PRIVACY POLICY

We have a high level of commitment to individual privacy, and therefore the protection of personal data is important to us.

We process data in accordance with the provisions of EU Regulation 2016/679 General Data Protection Regulation, Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, and other current regulations in this regard.

This Privacy Policy was reviewed in April 2026 to comply with the information and transparency duties of the website and the data controller in general, providing any interested party—not just website users—with the general terms of the controller on this matter. Variations may occur until its next review.

Who is the controller of your data?

• Controller: MAM GALINDO S.L.

• NIF/CIF: B73719759

• Address: CALLE HORNO, 42 1º. 30800 Lorca (MURCIA)

• Email: comercial@vitaevis.com

What is the origin and type of data we process?

The origin of the information we process may be any of the following categories:

• Paper, electronic, or digital forms.

• Communication and messaging systems: email and messaging applications, telephone, etc.

• Other lawful sources and origins of information.

The different categories of data that we may process, depending on the type of data subject (user, client, supplier, employee, etc.) and the nature of the controller's activity, are:

• Identification data: e.g., name and surname, image.

• Identification codes or keys: e.g., username, employee code.

• Contact addresses (postal or electronic): e.g., telephone number, email, social media profile.

• Personal and professional characteristics: e.g., age, date of birth, qualifications, professional experience, CV.

• Economic, financial, and insurance data: e.g., bank details, credit card, etc.

• Economic and non-economic payroll data and other employment information: e.g., job position, payroll document, etc.

• Transaction data: e.g., goods and services supplied and received.

• Special category data: e.g., health, trade union membership, racial origin.

• Other data and information: necessary or implicit in the development of our activities, services, and objectives.

MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE DATA SUBJECT. By ticking the corresponding boxes and entering data in fields marked as mandatory (for example, with an asterisk) in the contact form or presented in download forms, the data subject expressly, freely, and unequivocally accepts that their data are necessary for the controller to meet their request; the inclusion of data in the remaining fields is voluntary.

The data subject guarantees that the personal data provided to the controller are true and undertakes to communicate any modification thereof. The data requested through the website, marked as mandatory, are necessary to provide an optimal service. If all data are not provided, there is no guarantee that the information and services provided will be completely adjusted to your needs.

For what purpose do we process your personal data?

In general, data are processed to successfully carry out the actions implicit in the normal development and management of the controller's activity. Specifically:

• Clients and prospects: management and maintenance of commercial, pre-contractual, and contractual relationships; internal administration; economic management; advertising and marketing; customer service.

• Collaborators, creditors, and suppliers: management and maintenance of commercial relationships, internal administration, and economic management.

• Workers: management, development, and maintenance of the employment relationship, HR management, communications, training activities, health and safety, time tracking, and other purposes derived from legal obligations.

• Candidates: management of CVs received, management of job offers, and personnel selection.

• Web and social media users: user support and management of communications between parties.

• Visitors: visitor support and access control to facilities.

Other general purposes:

• Commercial profiling: to improve your experience by personalising offers and communications (based on legitimate interest; no individualised decisions are made).

• Video surveillance: for the security of property and people, and labour control.

• Telephone switchboard: recording communications for security, guarantee, and quality of service.

• Financial management: in case of debtors with certain, overdue, and enforceable outstanding payments, the controller may communicate this to credit solvency files or debt collection services.

• Communications: development and execution of communications (email, instant messaging, etc.) for internal and external categories.

How long will we keep your data?

Personal data will be kept at least as long as the relationship with the data subject exists, as long as its erasure is not requested, as long as liabilities may arise, or as long as there is a legal requirement for retention. CVs of candidates will be deleted immediately when they are no longer of interest.

What is the legitimation for processing your data?

• Informed consent of the data subject.

• Pre-contractual or contractual commitments.

• Legitimate interest of the controller.

• Applicable legal obligations.

To which recipients will your data be communicated?

Data will not be communicated to any third party by default, except for: a) auxiliary services and authorised processors; b) competent public authorities and administrations; c) other legitimate third parties provided for by law.

What are your rights?

You may request the exercise of the following rights:

• Access: to confirm if your data are being processed.

• Rectification or Erasure: when data are inaccurate or no longer necessary.

• Restriction of processing: in certain circumstances (data will only be kept for the exercise or defence of claims).

• Portability: to receive your data in a structured format.

• Objection: to stop processing for reasons related to your particular situation.

• Revocation of consent: which may entail the cancellation of the existing relationship.

To exercise these, contact us at the email or postal address indicated at the beginning.

Data Security

We adopt the necessary technical and organisational measures to guarantee an adequate level of confidentiality, integrity, availability, and resilience. However, we do not assume responsibility for damages caused by third-party alterations to our systems beyond what the legal system permits.

Sending communications or information

Our policy is limited to sending communications we consider of interest or that you have consented to receive. You may opt out at any time via the mechanisms provided in said messages.

Social Media

By following our profiles, you provide consent for the processing of data available on your profile. Users must refrain from publishing content contrary to law, morals, or public order. The controller is not responsible for the security measures of each platform.

Regarding minors, in Spain, processing is only allowed for those over 14 years of age. Otherwise, the intervention of a legal representative is required.

Recruitment and candidate management

Data supplied for job offers will be processed to manage candidacies for the controller or subsidiary companies. If the data are no longer of professional interest or the purpose for collection ends, they will be deleted ensuring confidentiality and anonymisation.