1. Who is responsible for processing your data?

Identity: CXIOME ESPAÑA S.A

CIF: A84835305

Address: 2ª Planta C/Ronda de Poniente 2, Edif 8, Polígono Empresarial Euronova, – 28760 Tres Cantos (Madrid)

Email: gdpr-cxiome@cxiome.es

Data Protection Officer: dpo-cxiome@cxiome.es

2. For what purpose do we process your personal data?

At CXIOME, we process the information provided by users and our customers for the following purposes:

– Respond to inquiries made through our contact form.

– To provide the contracted services and manage and maintain relationships with our customers and suppliers. This includes sending administrative communications related to the contracted services.

– Send communications with offers of services, events, and news related to our professional activity, when we are entitled to do so.

– Manage job vacancies and relations with candidates. Resumes will only be accepted through official channels, so resumes sent by any other means will not be accepted.

– Ensure the safety of people, property, and facilities.

– Analysis of customer interaction and service improvement. We analyze customer interactions with our services, including emails and customer service calls, to generate satisfaction indicators and evaluate service quality. These analyses may include profiling techniques, always with human intervention and respecting the rights of data subjects, including their right to object to this processing where applicable.

– Staff performance evaluation. Our employees’ calls and communications may be recorded and analyzed for quality control, performance monitoring, and internal training purposes.

3. How long do we keep your data?

The personal data provided will be kept for the time strictly necessary to fulfill the purposes for which it was collected and, where applicable, until the data subject requests its deletion. After these periods, the data may be blocked and kept for the purpose of dealing with any liabilities arising from the processing and only for the duration of the limitation period for such liabilities. After these periods, the personal data will be deleted.

4. What category of data do we collect?

Taking into account the purposes mentioned in the previous sections, the following categories of data may be processed: Identifying data (name and surname, telephone number, postal address, email address, and identification document); Economic, financial, or banking data (e.g., activities, businesses, commercial licenses, or bank accounts). Academic data: Education and qualifications. Professional data: Professional experience, membership of professional associations and bodies. Commercial information data: Activities, businesses, and commercial licenses.

In general, no specially protected data is processed. In the event that special categories of data are processed, it will be for the purpose of complying with obligations and exercising specific rights of the data controller or the data subject in the field of labor law and social security and protection, or for the formulation, exercise, or defense of claims

5. What is the legal basis for processing your data?

The legal basis that legitimizes the processing of your personal data will be related to the purpose for which the data was collected. In this regard, the processing of your personal data will be legitimized by one of the following conditions:

– When you provide us with personal data through our contact form, the processing of your data will be legitimized by your consent.

Acceptance of the privacy policy, through the established opt-in procedure, shall be understood for all purposes as the provision of free, specific, informed, and unequivocal consent—pursuant to Article 4 of the General Data Protection Regulation—by the USER for the processing of personal data under the terms set forth in this document.

– The processing of your data for the purpose of sending communications with offers of services, events, or news related to our professional activity will be legitimized by your consent or by the legitimate interest of CXIOME.

– When the purpose of processing your personal data is to provide the contracted services and manage the existing relationship, it will be the execution of the service provision contract.

– The processing of personal data for the management of job vacancies will be legitimized by the consent given by candidates when completing the contact form.

– The public interest will legitimize the processing of video surveillance images for the purpose of ensuring the safety of people, property, and facilities.

– Data processing for the analysis of customer interaction and the generation of satisfaction indicators, including automated profiling, will be legitimized by the legitimate interest of CXIOME, always guaranteeing transparency, human intervention, and the right of opposition of the interested parties.
– The processing of employee data for performance evaluation and call quality control purposes shall be justified by the performance of the employment contract and, where applicable, by the legitimate interest of CXIOME.

– Likewise, your personal data may be processed when necessary to comply with a legal obligation.

6. To whom will your data be disclosed?

In general, your data will not be transferred to third parties, except where legally required.
In order to fulfill the purposes indicated in this Policy, we will collaborate with service providers who may have access to your personal data. CXIOME has signed the corresponding data processing agreement with these providers, which imposes the following obligations on them, among others: to apply appropriate technical and organizational measures; to process personal data for the agreed purposes and only in accordance with the instructions indicated by CXIOME.

7. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation as to whether or not CXIOME is processing personal data concerning them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In such cases, CXIOME will notify each of the recipients to whom your personal data has been disclosed.

In certain circumstances, interested parties may request the limitation of the processing of their data, in which case we will only keep it for the exercise or defense of possible claims.

In certain circumstances, and for reasons related to their particular situation, interested parties may object to the processing of their data. CXIOME will stop processing the data, except for compelling legitimate reasons, or the exercise of defense of possible claims.

Interested parties shall have the right to receive the personal data concerning them, which they have provided to CXIOME, in a structured, commonly used, and machine-readable format.

To exercise the rights mentioned in the previous sections, users may send a written communication to CXIOME’s registered office or to the email addresses indicated in the header of this data protection policy, identifying themselves correctly. In case of doubts about the identity of the applicant, the Data Controller may request additional information.

We also inform you that you may file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe that the processing of your personal data violates applicable regulations.

8. Mandatory or optional nature of the information provided

By checking the corresponding boxes and entering data in the fields marked with an asterisk (*) or presented in the contact form, interested parties expressly, freely, and unequivocally accept that their data is necessary for CXIOME to respond to their request, with the inclusion of data in the remaining fields being voluntary. The user guarantees that the personal data provided to CXIOME is accurate and is responsible for communicating any changes thereto. CXIOME informs that all data requested through the website is mandatory, as it is necessary for the provision of an optimal service to the interested party. If all the data is not provided, it cannot be guaranteed that the information and services provided will be completely tailored to your needs.

9. What security measures do we have in place

CXIOME informs you that it has implemented the necessary technical and organizational security measures to guarantee the security of your personal data and prevent its alteration, loss, unauthorized processing, and/or access. Likewise, CXIOME has established measures to reinforce the confidentiality and integrity of the information in its organization, continuously monitoring, controlling, and evaluating processes to ensure respect for data privacy.

Information security certifications:

UNE–EN ISO 27001:2013 Information Security Management Systems.
UNE–EN ISO 20000-1: 2011 Information Technology Service Management System.
UNE-EN ISO 22301: 2012 Business Continuity Management Systems.
ENS: Certification of compliance with the National Security Scheme.

10. Conflict resolution and contact with the data protection officer

Interested parties may contact CXIOME’s Data Protection Officer directly with any queries, questions, or complaints regarding the processing of their personal data. The DPO will respond to these requests with the utmost diligence, providing advice and proposing solutions in accordance with current regulations, offering a quick way to resolve any issues related to your personal data.

The use of this channel does not limit or replace the right of the interested party to file a complaint with the Spanish Data Protection Agency. However, it is recommended that this channel be used as a first step to facilitate a quick and effective internal resolution.