Privacy Policy

The party responsible for this website is NALANDA GLOBAL, S.A., with tax identification number A-82692617 and registered office at Calle Proción, 7- Edificio América II Portal 4, 2° I, 28023, Madrid (“Nalanda”). Nalanda makes available to the users of the web pages located at the following URLs  https://www.nalandaglobal.com and https://www.obralia.com or accessible through the application for mobile devices (hereinafter, “Web Platform”) this Privacy Policy, in order to provide information on how we treat your personal data and protect your privacy and information.

Please take a few minutes to read this Privacy Policy carefully. This Privacy Policy may be modified when necessary. In case of modifications, we will inform you through the Web Platform, or by other means when possible, so that you can be aware of the new privacy conditions. Your continued use of the features made available to you after we have notified you of such changes will constitute your agreement to such changes, as an affirmative action.

The data entered in the Web Platform in connection with the provision of document management services are the property of the contractors and/or subcontractors.

Between Nalanda and the Client (regardless of its position as owner of the work, contractor or subcontractor in the provision of services) governs a data protection processing assignment relationship, with Nalanda holding the position of data processor and the Client holding the position of data controller (see Table 1).

The obligations and responsibilities of Nalanda and the customer, in their respective capacity as processor and data controller, are set out in section 3.4 of the General Terms and Conditions of Nalanda, accessible through this link under the heading “Responsibility of the CLIENT in the use of the Web Platform as data controller and responsibility of NALANDA as data processor”.

Table 1

In the event that the Client subcontracts other companies or freelancers, both the Client and Nalanda will have access to the documents of its subcontractors of different levels and in turn to the documentation of the workers involved in each work or project, therefore, the Client is responsible for obtaining from its lower subcontractors and/or its freelancers/workers the relevant authorization and guarantees that it has sufficient legitimacy for its treatment, regulating its relationship subject to the regulations of protection of personal data.

For what purposes do we process your personal data?

Personal data provided by users of the Web Platform will be processed for the following purposes:

• In case you are a Client and/or User of Nalanda, or are in the process of contracting any service provided by Nalanda:
  • Processing of the discharge process.
  • Management and maintenance of the Nalanda portal users.
  • Management and maintenance of Nalanda’s Clients.
  • Management of applications for professional vacancies in Nalanda’s current or future selection processes.
  • Manage the normal use of the website and perform statistical analysis on the use of the website.
• In the event that professional contact details are included in any of the services provided by Nalanda, they will be processed for the following purposes:
  • Document management tool: for the publication of the professional contact data necessary to enable the management of validation and authorization operations carried out through this tool.
  • Administration of the “Páginas Naranjas” web directory: to include the publication of such data, with the objective of listing and classifying the companies participating in the Web Platform and promoting relations among them.
  • Administration of the purchase tool: to enable the management of the purchase and sale operations carried out through this tool.
  • Administration of the electronic invoicing tool: for a correct sending and reception of invoices we will collect the data of the person in charge of sending/receiving of each company and its different delegations/centers.
  • Administration of the approval service: Nalanda will request the data of the person/s responsible for approval/compliance of the corresponding company in order to make the necessary communications.
• Purposes related to commercial communications:
  • Commercial communications by any means about Nalanda’s products and services.
  • Commercial communications from third parties with which Nalanda maintains partnership agreements.

What data are processed and from what sources?

Depending on the relationship with the Customer, Nalanda may process the following types of personal data:

• Identifying and/or contact data of users or employees of the client, its contractors and/or subcontractors (e.g. first and last name, business telephone number, business e-mail, IP address, etc.).
• Economic and financial data of the Customer or of the Customer’s employees, of its contractors and/or subcontractors (e.g.: means of payment of which you were the owner as a natural person, etc.).
• Academic and professional data of the client’s employees, its contractors and/or subcontractors (e.g.: academic degree, their position within their organization, etc.).

The data that Nalanda treats as a result of the interactions made by the user through our Web Platform come from the following sources:

• Data provided by the customer/user (or by a third party on his/her behalf) through the completion of the forms made available to him/her in the online registration process or by any other means (e.g., customer service).
• Data generated as a result of the development, execution or maintenance of the relationship between the user and Nalanda.

To ensure proper management in the processing of your data, Nalanda has designated a data protection officer (DPD), whose email address is dpo@nalandaglobal.com.

What is the legal legitimacy for the processing of your data?

Depending on their type and the relationship between the customer/user and Nalanda, Nalanda will process the personal data of users of the Web Platform under the following legitimate bases:

• Execution of the contractual relationship between Nalanda and the customer: in relation to the purposes of processing the registration and management of customers / users of the portal.
• Fulfillment of legal obligations applicable to Nalanda (e.g. tax obligations or billing): in connection with the purposes of management and maintenance of customers / users of the Nalanda portal.
• Legitimate interest of Nalanda: in relation to the purpose of sending advertising, promotional information relating to products and services of Nalanda, in the case of customers of Nalanda.
• Legitimate interest of third parties: in relation to document management, approval or electronic invoice services, or purchasing tools, or “Orange Pages”, in accordance with Article 19 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), insofar as such data are necessary for the professional location of the data subject for the sole purpose of maintaining relations with the legal entity in which the data subject provides services (or it is an individual entrepreneur or liberal professional).
• Consent, in the event that it has been provided, for the purpose of sending promotional advertising information relating to products and services of third parties with which Nalanda maintains collaboration agreements.

To whom is your data communicated?

The processing of personal data described and reported in this Privacy Policy does not imply the realization of communications or transfers of your data by Nalanda to third parties, except where there is a legal obligation or are necessary for the provision of the service contracted by the Customer. In this sense, it is reported that certain features of the Platform may involve the dissemination of identification data and / or professional, restricted to Customers / users of the Platform.

On the other hand, Nalanda’s data processors may have access to personal data, i.e. service providers contracted by Nalanda who, for the performance of their duties, have to access them.

How long do we keep your data?

Personal data will be retained for the duration of the relationship with Nalanda and / or to achieve the purpose of treatment pursued or, where appropriate, until you exercise your rights to terminate the treatment. Once this period has elapsed, your data will remain blocked for the attention of judicial, administrative or tax claims, for the periods legally determined by the regulations applicable in each case.

Subsequently, you may request that we completely delete your information, in which case it will no longer be accessible. To process such a request, you must contact our data protection officer and write to  dpo@nalandaglobal.com.

In compliance with the principle of limitation of the retention period, we reserve the right to keep the data and documentation for the duration of the contractual relationship and thereafter for the time necessary for the specific purposes for which they have been collected in order to comply with legal obligations and responsibilities arising from such processing in accordance with the applicable regulations such as the prevention of possible inspections, so it is agreed to keep them for a period of prudence thereafter.

Documentation relating to employees is automatically deleted five years after it has been deactivated from the portal.

In the case of candidates, your data will be kept for a period of 1 year. If you do not wish your data to be retained for this period, you may exercise your right of deletion or revoke your consent.

What information do you need to provide?

Nalanda informs customers and users that it will be necessary to provide at least those data marked with an asterisk (*) in the registration form. These data are strictly necessary to acquire the status of registered customer and, eventually, user, being voluntary the inclusion of data in the remaining fields.

In case of not providing at least such data, considered as necessary, Nalanda will not be able to manage the registration process or carry out the provision of the contracted service.

What do you have to guarantee us when you provide your personal data?

The Client and/or user guarantee that the data provided are true, accurate, complete and up to date, undertaking to keep them up to date, being responsible for any damage or loss, direct or indirect, that may arise from the breach of such obligation and guarantee.

In the event that the user provides data belonging to a third party, he/she guarantees that he/she has informed said third party of all the aspects contained in this Privacy Policy and obtained his/her authorization, and has sufficient legitimacy, to provide us with his/her data for the purpose of the processing in question.

What measures do we take to protect your personal data?

In response to the concern of Nalanda to ensure the security of your data, measures have been implemented to ensure the confidentiality, integrity and availability of your data. Also, specific security levels have been adopted for the protection of personal data and have been installed technical and organizational means to prevent the loss, misuse, alteration, unauthorized access and theft of personal data provided through the Web Platform.

In particular, NALANDA has ISO/IEC 27001:2003 certification for Information Security Management Systems (ISMS) as well as ISO 9001-2015 certification for Quality Management Systems.

What are your rights regarding your personal data?

Nalanda states that you have the right to obtain information about your personal data that we are processing, as well as to request in accordance with data protection regulations:

• Access to your data to know what personal data we are processing.
• The rectification of your personal data that you consider inaccurate and that are subject to processing by Nalanda,
• The deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• The limitation of the processing of your data, in which case we will only keep the data on which you have requested the limitation for the exercise or defense of claims.
• The portability of your data in a structured format of common use and machine readable, as well as to be transmitted by Nalanda to another data controller.
• The opposition to the processing of your data in which case, we would stop processing them unless we must continue to do so for the fulfillment of our contractual or legal obligations, for compelling legitimate reasons or for the exercise or defense of possible claims.

We also remind you that you have the right to withdraw any of the consents you may have given for the processing of your data, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

Nalanda informs you that you may exercise your rights over your personal data by writing to NALANDA GLOBAL, S.A. (to the postal address Calle Proción, 7- Edificio América II Portal 4, 2° I, 28023 or e-mail dpo@nalandaglobal.com) enclosing a copy of your DNI, NIE, Passport or equivalent document, on both sides, in order to prove your identity.

Nalanda will provide the requested information within a maximum period of 1 month from receipt of the request, although we inform you that this period could be extended for another 2 months taking into account the complexity and number of requests.
Finally, we inform you that you can file a complaint with the competent supervisory authority on data protection, being in Spain the Spanish Data Protection Agency (www.aepd.es). However, beforehand, you may contact the Data Protection Delegate, who will resolve the complaint within a maximum period of two months.

OTHER PROCESSING OF PERSONAL DATA

Cookies and similar:

Cookies are files that are downloaded to the User’s browser and can be read later by Nalanda. In this way, cookies allow various functionalities, such as, for example, recognize a user who has accessed the website previously and to make analysis on the use of the web service to improve it. However, it is not possible to find out the identity of the User from the cookies used by Nalanda, unless the User provides additional information through other means and these could be linked to the cookies you have downloaded.

You can access our Cookies Policy through the following link: https: //www.nalandaglobal.com/politica-de-cookies/

Let’s Talk” form:

The data provided through the “Let’s Talk” form will be used to respond to your contact request.

• Legal basis: The legal basis that legitimizes the treatment, is the execution of a contract formed at the time of sending your request for contact.

Also, if you have authorized by checking the appropriate box on the contact form, you may receive by any means commercial communications about products, services, promotions, news or events Nalanda, related to their services. You can obtain more information in this regard in the communications section of this Privacy Policy. You may also withdraw your consent as indicated in the section on the rights of interested parties of this Privacy Policy.

• Retention period: The data will be processed for the time necessary to resolve your contact request. Subsequently, they will be blocked and kept for 3 years for the attention of the possible responsibilities derived from the treatment.

Request more information” form:

The data provided through the form “Request more information” will be processed by Nalanda in order to respond to your request for information.

• Legal basis: The legal basis that legitimizes the treatment, is the execution of a contract formed at the time of sending your request for information.

Also, in the event that you have authorized by checking the appropriate box on the request form for more information, you may receive by any means commercial communications about products, services, promotions, news or events Nalanda or third parties with which Nalanda maintain collaboration agreement related to their services. You may withdraw your consent as indicated in the section on the rights of interested parties in this Privacy Policy.

• Retention period: The data will be processed for the time necessary to resolve the user’s request for contact. Subsequently they will be blocked and kept for 4 years for the attention of the possible responsibilities derived from the treatment.

Work for us” form:

The personal data you provide through this form will be processed by Nalanda to manage your application for the corresponding selection process.  

• Legal basis: The legal basis is the execution of a contract formed at the time you submit your application.
• Retention period: Your data will be kept for a period of 1 year. If you do not want your data to be kept during this period, you may exercise your right of deletion. Your personal data will not be disclosed to third parties unless required by law.

You may exercise your rights at any time as indicated in the section on data subjects’ rights in this Privacy Policy.

Contract or Extend” form:

Nalanda will process the data provided through the “Contract or extend” form in order to provide and manage both the personalized services of basic CAE document management and, where appropriate, the approval services configured in different packs (Basic CAE Document Management, Silver, Gold or Platinum Pack), at the choice of the provider, as well as its subsequent collection and monitoring.

• Legal basis: The legal basis that legitimizes the treatment is the execution of the contract formalized with the customer through its high in the service and the acceptance of the particular and general conditions of contracting.

Also, based on the legitimate interest of Nalanda, commercial communications may be sent to the user by any means (including electronic) about services, products, news or events related to Nalanda’s own services (e.g. document management services and / or approval of suppliers). You can obtain more information about commercial communications in the communications section of this Privacy Policy.

• Retention period: The data will be processed for this purpose for the duration of the contractual relationship between the parties and during the legally established statute of limitations.

You may exercise your rights as indicated in the rights of data subjects section of this Privacy Policy.

The data provided through the drop-down “Leave a message” and specifically in relation to the user’s choice of the respective drop-down (i) contact form and (ii) commercial form, (i) in order to meet the request for information.(ii) As well as the commercial reason for your request through your selection the request for a videoconference, commercial training visit or loyalty call.

• Legal basis: The legal basis that legitimizes the treatment, is the consent of the user expressed at the time of sending your request for contact based on the requested subject.
• Retention period: The data will be processed for the time necessary to resolve the user’s request for contact. Subsequently they will be blocked and kept for 3 years for the attention of the possible responsibilities derived from the treatment.

Also, in the event that you have authorized by checking the appropriate box on the support form, you will receive by the means of contact provided, including electronic, commercial communications about products, services, promotions, news or events Nalanda, related to the management sector and document information for companies, such as services relating to the corporate purpose of Nalanda. You can obtain more information about commercial communications in the communications section of this Privacy Policy.

You may withdraw your consent and exercise your rights at any time, as indicated in the data subjects’ rights section of this Privacy Policy.

Sending Commercial Communications:

Nalanda informs the user that you may receive commercial communications that you request or that refer to products, services, promotions, news or events Nalanda.

The tool used to send commercial communications by e-mail will include links and small, transparent images that will be associated with your e-mail address. Thus, when you download one of these images or access the links contained in the email, Nalanda can know for statistical purposes if the mail has been opened or if you have accessed a link from that email. You can prevent these uses by configuring your email manager or program to prevent automated downloading of images, as well as not accessing the links included in the emails you receive.

In each communication, the user may object to receive this type of information through the specific mechanisms to process the unsubscription, as well as request, where appropriate, the right to revoke consent, opposition or deletion.

More information:

If you have any questions about the information contained in our Privacy Policy, please send an e-mail to dpo@nalandaglobal.com.