling legitimate grounds or the exercise or defense of potential legal claims. 

The data subject can exercise their rights by sending an email to gdpr@plainconcepts.com  indicating the reason for their request and the right they wish to exercise. If necessary to identify the data subject, a copy of an identification document may be requested. Alternatively, a communication can be addressed to the Data Protection Officer by sending an email to dpo@leasba.com  

In cases where the data subject feels that their rights regarding the protection of their personal data have been violated, especially when they have not obtained satisfaction in the exercise of their rights, they can lodge a complaint with the Data Protection Authority, specifically the Spanish Data Protection Agency, through their website: www.aepd.es  

As Plain Concepts processes data in different EU member states, the primary point of contact may be a Data Protection Authority of another EU member state, whose contact information can be found at the following link: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm  

In the case of the United Kingdom, if you wish to obtain more information about each of your rights, including the circumstances in which they apply, please refer to the Guide from the Information Commissioner’s Office (ICO) of the United Kingdom on individuals’ rights under the General Data Protection Regulation. The supervisory authority in the UK is the Information Commissioner, who can be contacted at http://ico.org.uk/concerns/  or by phone: +44303-123-1113. 

PLAIN CONCEPTS S.L.U. (Company belonging to the Plain Concepts Group) with VAT number: B24532178 and registered address at C/ Gran Vía Don Diego Lopez Haro 1 8º (Bilbao) – Spain. (Hereinafter, PLAIN CONCEPTS) is committed to protecting and respecting your privacy. This Privacy Notice (part of the Candidate Privacy Policy) sets out the basis on which we will process personal data collected from you, or that you provide to us, in relation to our hiring processes. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. For the purposes of the General Data Protection Regulation (“GDPR”), the Data Controller is PLAIN CONCEPTS. 

We use Workable, an online application provided by Workable Software Limited, to assist with our hiring process. We use Workable as a data processor to handle personal information on our behalf. Workable is only authorized to process your personal data in accordance with the instructions given by PLAIN CONCEPTS. When you apply for a job vacancy posted by PLAIN CONCEPTS, the provisions of this Privacy Notice will apply to our processing of your personal information in addition to our separate “Recruitment Privacy Policy.” 

Your Personal Information Information  

Information we collect from you: 

We collect and process some or all of the following types of information about you:  

• Information you provide when applying for a position. This includes information provided through an online job site, via email, in-person interviews, and/or any other method. In particular, we process personal data such as your name, email address, address, phone number, date of birth, qualifications, experience, information related to your employment history, skills experience you provide, as well as your video if you conduct your interview using the Video Interview feature.  
• If you contact us, we may keep a record of that correspondence.  

• A record of your progress through any hiring process we may conduct. 
• Details of your visits to the Workable website, including but not limited to traffic data, location data, weblogs, and other communication data, the site that referred you to the Workable website, and the resources you access. 

Information we collect from other sources:  

Workable provides us with the ability to link the data you provide to us with other publicly available information about you that may be posted on the internet, including sources such as LinkedIn and other social media profiles.  

Workable’s technology allows us to search multiple databases, some of which are publicly available and others that are not, which may include your personal data (including your CV or resume) in order to find potential candidates to fill our vacancies. When we find you in this way, we obtain your personal data from these sources.  

We may receive your personal data from a third party who recommends you as a candidate for a specific job opportunity or for our business in general. 

Legitimization: 

• Legal basis for processing.  
• We rely on legitimate interest as the legal basis upon which we collect and use your personal data. Our legitimate interests are in hiring personnel for our business. 

Processing Purposes  

We use the information we have about you in the following ways:  

• To consider your application for a specific role you have applied for.  
• To consider your application for other roles.  
• To communicate with you regarding the hiring process. 
• To enhance any information, we receive from you with information obtained from third-party data providers.  

• To find suitable candidates to fill our job vacancies.  
• To assist our service providers (such as Workable and its processors and data providers) and partners (such as job sites through which you have submitted your application) in improving their services. 

Decision Making/Automated Profiling: 

We may use Workable’s technology to select suitable candidates for consideration based on criteria explicitly identified by us or typical for the position you have applied for. The process of searching for suitable candidates is automated; however, any decision regarding whom we will hire to fill the vacant position will be made by our staff. 

Disclosure of your information: 

As stated above, we may share your information with our external service providers, including Workable, who will use it only in accordance with our instructions and as required by law. If you have applied for a job through another service provider, we may disclose similar data to the aforementioned Provision Data to such service provider. The service provider will be the data controller for this data and will therefore be responsible for complying with all applicable laws regarding the use of that data after we transfer it. 

How we store your personal data 

• Security:  

We take appropriate measures to ensure that all personal data is kept secure, including security measures to prevent personal data from being accidentally lost, used, or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data breach. We will notify you and any applicable regulator of a suspected data breach where we are legally required to do so. Unfortunately, the transmission of information over the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means; therefore, any transmission is at your own risk. 

• Where we store your personal data:  

When we store your personal data on our own systems, it is stored within the EEA. The data we collect from you and process using Workable’s Services may be transferred and stored at a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, fulfilling your orders, processing your payment details, and providing support services. By submitting your personal data, you agree to this transfer, storing, or processing. In particular, your data may be accessible to i) Workable staff in the USA, or ii) Workable’s hosting service provider may store it on servers in the USA as well as in the EU. The USA does not have the same data protection laws as the UK and EEA. A Data Processor Agreement has been entered into between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its data processors. These Data Processor Agreements are designed to help safeguard your privacy rights and provide you with remedies in the unlikely event of misuse of your personal data.  

If you would like more information, please contact us (see ‘Contact’ below). Otherwise, we will not transfer your personal data outside of the UK or EEA or to any organization (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries. 

The data controller is the company of the Plain Concepts Group with whom you have a contractual relationship and whose data are included in the contractual documentation and whose details appear in the contractual documentation. 

The contracting made by Plain Concepts UK LTD, Plain Concepts Corporation INC, Plain Concepts GmbH, Plain Concepts RO S.R.L. or Plain Concepts Benelux B.V.; Plain Concepts S.L.U. will act as co-responsible. 

If you have any doubts as to who is responsible for your data, you can send an inquiry to the following e-mail address: gdpr@plainconcepts.com. 

PLAIN CONCEPTS has a Data Protection Officer (DPO), whom you can contact by sending an e-mail to dpo@leasba.com in order to resolve any questions regarding this Privacy Policy. 

The personal data that are processed by PLAIN CONCEPTS are: 

–Identifying data: name and surname, postal and e-mail address, telephone, NIF/DNI/NIE, passport or any other similar identity document and signature. 

–Commercial data or conditions: services rendered, activities and business and, if applicable, commercial licenses. 

–Data relating to transactions of goods and services: financial transactions, compensation, etc. 

–Bank details: such as, for example: account number.– 

– Employment data: if you are a natural person who provides services for our suppliers, PLAIN CONCEPTS may process, in addition to your contact details, data relating to the function or position held. 

Likewise, PLAIN CONCEPTS, in accordance with its internal procedure for the management of suppliers and potential suppliers and in compliance with the established risk management guidelines, may obtain information from third parties. 

The personal data is obtained through the information you provide during the registration process in the Register of Suppliers and, where appropriate, through the contracting process and throughout the period of development of the contractual relationship. Additionally, PLAIN CONCEPTS may obtain data from third parties, as previously mentioned. 

If you do not provide us with the requested personal data, it is likely that we will not be able to register you in the Supplier Register, fulfill the contractual relationship, manage the activity and comply with legal obligations. 

The personal data requested and collected by PLAIN CONCEPTS is strictly necessary to fulfill the following purposes: 

(a) Participation in the supplier qualification and selection process within the framework of its risk management rules and procedures. 

1. b) Periodic verification of its compliance with all the requirements demanded to be a Supplier of PLAIN CONCEPTS, as well as the appropriate economic and financial situation.
2. c) Management of the contractual relationship with suppliers in all its aspects.
3. d) Management and internal communication between the organizations of the Group on the matters related to the relations with suppliers.
4. e) Administrative management, collections and payments.
5. f) Sending communications related to sustainability, ethics and compliance.
6. g) Complying with legal obligations and requirements from governmental and judicial bodies.

The legal basis for the processing of your data is different depending on the purpose for which the data is intended: 

– Execution of a contract (art. 6.1 b) GDPR): for the purposes of paragraphs a), b), c) and e) the legitimacy is based on the execution of a contract to which you are a party or for the implementation of pre-contractual measures, in particular in the case of qualification and selection process of suppliers. 

– Compliance with legal obligations (art. 6.1.c) GDPR) 

– Legitimate interest of the controller (art. 6.1 f) GDPR): the legitimacy for the purposes set out in paragraph d) is based on the legitimate interest of PLAIN CONCEPTS in the management of the present and future relationship with you as a representative of a legal entity supplier or contact person, or as a natural person. 

By virtue of legitimate interest and in accordance with Recital 48 GDPR, all entities that are part of the PLAIN CONCEPTS Group may communicate data to each other for internal administrative purposes, supplier control, relationship management and risk management. 

PLAIN CONCEPTS will keep your personal data during the maintenance of the commercial relationship in force, as well as for the fulfillment for the terms legally foreseen in related legislations.  Additionally, before the sending of commercial communications, they will be kept as long as you do not withdraw your consent on them.  

Without prejudice to the conservation of the data during the period established to comply with the legally established obligations and to deal with possible claims that may arise in relation to the processing of the data. During this period of time the data will be duly blocked. 

The personal data of you, natural person or representative or contact person in the case of a legal person, may be communicated to third parties and relevant agencies when necessary for the fulfillment of the purposes set out above. 

Specifically, the data will be communicated to: 

• Public registries. 
• Tax Administration. 
• Other Public Administration bodies. 
• Banks/Savings banks. 

• Insurance companies. 
• Suppliers of products and services.  
• Companies of the PLAIN CONCEPTS Group: some of the companies of the group are located outside the European Economic Area (EEA), which entails an international transfer of data, which will be seen in detail in point 8 referred to international transfers. 

In the processing of personal data relating to the management of suppliers, transfers to third countries are foreseen, specifically to: 

1. PLAIN CONCEPTS GROUP COMPANIES OUTSIDE THE EEA: the transfer of data to subsidiaries located in third countries is carried out for the purpose of collaboration between the different companies of the Group, administration, execution and development of projects for the provision of services to customers.  

The personal data that are subject to transfer are only personal identification and professional data that are essential for internal administrative purposes, supplier control, relationship management and risk management. 

Therefore, international data transfers to the following Group companies are foreseen: 

• PLAIN CONCEPTS CORP (USA). 
• PLAIN CONCEPTS UK LTD (United Kingdom). 

The person concerned may exercise the rights granted by the current data protection legislation. Specifically: 

• Right of access to your personal data: You have the right to obtain from the controller confirmation as to which of your personal data is being processed or not and whether an international transfer of your personal data is taking place. 
• Right to rectification of inaccurate or incorrect data: You have the right to obtain without undue delay from the controller the rectification of inaccurate personal data concerning you. Considering the purposes of the processing, you shall have the right to have incomplete personal data completed, including by means of an additional statement. 
• Right of deletion or cancellation: You have the right to obtain the deletion of your personal data without undue delay when: 

(a) The personal data is no longer necessary in relation to the purpose for which it was collected. 

1. b) The data are
2. c) Consent is withdrawn by the data subject. This withdrawal of consent shall not affect the lawfulness of the processing previously carried out on the basis of the corresponding legitimacy.
3. d) The data have been used unlawfully.

• Right to data portability: you have the right to have your data transferred by the Data Controller to another Data Controller, which will be carried out in a structured, commonly used and machine-readable format when the processing is carried out by automated means. 

• Right to limitation of processing: in certain circumstances, you may request the limitation of the processing of your data, in which case they will only be kept properly blocked for the exercise or defense of claims. 
• Right to object: you may object to the processing of your personal data in certain circumstances and for reasons related to your particular situation. In this case, PLAIN CONCEPTS will stop processing such personal data, except in those cases where there is a compelling legitimate interest or the exercise or defense of possible claims. 

You can exercise your rights under the current data protection regulations (access, rectification and deletion of your data, data portability, limitation or opposition to their processing, the right not to be subject to automated decisions, as well as to obtain clear and transparent information about the processing of data). 

The interested party may exercise their rights by sending an email to the address gdpr@plainconcepts.com, indicating the reason for your request and the right you want to exercise. If we consider it necessary to identify you, we may request a copy of a document proving your identity. You may also send a communication to the Data Protection Officer by sending an e-mail to dpo@leasba.com. 

In those cases, in which you feel that your rights concerning the protection of your personal data have been violated, especially when you have not obtained satisfaction in the exercise of your rights, you may file a complaint with the Supervisory Authority for data protection; 

For Plain Global Solutions S.L. and Plain Concepts S.L.U.: 

– The Spanish Data Protection Agency, Web: www.aepd.es.   

For Plain Concepts UK LTD:  

– Information Commissioner’s Office, Web: www.ico.org.uk.  

For Plain Concepts GmbH:  

– Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Web: www.ldi.nrw.de  

 Para Plain Concepts RO S.R.L.:  

– National Supervisory Authority for Personal Data Processing, Web: www.dataprotection.ro  

Para Plain Concepts Benelux B.V.:  

Autoriteit Persoonsgegevens, Web: www.autoriteitpersoonsgegevens.nl/nl