Introduction

Valid Soluciones Tecnológicas, S.A.U. (“Valid”) acts as the data controller for processing activities conducted on the website https://trustedconnectivity.valid.com. Valid is strongly committed to regulatory compliance and the protection of user privacy. As part of its transparency duty, this document details how personal data may be processed and the rights recognized by applicable regulations. For any questions or additional information, users may contact Valid at rgpd@valid.com.

From Whom Do We Collect Personal Data?

The personal data processed through the website https://trustedconnectivity.valid.com (the “Website”) is provided directly by the users through the applications forms made available for this purpose or via the communication channels detailed in each section of the site.

Users guarantee that the data they provide is truthful, accurate, complete, and kept up to date to reflect their real circumstances.

If users provide third-party data, they confirm they have the necessary authorization to do so and agree to share this Privacy Policy with the third party, releasing Valid from any liability in this regard. Valid may perform checks to verify this claim, taking appropriate due diligence measures under data protection regulations.

Data fields marked with an asterisk (*) in the application forms are necessary to achieve the purposes for which the data is collected. If users do not provide such data, it will not be possible to process the corresponding requests.

What Categories of Data Do We Process?

According with the purposes and processing activities conducted via the Website and its specified contact channels, Valid may process the following categories of personal data:

1. Identification and Professional Contact Data: Name, surname, email address, country, or geographic region.
2. Employment Details: Job title, employer name, and corporate contact details.
3. Browsing Data: IP address, advertising ID, and user behavior on the Website.
4. Other Data: Information provided directly by the user during communication through the specified channels.

For What Purposes Do We Process Personal Data?

Valid processes user-provided data for the following purposes:

1. To manage and respond to contact requests submitted via the Website’s application forms, corporate email addresses, or other contact channels.
2. To manage newsletter subscriptions and periodically send electronic commercial communications regarding services, events, and professional news, unless the user opts out.
3. To send commercial or promotional information related to contracted services and value-added solutions for end users unless the user opts out.
4. To manage event´s registration and attendance.
5. To create anonymous statistical reports about access habits, preferences, and user behavior on the Website.
6. To comply with legal obligations and verify compliance with contractual obligations, including fraud prevention.

On What Basis Will We Process Personal Data?

Valid processes users’ data in accordance with the following legal bases:

1. Managing and responding to contact requests made by the user:
   The legal basis for processing data for this purpose is the user’s consent, which may be withdrawn at any time. If the user withdraws consent, the query or issue raised cannot be processed further.
2. Managing subscription to the newsletter through Valid’s website and sending periodic commercial electronic communications:

The legal basis for processing data for marketing purposes is the legitimate interest under the exception provided in Article 21.2 of the Information Society Services Law. This legitimate interest is based on conducting direct marketing to offer users products and services that may be of interest to them, fostering loyalty. However, the user has the right to object to this processing when providing their data and at any time thereafter.

If the user has not previously received services from Valid and there is no prior contractual or pre-contractual relationship, data will be processed based on the consent provided by the user. Furthermore, data processing derived from subscribing to newsletters via the designated form will also be carried out based on the user’s consent.

If the user wishes to stop receiving commercial or promotional communications from Valid, the user can request to unsubscribe by sending an email to trustedconnectivity@valid.com or clicking the link at the bottom of the commercial communications sent.

1. Managing the user’s registration and attendance at events organized by Valid:
   The legal basis for processing data for this purpose is the user’s consent, which may be withdrawn at any time.
2. Creating anonymous statistical reports regarding users’ access habits, preferences, and behaviors on the website:
   The legal basis for all processing derived from this purpose is the legitimate interest recognized by data protection regulations. This legitimate interest is based on providing Valid’s users with the highest quality services and the best possible experience.
3. Fulfilling legally established obligations:
   The legal basis for all processing derived from this purpose is compliance with a legal obligation.

The consents obtained for the aforementioned purposes are independent, meaning the user can revoke one without affecting the others.

How Long Do We Process Data?

Valid will retain users’ personal data for the following periods:

1. Managing and responding to contact requests made by the user:
   Data will be retained for as long as necessary to process and respond to the user’s request. Once completed, the data will remain blocked for the duration of the statute of limitations for any legal actions arising from the request.
2. Managing subscription to the newsletter through Valid’s website and periodically sending commercial electronic communications:
   Data will be processed until the user objects to receiving these communications or withdraws their consent.
3. Managing the user’s registration and attendance at events organized by Valid:
   Data will be retained for as long as necessary to manage the event. Once the event is completed, the data will remain blocked for the duration of the statute of limitations for any legal actions arising from the request.
4. Creating anonymous statistical reports regarding users’ access habits, preferences, and behaviors on the website:
   Information will be used in aggregate form to create reports, statistics, and analyses for as long as necessary to process and complete these tasks. Once completed, the data will remain blocked for the duration of the statute of limitations for any legal actions arising from the request.
5. Fulfilling legally established obligations:
   Data provided to fulfill obligations arising from Valid’s services will be retained for the legally established time periods.

To Whom Will Data Be Communicated?

Valid informs users that their data may be shared with other companies within the Valid Corporate Group to address user requests, manage contracted services, and provide information about services, events, and news related to professional activities. This is done for administrative and management purposes within Valid, based on the legitimate interest recognized in Article 48 of the General Data Protection Regulation (GDPR). These recipients may be located inside or outside the European Economic Area (EEA), and in the latter case, international data transfers will be appropriately legitimized.

When users register for events organized by Valid in collaboration with business partners, suppliers, or third parties, the data provided by the user may be shared, provided there is sufficient legal basis for doing so, as specified in the relevant registration processes.

Additionally, certain data may be shared, in compliance with applicable laws or contractual relationships, with the following entities:

• Public Administrations: In cases stipulated by law, based on legal obligations.
• Courts and Tribunals: In cases stipulated by law, based on legal obligations.
• Law Enforcement Agencies: In cases stipulated by law, based on legal obligations.
• Banks and Financial Institutions: To process payments for services provided by Valid to its clients.
• Legal Professionals: When required by law or necessary for the execution of contracted services.

Furthermore, Valid collaborates with third-party service providers who may have access to users’ personal data to provide services on behalf of Valid. These providers process data on Valid’s behalf in accordance with strict procedures to ensure compliance with data protection regulations, including entering into appropriate data processing agreements in line with Article 28 of the GDPR.

Where Are Personal Data Processed?

Due to the structure of the Valid Group companies and the geographical location of their offices, the personal data provided by users may be processed outside the European Economic Area (EEA). This applies based on the nature of user requests, contractual relationships, participation in selection processes, or registration for events organized by these offices.

Valid and the Valid Group companies have implemented the necessary legal, technical, and organizational measures to protect the personal data provided by users. These measures ensure compliance with the standards established by various regulations, including the execution of Standard Contractual Clauses in accordance with the European Commission Decision 2021/914, which defines the new set of standard contractual clauses for transferring personal data to third countries under the GDPR.

In cases where Valid employs service providers located outside the European Union to maintain the website, these international data transfers are regulated through the aforementioned Standard Contractual Clauses. This reflects Valid’s commitment to protecting the integrity and security of users’ personal data, in full compliance with the applicable legal requirements.

What Security Measures Are Adopted to Protect Personal Data?

In line with Valid’s commitment to protecting personal data and user privacy, the necessary security measures have been implemented to prevent loss, manipulation, dissemination, or alteration of the data. These include:

• Encryption of communications between the user’s device and Valid’s servers.
• Encryption of information on Valid’s servers.
• Other measures to prevent third-party access to user data.

What Rights Does the Data Subject Have?

Users may exercise the following rights at any time and free of charge by sending a written request to Valid at Avenida Manoteras 20, Edificio Tokyo, Planta Baja, 28050, Madrid, Spain, or via email at rgpd@valid.com:

1. Right of Access: The user has the right to be informed about whether or not Valid is processing their personal data. If so, the user can access the data and receive information about the purposes of processing, the categories of data involved, the recipients to whom their data has been communicated, and the expected retention period, among other information.
2. Right of Rectification and Deletion: The user has the right to request the deletion of personal data when the legal requirements are met and the correction of inaccurate data when, for example, the data is no longer necessary for the purposes for which it was collected.
3. Limitation of Processing, Revocation of Consent, and Objection to Processing: Under certain circumstances (e.g., if the user contests the accuracy of their data, while its accuracy is being verified), the user can request the limitation of their personal data processing. These data will only be processed for the exercise or defense of legal claims. The user also has the right to revoke their consent and oppose processing at any time, for reasons related to their particular situation, if the processing is based on our legitimate interest or that of a third party (including marketing). In this case, Valid will cease processing, unless legitimate grounds are provided.
4. Right to Data Portability: The user has the right to receive the personal data they have provided to Valid in a structured, commonly used, and machine-readable format and to transmit it to another data controller, as legally provided.
5. Other Rights:
   a. When personal data is transferred to a third country or an international organization, the user has the right to be informed about how to access or obtain a copy of the safeguards related to the transfer.
   b. The user may file a complaint regarding the protection of their personal data with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at C/ Jorge Juan, 6, 28001 – Madrid, if they believe Valid has violated the rights granted to them under applicable data protection regulations.

Changes to the Privacy Policy

Valid reserves the right to make necessary changes to ensure compliance with current legislation.

Last Updated: January 8, 2025

© Valid Soluciones Tecnológicas, S.A.U. All rights reserved.