Data protection notice for employees (O_IS_ES)

JUNIO 2026 

 

This data protection notice applies to the processing of your personal data as our business partner. 

1  Data Controller 

The data controller is  

Technoform Bautec Ibérica, S.L.U 

Ctra. Madrid-La Coruña, km 181 

47100 Tordesillas (Valladolid), Spain 

Phone: +34 983 796 632 
Email: rgpd [dot] oises [at] technoform [dot] com 

For any questions regarding data protection, feel free to contact us at any time using the contact details mentioned above. 

2  Purpose and legal basis 

We process your data on the basis of the EU General Data Protection Regulation (GDPR), Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) and all other laws relevant to us in terms of data protection. 

2.1 Employment relationship 

We store information about our employees that is necessary for the HR administration and remuneration process: 

  • Master data and contact details,  
  • health data, 
  • remuneration data, 
  • social security data, 
  • family related information, 
  • job application data, 
  • contract data, 
  • time recording information, 
  • training and qualification information, 
  • travel data. 

 

The data is processed on the basis of Art. 6 (1) lit. b GDPR. Without the provision of the required data, it is not possible to carry out and manage the employment relationship.  

Compliance with a legal obligation: 

  • The processing of data derived from employment relationships is legitimised by Royal Legislative Decree 2/2015, of 23 October, which approves the revised text of the Workers' Statute Law. 
  • Obligation to protect in the field of Occupational Risk Prevention, by virtue of Law 31/1995, of 8 November, on the Prevention of Occupational Risks. 
  • Provision of information to the managing bodies of the economic benefits of the Social Security in accordance with the General Law on Social Security. 
  • Communication of your data when requested by the Labour Inspectorate. Law 42/1997, of 14 November, regulating the Labour Inspectorate. 
  • Obligations regarding affiliation, registrations, cancellations, contribution documents and receipts justifying the payment of salaries and the delegated payment of benefits established by Royal Legislative Decree 5/2000, of 4 August, which approves the revised text of the Law on Infringements and Sanctions in the Social Order. 
  • Tax obligations of the entity, in accordance with the General Tax Law.  
  • Keeping of the record of working hours and possible data communications in accordance with Royal Legislative Decree 2/2015, of 23 October, approving the revised text of the Workers' Statute Law, after its modification by Royal Decree-Law 8/2019, of 8 March, on urgent measures for social protection and the fight against job insecurity in the working day. 

Personal data of employees is stored for the duration of the employment relationship and with respect to all existing statutory retention periods. Special regulations may apply to certain processing areas.  

Provided statutory retention obligations do not apply, personal data may be deleted if its further processing is no longer necessary to carry out and to manage the employment relationship. Maximum 6 years. 

2.2 Microsoft 365 

We use Microsoft 365 for internal data processing and management, as well as for communication with customers and business partners. In this context, the credentials and professional contact details of employees are stored in this system. The legal basis for this is our legitimate interest in accordance with Art. 6 (1) (f) GDPR to organize the data management and collaboration within the company.  

This data will be directly incorporated into the application, by the company in which the employees performs his or her functions, and may not be modified by the user. In the event that it is necessary to update or modify such data, it will be the corresponding company of the group that proceeds to modify them.  

Likewise, although users may voluntarily incorporate personal information about interests, hobbies or studies, among other issues, on the Office 365 platform as well as in its different applications, we warn you of avoiding as much as possible the use of this platform for personal purposes, since it is a corporate and professional application.  in which the user's profile will be deleted once they, as an employee, leave the group company in which they performed their functions.  

Technoform Group's Office 365 platform can only be used on devices that are owned by the company or authorized by it. 

2.3  IT-Security 

As part of our security measures, we maintain various log protocols in IT systems. These are used for troubleshooting purposes and to provide evidence of data collection, modification, and deletion. The following data is logged here for: 

  • device data, 
  • access data, 
  • user data. 

The legal basis for this processing is, on the one hand, our legitimate interest pursuant to Art. 6 (1) (f) GDPR in the secure operation of IT systems and, on the other hand, legal requirements pursuant to Art. 6 (1) (c) GPDR to ensure the integrity, confidentiality, and availability of data (accountability obligation). 

Log data for IT security is generally deleted after 90 days at the latest. Log data in connection with accountability evidence is deleted in accordance with the applicable statutory requirements. In cases of reasoned concern, data may also be retained until the matter has been clarified. 

2.4 Access control 

By virtue of article 20.3 of the Workers' Statute, Technoform may adopt the measures it deems most appropriate for surveillance and control to verify the worker's compliance with their labour obligations and duties. For this reason, we inform you that the company's facilities have a video surveillance system whose purpose is to guarantee the safety of people, property and facilities of the entity and, if necessary, they will be used for labor control.  

As part of our security measures, the offices are equipped with a working day registration system. The following data is recorded for this purpose:  

  • Worker data, 
  • Arrival and departure times.  

The legal basis of the registration of working hours and possible data communications in accordance with Royal Legislative Decree 2/2015, which approves the revised text of the Workers' Statute Law, after its amendment by Royal Decree-Law 8/2019, of 8 March, on urgent measures for social protection and the fight against job insecurity in working hours. 

 

2.5 Publications 

We process the following categories of personal data as part of our internal and external corporate communications: 

  • contact details, 
  • image and video recordings, 
  • any other information you may provide. 

The personal data concerning you will be processed for the purpose of public relations and advertising Technoform products and services on the basis of your voluntary consent in accordance with Art. 6 (1) (a) GDPR. Your images and videos or other information about you may be used in internal or external communications on our website, intranet, in publications, brochures and information folders, on posters, at trade fairs and on the internet, including the social media channels of the Technoform Group.  

Data that we use for public relations and advertising purposes is generally only processed for as long as it is necessary for the purposes stated. Although we actively distribute the data to a limited extent only, the content may remain available online after the end of the advertising campaign (e.g., on social media). Furthermore, deletion will take place if you revoke your consent. 

 

3  Recipients of personal data 

Your data will be communicated to the entities and bodies detailed below: 

  • To the corresponding banks. 
  • To the Tax Administration. 
  • Social Security Bodies, the Mutual Society for Accidents at Work and Occupational Diseases of the Social Security, the company in charge of health surveillance and the external prevention service. 
  • Companies/advisors that participate in the management and processing of complaints through the existing channels for this purpose. (protection against harassment, ethical mailbox, etc.) 
  • In the event that it is requested, your data will be transferred to the Labour Inspectorate.  
  • In the event of taking part in training activities organised by other entities, the participant's data necessary for the development of the training will be communicated to the organising entity.  
  • The data from the performance record will be published, internally, in order to improve quality and safety in manufacturing. 

 

  • Your data may be communicated to the rest of the entities that are part of the Technoform Group group of companies, located in third countries. 

 

  • In order to benefit from the social services that TECHNOFORM BAUTEC IBÉRICA provides to its employees, your data will be transferred to entities that provide the following services: 

 

  1. Management of business travel. 
  2. Issuance of restaurant and nursery cards. 
  3. Creation of gift vouchers for the birth of children. 
  4. Realization of health and life insurance 
  5. Training. 
  6. Management of business expenses 

 

In this context, data transfers outside the EU may also take place. In doing so, we make sure that there is either an EU adequacy decision for the destination country in question in accordance with Art. 45 GDPR or that we have concluded a contract with the service providers concerned on the basis of the standard data protection clauses in accordance with Art. 46 (2) (c) GDPR (https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en). 

4  Your rights 

You have the following rights against us in relation to personal data concerning you: 

  • Right to information (Art. 15 GDPR). 
  • Right to rectification (Art. 16 GDPR). 
  • Right to erasure (Art. 17 GDPR). 
  • Right to restriction of processing (Art. 18 GDPR). 
  • Right to data portability (Art. 20 GDPR). 
  • Right to object to processing (Art. 21 GDPR). 
  • Right to withdraw consent (Art. 7 para. 3 GDPR). 
  • Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). 

5  Data protection officer 

We have appointed an external data protection officer: 

PRODAT en Castilla y León  

Calle Angustias 32, 2º B 

47003 Valladolid  

Phone: +34 983 363 893  
Email: rgpd [dot] tbes [at] technoform [dot] com 
Internet: www.prodacyl.es  

 

6  Validity and modification of this data protection notice 

This data protection notice is currently valid (see status in the heading). Due to further development of our offers or due to changes in legal or official requirements, it may become necessary to change this data protection notice. 

If you want more information, request the complete documents D02TBS09, FO02TBS16 and WI02AM18 at the following address rgpd [dot] oises [at] technoform [dot] com