1.- PRIOR CONSIDERATIONS

UMILES NEXT, S.L. (hereinafter, "UMILES "), in its commitment to the Protection of the Confidentiality and Privacy of Personal Data, has adapted all its business processes, and especially those that involve the processing of personal data, to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (GDPR), as well as to Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, adapting all processes to the new requirements and implementing the necessary security measures taking into account the results obtained from the risk analysis carried out.

This PRIVACY POLICY sets out what personal information we may collect, why we collect that data and what processes and formalities we will carry out in order to process it.

It is important to remember that by providing personal data, you are expressly acknowledging that UMILES may process the data in accordance with the processes and procedures established in this PRIVACY POLICY.

We also inform you that legislative, technological or other changes may imply the need to adapt the content of the PRIVACY POLICY to the new requirements, so we recommend that you visit our website to consult the most up-to-date PRIVACY POLICY.

This PRIVACY POLICY regulates the collection and processing by UMILES of (i) the personal data that you provide as a user of this website (hereinafter, the "WEBSITE "), including the services that are available through the WEBSITE; and (ii) other data collected through other collection systems, duly identified below. All this without prejudice to the specific provisions established in certain sections, forms or services available on the WEBSITE in order to provide you with the relevant information and, where appropriate, obtain your consent.

UMILES reserves the right to modify the PRIVACY POLICY to adapt it to legislative, jurisprudential and/or administrative developments, as well as to the practices developed at any time through the WEBSITE, taking your rights and interests into account at all times.

UMILES will provide the appropriate technical resources so that you can access the PRIVACY POLICY to comply with the information obligations in application of regulations that regulate data protection.

2.- INFORMATION ON THE PERSON RESPONSIBLE FOR DATA PROCESSING

In accordance with article 10 of Law 34/2002, of 11 July, on Services of the Information Society and Electronic Commerce, which regulates your right to information, we inform you of the following data in relation to the Owner of the WEBSITE:

UMILES NEXT, S.L. is a limited liability company with registered office in Bilbao at Calle Elcano, no. 5, 1, right, 48009 (Bizkaia), registered in the Commercial Registry of Bizkaia in Volume 6019, Section 8, Page BI 77036 and with Tax Identification Number (NIF) B06845390. The contact telephone number is 91 113 89 88 and the contact email is info@umilesnext.com.

For any additional information regarding UMILES, you can contact us at info@umilesnext.com or at the telephone number 91 113 89 88, or visit the website www.umilesnext.com .

3.- DATA COLLECTION METHODS

The data processed by UMILES has been collected through: (i) the forms that you fill out during use of the WEBSITE and/or through other channels (e.g. registration as a user of the WEBSITE -when applicable-, contact forms, budget request forms, etc.); (ii) by sending a consultation email; or (iii) through other duly identified collection systems, such as the registration of visits to our offices and the video surveillance system implemented in our facilities.

In the event that the personal data provided belongs to a third party, the User guarantees that they have informed said third party of the PRIVACY POLICY and have obtained their authorisation to provide their data to UMILES for the purposes indicated below.

In addition, you are hereby informed of the possible processing of your social network data through the corporate profiles kept by UMILES on each social network where it is present, all under the terms and conditions established in each social network.

4.- TYPES OF DATA OBTAINED

At UMILES, we specifically process the following categories of data:

• Identification and contact data (e.g. name, surname, ID, postal and electronic address, telephone, etc.).
• Professional data/employment details (e.g. company and position).
• Images captured in the activities and events organized by UMILES in which you participate.
• Identification codes and keys as a registered user of the WEBSITE.
• Internet browsing data (e.g. IP address, visits to web pages, etc.).
• Data on personal characteristics, training, employment, etc. (in the case of job applications/offers and/or UMILES selection processes in which you participated voluntarily).

5.- PURPOSE OF THE PROCESSING

The personal data voluntarily provided by the client or User will entitle UMILES to collect and process the data for the following purposes:

• Manage and process your registration as a user of the WEBSITE, when possible.
• Manage your access to and use of the content and services provided by UMILES through the WEBSITE, including blog services, social networks or any other functionalities that are accessible from the WEBSITE at any time.
• Obtain statistical data on the access, download and use of the content and services made available to you through the WEBSITE.
• Process and manage the contracting and, where appropriate, subsequent invoicing, of products or services formalised with UMILES through the WEBSITE, including the offer of face-to-face and/or telematic activities and training, and, in general, maintain, manage and control the contractual relationship that you establish with us as the acquirer of our products or services.
• Process and manage the request for information, suggestions, complaints or claims made through the WEBSITE or email, including any queries made regarding privacy and/or the exercise of your data protection rights.
• Sending you commercial communications and advertising from UMILES and other companies from our business group through various means, including electronically, in regard to products, services, offers, promotions and any other relevant information referring to said entities, provided that you have consented to these offers or it is about products or services similar to those previously contracted with UMILES.
• Manage your subscription to our "newsletter" service and to send the corresponding electronic communications, provided that you have consented.

• If you have consented, manage and disseminate activities and events organized by UMILES.
• Manage your job application or your enrolment in a job offer and your participation in the corresponding selection process.
• Ensure the safety of our facilities by logging visits.
• Ensure the safety and integrity of people and property by capturing images through the video surveillance system implemented at the entrances and inside our facilities.

In no case will the data collected be used for profiling or for automated decision-making.

The processing of your personal data by UMILES, in accordance with the applicable regulations, is based, as the case may be, (i) on your consent, granted at the time of the collection of your personal data that you voluntarily provide through the mechanisms enabled for this purpose on the WEBSITE; (ii) on the relationship established with us in the contracting of our products and services; or (iii) on the legitimate interest of UMILES, in what affects the recording of visits to our facilities, the video surveillance system implemented in our facilities and other uses considered legitimate by the company.

We remind you that in those cases where the processing is based on your consent, you may revoke your consent freely at any time, free of charge, under the terms of this PRIVACY POLICY.

6.- RECIPIENTS OF THE DATA

UMILES may share and communicate the personal data you provide to the third parties detailed below for the sole purposes set out in this PRIVACY POLICY:

• Software/systems vendors.
• Professional advisors.
• Communication Platforms and Marketing/Advertising Companies
• Companies supplying the products and services offered.
• Banks and financial institutions.
• Transport and messenger companies.
• Satisfaction survey entities.
• Public Government offices and agencies to whom UMILES has a legal obligation to provide this data, where appropriate.
• Entities of the UMILES business group, in order to respond to requests and queries and/or send you commercial communications regarding said entities and their respective activities or products.

Moreover, be aware that your personal data may be communicated to third parties that provide services to UMILES, some of whom have data processing centres located outside the European Economic Area, so your data may be subject to international data transfer, subject to the applicable legal guarantees.

7.- DATA RETENTION TIME

In general, personal data will be kept for the time necessary to serve the purpose for which the data were collected or until you revoke your consent or request its deletion, as well as the additional time necessary to comply with the legal obligations that UMILES must observe.

In any case, be aware that UMILES has established internal data purification policies aimed at controlling the retention periods of the personal data in its possession, so that the data will be disposed of when no longer necessary and/or appropriate for the purpose for which they were collected.

Specifically note the following:

• In regard to the record of visits to our facilities, the data will be kept for a maximum period of one month.
• As for the video surveillance system implemented in our facilities, the images captured will be deleted within a maximum period of one month.
• For the management of job applications, your data will be kept for a maximum period of 36 months.

8.- USER RIGHTS

UMILES, as the data controller, undertakes to respect the confidentiality of the data and to make available to the user the means necessary for the effective fulfilment of their rights. At any time, you can exercise the following rights:

• Access: You have the right to access your data to know what personal data we are processing.
• Rectification or deletion: you have the right to rectify any inaccurate personal data that are being processed or even to request their deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• Limitation: you have the right to request that we to limit the processing of your data, in which case we inform you that we will only keep the data for the exercise or defence of claims as provided for by the applicable regulations on data protection.
• Opposition: you have the right to object to the use of your data for a purpose other than that for which it was provided, in which case, we would stop processing it unless, for legal reasons or for matters related to claims, UMILES must continue.
• Portability:  you have the right to receive your personal data that you have provided us, in a structured, commonly used and machine-readable format, and to transmit the data to another data controller.
• Withdrawal: You have the right to withdraw consent at any time, without affecting the legality of the treatment based on consent prior to its withdrawal.

You may exercise all the rights described by email to protecciondatos@crisalion.com  or by writing to the registered office of UMILES indicated in clause 2, indicating in the subject "Protection of personal data" and informing us of the reason for your request. You can also contact our Data Protection Officer by email at dpo@crisalion.com.

Finally, we inform you that you can lodge a complaint with the competent Supervisory Authority (in Spain, the Spanish Data Protection Agency), especially when you have not obtained satisfaction in the exercise of your rights. You can contact this Authority through its website: www.aepd.es.

9-. COOKIES POLICY

We inform you that UMILES has established a Cookies Policy that is accessible through the WEBSITE.

10.- SECURITY MEASURES

UMILES will process your data in an absolutely confidential manner at all times and maintain the mandatory duty of secrecy regarding such data, in accordance with the provisions of the regulations, adopting the necessary technical and organisational measures to ensure the security of your data and to prevent its alteration, loss or unauthorised processing or access, taking into account the state of technology, the nature of the data stored and the risks to which the data are exposed.