1. WHO IS THE CONTROLLER OF YOUR DATA?

The data controller is INDUSTRIA DE DISEÑO TEXTIL, S.A. (INDITEX, S.A) (hereinafter, INDITEX).

This Privacy Policy (together with the Terms of Use and other documents contemplated therein), establishes the bases on which INDITEX processes your data through the global recruitment platform of the Inditex Group, Inditex Careers (hereinafter, Inditex Careers or Global Platform).

One of the main objectives of the Global Platform (accessible through URL http://www.inditexcareers.com), owned by INDITEX, is to manage worldwide the recruitment processes of all its Group companies and maximize the opportunities of its registered users. 

Each time that you use the Global Platform and you provide us with or we have to access any information that given its features permits us to identify you (hereinafter, Personal Data), either to browse it or to use its services or functionalities (to register as a user, register as a candidate to an offer, subscribe to receive our employment offers, send a consultation through the contact form, etc.), you will be subject to the Privacy Policy in force from time to time and must review its wording to verify that you are in agreement with it.

 

2. WHY WE PROCESS AND ORIGIN OF YOUR PERSONAL DATA

Depending on the services and functionalities of the Global Platform that you use, we will need to process some or other data, which will in general be, in each case, those set out below: 
 
-     your identification data (for example, your name, surname, address, contact telephone, etc.);
-     academic and professional data (training, etc.);
-     employment details (profession, professional history, etc.);
-     data on your professional interests and preferences.
 
Failure to provide certain data marked as compulsory may impede the processing of your registration as a user or your candidature for employment offers available through the Global Platform. 

 

Important note on the content of the provided additional information: 

It is very important for the data that you provide through the free text fields, and in the files, links or documents submitted not to contain confidential or especially sensitive information, such as: racial or ethnic origin, ideology or political, religious or philosophical convictions, membership of political parties or trade unions, physical or mental health, biometric or genetic configuration data, sexual orientation, criminal record, Social Security or personal identification number, etc.
If you provide us with information of this kind, you accept your liability for the potential risks to your privacy. If we detect this type of information, we will proceed to delete it from our systems and it will never be taken into consideration for the recruitment processes.
 
The origin of the Personal Data that we process at the Global Platform may be any of those set out below:

-     Your direct interaction with the Global Platform itself, by completing the registration form and any specific forms available for the specific functionalities that you wish to use.

-     Through a third party, if you authorized him/her to reference you and provide us with your contact data. Such data may appear preloaded in the Global Platform registration form, so as to process your registration as a potential candidate to participate in the Inditex Group recruitment processes. Remember that, in those cases in which you complete the process for registration with the Global Platform, we will report this to the third party who provided your contact. In addition, if you do not register as a user within a certain time, we will proceed to delete your data.

Depending on the manner in which you interact with the Global Platform, we will use your Personal Data for the following purposes:

a)   To register you as a user of the Global Platform: We will use the Personal Data that you provide us with to identify you as a user of the Global Platform and afford you access to the various services, functionalities and applications available to you as a registered user.

In addition, we may use your data to get in touch with you by e-mail, telephone or SMS, relating to functionality updates or to send you informative notices on the services, including security updates of the Global Platform.

b)   Inditex Group recruitment processes: We will use the Personal Data that you provide in the Global Platform registration form and while you use as a registered user the services and functionalities of the Global Platform, to develop, implement and manage the Inditex Group recruitment processes, depending on the areas of interest that you mark and on the existing offers to which you send your candidature.

In addition, we may contact you by e-mail, telephone or SMS for an adequate management of the recruitment processes in which you wish to participate.

c)   Ancillary services or functionalities: In addition to the functionalities pertaining to the Global Platform, the Global Platform also offers a series of specific functionalities and services that may be activated voluntarily by accepting the specific conditions:

i.   Notices sent by e-mail, SMS or telephone: If you are interested, you may voluntarily select the possibility of receiving notices containing information on the employment offers that are published on the Global Platform.

For such purpose, you will have to activate the box available in the Newsletter section, giving us your consent to subscribe for our alerts service, and authorizing INDITEX to send you information on the employment opportunities both of the parent company and of the rest of the Inditex Group companies whose recruitment processes are managed through the Global Platform and in accordance with your marked preferences.

These notices will be sent in accordance with the preferences that you selected through the Global Platform, including the sending of notices by e-mail or through any other equivalent electronic communication means (such as SMS) and by telephone call. You may change your preferences as regards the sending of such communications by accessing the section My Account, or withdraw your consent at any time through the My Account section, marking the relevant deactivation box.

d)   Consultation management: If you submit any question to us, through the contact form or e-mail, your Personal Data may be used by INDITEX to deal with your requests, including those relating to the technical service of the Global Platform, its functioning, concerns/suggestions on recruitment processes, etc.

For an adequate management of your consultation, we may have to contact you by e-mail, telephone or SMS. 

 

3. OUR LEGAL BASIS FOR THE PROCESSING OF YOUR DATA

The legal basis that permits us to process your Personal Data also depends on the purpose for which we use them:

a)   Registration as a user of the Global Platform: The processing of your data is necessary for performance of the terms of use that regulate the use of the Global Platform.

b)   Inditex Group recruitment processes: The processing of your data is necessary for the performance of the terms of use that regulate the use of the Global Platform.

c)   Ancillary services or functionalities:

i.   Notices by e-mail, SMS or telephone: Our lawful base to use your data is the consent that you give us on activating the box available in the Newsletter section.

d)   Consultations management: We consider that we have a legitimate interest in handling the requests or concerns that you submit to us through the means available for the purpose. We understand that the processing of these data is also for your benefit since it permits us to be able to assist you adequately and resolve your concerns. 

 

4. HOW LONG WE WILL KEEP YOUR DATA?

The term for which we will keep your data will depend on the functionalities for which we process them. Specifically:

a)   Registration as a user of the Global Platform: We will process your Personal Data while your account remains active. In this regard, we inform you that your registered user account will expire after 18 months without your having started a session. Before proceeding to delete your account, you will receive a message of reminder by e-mail informing you of the manner in which you may proceed to prevent your account from expiring and thus having your data cancelled.

b)   Inditex Group recruitment processes: We will process your Personal Data while your account remains active.

c)   Ancillary services or functionalities:

i.   Notices by e-mail, SMS or telephone: We will process your data until you unsubscribe or cancel your subscription to the Newsletter.

d)   Consultations management: We will process your data for the time necessary to attend your application or request.

 

Notwithstanding the fact that we will process your data for the time strictly necessary to achieve the purpose in question, we will subsequently keep them duly stored and protected for the time during which liability may arise from their processing, in compliance with legislation in force from time to time. Once the potential actions fall under the statute of limitations, we will proceed to delete your personal data.

5. WILL WE SHARE YOUR DATA WITH THIRD PARTIES?

To achieve the purposes set out in this Privacy Policy, we must grant access to your personal data to Inditex Group companies and to third parties who provide us with support in the services that we offer you, in other words:

-     To the Inditex Group companies, since one of the main objectives of the Global Platform is to manage worldwide the recruitment processes of all Inditex Group companies and maximize the opportunities of its registered users. Therefore, to achieve such purposes, we may have to disclose or transfer the information that you provided us with to certain Inditex Group companies (whose activities are related to the decoration, textile, finished articles of clothing and home products sectors, and any others supplementary to the above, including the cosmetics and leatherwear sectors, and the development and support of electronic commerce, building, logistics, transport and distribution sectors), to the extent that they may need to access your Personal Data, because they are directly involved in the recruitment processes in which you submitted your candidature or because this is necessary in accordance with our mutual interests and preferences. 

-     Service providers that provide us, inter alia, with support in technological matters or for the development, performance and management of our recruitment processes.

For service efficiency purposes, some of these providers are located in territories outside the European Economic Area that do not offer a level of data protection comparable to that of the European Union. In such cases, we inform you that we transfer your data with adequate safeguards and always keeping your data safe, using the most convenient international data transfer tools, in example the Standard Contractual Clauses and any relevant supplementary measures. You may consult the content of such Standard Contractual Clauses through the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transferpersonal-data-third-countries_en

The Personal Data reported to or accessed by the Inditex Group companies may be used and stored locally by those Inditex Group companies to manage their recruitment processes. 

For more information about the Group companies we share the data with, the countries or regions to which we transfer the data, or the safeguards with which we transfer the data, please write an email to the Data Protection Officer's address as indicated in the section below.

 

6. WHAT YOUR RIGHTS ARE WHEN MAKING YOUR DATA AVAILABLE TO US

We undertake to respect the confidentiality of your personal data and to ensure the exercise of your rights. You may exercise your rights free of charge by sending us an e-mail to , merely informing us of the reason for your request and the right that you wish to exercise. If we consider this necessary to be able to identify you, we may ask you for a copy of a document evidencing your identity.

In particular, regardless of the purpose or legal basis on which we process your data, you have the following rights:

-     To ask us for access to the data we have available on you. We remind you that if you are a Global Platform registered user you may also consult the information that you provided when creating your account in the section on your personal data.

-     To request us to rectify the data that we already have available. Remember that if you are a Global Platform registered user you may also access the section on your personal data of your account to modify or update your personal data available in it. In any case, please take into account that, on actively providing us with your personal data through any procedure, you confirm that they are true and accurate and you undertake to inform us of any change or modification in such data. Only the user will be liable for any loss or damage caused to the Global Platform or to the Global Platform controller or to any third party by a reporting of erroneous, inaccurate or incomplete information in the registration forms. Please remember that, as a general rule, you must only provide us with your own personal data, and not with those of third parties, other than to the extent otherwise permitted in this Privacy Policy.  

-     To request us to erase your data to the extent that they are no longer necessary for the purpose for which we need to process them, as we informed you above, or that we no longer have any lawful basis to process them.

-     To request us to limit the processing of your data, implying that in certain cases you may request us to suspend provisionally the processing of the data or to keep them longer than the time necessary when you may need this.

-     If you have given us your consent to process your data for any purpose, you also have the right to withdraw your consent at any time.  

Where our lawful basis to process your data is your consent or the execution of the contract, as explained in sections 2 and 3, you will also have the right to request the portability of your personal data. This means that you will also have the right to receive the personal data that you have provided us with, in a structured, commonly used and machine-readable format, to be able to transfer them to another entity directly, provided that this is technically feasible. In addition, when the processing of your data is based on our legitimate interest, you will have the right to object to the processing of your data.

Lastly, we inform you of your right to bring a claim before the responsible data protection supervisory authority, in particular, before your local data protection authority as identified in the Appendix below ("Specific Country/Region Provisions").

Por último, te informamos de tu derecho a presentar una reclamación ante la autoridad de control en materia de protección de datos pertinente (https://edpb.europa.eu/about-edpb/board/members_en).
If you have any questions about how we process your data or about what is explained in this Privacy Policy, you can contact the Data Protection Officer by writing an email to

 

7. CHANGES TO THE PRIVACY POLICY

We may amend the information contained in this Privacy Policy when we consider this advisable. If so, we will notify you through various procedures through the website of Inditex Careers (for example, using a banner, a pop-up or a push notification), or we may even send you a notice to your e-mail address when the change in question is relevant to your privacy, for you to be able to review and evaluate the changes and, as the case may be, object or unsubscribe from any service or functionality. In any case, we suggest you to review this Privacy Policy from time to time in case minor changes are made or we make any interactive improvement, taking the opportunity that you will always find it as a permanent point of information on the website of Inditex Careers.

 

8. ADDITIONAL INFORMATION

You may consult additional information on the manner in which we use the data of our candidates in our Inditex Group companies Recruitment Privacy Policy (Recruitment Privacy Policy) at http://itx.to/RecruitmentPrivacyPolicy.
 

9. INFORMATION ON COOKIES

On the Global Platform we use cookies, small text files containing information on your browsing at this site, the main objective of which is to improve your experience on the Global Platform. You may find additional information on the cookies that we use, their purpose and other information of interest through the following link: https://www.inditexcareers.com/portalweb/politica-de-cookies

 

10. ADDITIONAL INFORMATION DEPENDING ON THE COUNTRY/REGION IN QUESTION

We also want to inform you about the Specific Country/Region Provisions that may be applicable to the processing of your personal data. These provisions are detailed in the Appendix to this Privacy Policy, and are applicable to our processing of your personal data only to the extent that they may be necessary for full compliance with the applicable data protection laws. If the Specific Country/Region Provisions cease to be compulsory due to potential legislative changes under the applicable data protection laws, they will no longer be applicable to the processing of the Personal Data of the Employee.  

The provisions of this Privacy Policy shall prevail over the Specific Country/Region Provisions of Appendix, unless so required by the applicable data protection laws and, in particular, the applicable national data protection laws.

 

APPENDIX

SPECIFIC COUNTRY/REGION PROVISIONS

Additional specific provisions for the processing of data originating in:

 

 

1. Albania

Section 5 - "We will share your data with third parties": For transfers to entities that may be located in territories outside the European Economic Area which do not provide a data protection level comparable with that of the European Union, we will inform you that we will transfer your data and obtain your consent on such transfer.

Section 6 - "What rights you have when you provide us with your data":

Access: You are entitled to receive all the information on your personal data or the explanation why such information cannot be provided, within 30 days from the moment when the access request has been received.

Rectification and erasure: You are entitled to receive the information on whether the rectification/erasure has been carried out or not within 30 days from the moment when the rectification/erasure request has been received, otherwise you are entitled to file a claim with the Information and Data Protection Commissioner.

If you claim that your rights, freedoms and legal interests concerning your personal data have been violated you shall have the right to bring a claim before the Information and Data Protection Commissioner and to request his intervention to remedy the infringed right. Following this complaint, in accordance with the Code of Civil Procedure, you may file a complaint in court.

We inform you of your right to bring a complaint before the responsible data protection supervisory authority which in Albania is the Information and Data Protection Commissioner (https://www.idp.al).

 

 

2. Australia

Section 2: Why we process and origin of your personal data

Under Australian Privacy Principle 5, the main consequences if you do not provide some or all of the required personal information are that we may cease consideration of you as a potential candidate for employment and not proceed any further.

Section 4: How long will we keep your data?

Under Australian Privacy Principle 4, if we received personal information from you that we did not solicit, we may, if lawful and reasonable to do so, destroy the information or ensure that the information is de-identified.

We will also keep your data for the development, performance and management of the recruitment processes.

Section 6: What your rights are when making your data available to us

If we consider it necessary to be able to identify you, we may request further information or a copy of a document evidencing your identity.

Any requests for access to or correction of personal information, inquiries or complaints from you regarding our compliance with the Australian Privacy Principles should be directed to dataprotection@inditex.com

 

 

3. Bosnia and Herzegovina

Section 6 - "What rights you have when making your data available to us":

We inform you of your right to bring a complaint before the responsible data protection supervisory authority which in Bosnia and Herzegovina is Personal Data Protection Agency in Bosnia and Herzegovina  (http://azlp.ba/)

 

 

4. Bulgaria

Section 4 - "How long we will keep your data" - "For the development, performance and management of the recruitment processes":

Based on the provisions of the Bulgarian Personal Data Protection Act employers from the Inditex Group based in Bulgaria that have received your data will only process it for the time necessary to manage your participation in the respective open recruitment processes and for a term of up to 6 months after their completion.”

 

 

5. Denmark

Section 1 – Who your data controller is

INDUSTRIA DE DISEÑO TEXTIL, S.A. (INDITEX, S.A) together with its Danish subsidiary INDITEX Danmark A/S, 24 20 97 17, Klosterstræde 1, 1157 København K, Danmark, are the controllers of your data and act as both joint and independent controllers of your data during the recruitment process. 

Section 2 - Purpose of your data processing

In addition to the personal data categories specified in the Privacy Policy, we also process your personal identity number when necessary for the recruitment and hiring process.

Section 3 -  Legitimate basis for the processing of your personal data

We rely on the following legitimate basis for processing your data within the recruitment process in Denmark:

-      For the performance of a contract or to enter into a contract according to article 6(1)(b) of the General Data Protection Regulation;

-       Agree to the processing of non-special category personal data according to article 6(1)(a) of the General Data Protection Regulation.

-       Legitimate interest, in accordance with article 6(1)(f) of the General Data Protection Regulation.

Section 4 - How long we will keep your data

We will process your personal data as long as it is necessary for the purpose of processing. For example, we have a legitimate interest to keep the personal data for 3 years to protect ourselves against legal claims in accordance with the Danish law on discrimination[A1] .

 

 

6. Finland

Section 1 – Who your data controller is

INDUSTRIA DE DISEÑO TEXTIL, S.A. (INDITEX, S.A) together with its Finnish subsidiary ITX Finland OY, 154 44 41-3, Aleksanterinkatu 19, Helsinki 00100, Finland, are the controllers of your data and act as both joint and independent controllers of your data during the recruitment process. 

Section 2 - Purpose of your data processing

In addition to the personal data categories specified in the Privacy Policy, we also process your personal identity number when necessary for the recruitment and hiring process.

Section 3 -  Legitimate basis for the processing of your personal data

We rely on the following legitimate basis for the processing of your data within the recruitment process in Finland:

-      For the performance of a contract or to enter into a contract according to article 6(1)(b) of the General Data Protection Regulation;

-       Agree to the processing of non-special category personal data according to article 6(1)(a) of the General Data Protection Regulation.

-       Legitimate interest, in accordance with article 6(1)(f) of the General Data Protection Regulation.

Section 4 - How long we will keep your data

We will process your personal data as long as it is necessary for the purpose of processing. For example, we have a legitimate interest to keep the personal data for 1 year after the recruitment period has ended to protect ourselves against legal claims in accordance with the Finnish Act on Discrimination[A2] .

 

 

7. France

Section 6 - "What your rights are when making your data available to us":

You have also the right to determine the rules governing the fate of your data after your death.

 

 

8. Germany

Section 6 - "What your rights are when making your data available to us":

 

-     Access: The right of access is limited pursuant to Section 34 German Federal Data Protection Act ("FDPA"). The right of access does e.g. not apply if the data (a) were recorded only because they may not be erased due to legal or statutory provisions on retention, or (b) only serve the purposes of monitoring data protection or safeguarding data, and providing information would require a disproportionate effort, and appropriate technical and organizational measures make processing for other purposes impossible.

 

-     Erasure: The right to erasure, pursuant to Section 35 FDPA, for instance, does not apply if in the case of a non-automated processing erasure would be impossible or would involve disproportionate effort due to the specific mode of storage and if your interest in erasure can be regarded as minimal. In such case, you may have the right to restriction of processing.

 

 

9. Italy

Section 4 - "How long we will keep your data" - "For the development, performance and management of the recruitment processes":

Regarding the registration as a user of the Global Platform, we will process your Personal Data while your account remains active. In this regard, we inform you that your registered user account will expire after 12 months without your having started a session. Before proceeding to delete your account, you will receive a message of reminder by e-mail informing you of the manner in which you may proceed to prevent your account from expiring and thus having your data cancelled.

Section 6 - "What your rights are when making your data available to us":

Please be informed that under certain circumstances pursuant to Article 2-undecies of the Legislative Decree 10 August 2018, No. 101, implementing the GDPR in Italy, such as where it is necessary for the data controller/s to exercise legal claims before courts, the exercise of your privacy rights may be delayed, limited or excluded. In such a case the data controller will provide you without delay with a reasoned statement and you may still request that the Garante verifies that the referred delay, limitation and exclusion are based on legitimate grounds.

 

 

10. Hong Kong SAR

Section 2 – "Why We Process and Origin of Your Personal Data"

We will not ask you provide these categories of sensitive personal data.

Section 3 - "Our legal basis for the processing of your data":

If you are based in Hong Kong SAR, for the purpose of Section 3(d) (Consultations management), we will process your Personal Data based on your consent only, and not on the basis of our legitimate interest.

Section 6 - "What rights you have when making your data available to us":

If you are based in Hong Kong SAR, we will process your Personal Data: (1) in accordance with applicable laws and regulations; and (2) based on your consent only, and not on the basis of our legitimate interest. Further, the right to request the portability of your personal data would not be available to you if you are based in Hong Kong.

Section 7 – "Changes to the Privacy Policy"

We may also seek your consent in relation to the amendments to the Privacy Policy as required under local data protection laws.

 

 

11. Kazakhstan

Section 3 - "Our legal basis for the processing of your data":

The legal basis for collection and processing of your data will be your consent, except for situations where such personal data may or shall be used without such consent under applicable law.

Section 4 - "How long we will keep your data":

The period for retention of personal data is determined by the date of fulfillment of the purpose(s) for collection and processing of the personal data.  Such period should also include the time during which liability may arise from their processing, in compliance with legislation in force from time to time.  

Section 5- “Will We Share Your Data With Third Parties”:

Some of the Inditex Group entities and third parties to which personal data will be transferred may be located in territories outside Kazakhstan which do not provide adequate data protection in the meaning of Kazakhstan law.

Section 6 - "What rights you have when making your data available to us":

You are also entitled to other rights in relation to your personal data, as provided under Kazakhstan law.

 

 

12. Kosovo

Section 6 - "What rights you have when making your data available to us":

We inform you of your right to bring a complaint before the responsible data protection supervisory authority which in Kosovo is the National Agency for the Protection of Personal Data (http://www.amdp-rks.org/).

 

 

13. Macau. SAR

Section 4 - "How long we will keep your data":

When your personal data is processed for recruitment process purposes, your personal data will not be kept for more than 2 years from the end of the last recruitment process in which you participated or from the last time you provided us with your personal data.

When your personal data is processed for consultation management purposes outside a recruitment process, your personal data will only be kept for the time necessary to meet and resolve any concerns and consultations that you may submit to us, but always subject to the maximum retention period of 5 years from your last contact with us.

Section 6 - "What rights you have when providing us with your data":

The responsible data protection supervisory authority in Macau SAR is the Personal Data Protection Office (“Gabinete para a Protecção de Dados Pessoais”) (https://www.gpdp.gov.mo).

 

 

14. Mexico

Section 5 - "We will share your data with third parties":

The transfers of personal data between Inditex Group companies do not require your consent. Inditex Grupo companies are governed by binding privacy policies and standards in compliance with article 37. III of the Federal Law on Protection of Personal Data Held by Private Parties.

Section 6 - "What rights you have when you provide us with your data":

In order to learn about the procedures, requirements and time periods for the exercise of your rights (access, rectification, cancellation and objection),  the restriction/disclosure and/or withdrawal of consent, please send an e-mail to dataprotection@inditex.com

If you deem necessary you may file a complaint before the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), which is the Data Protection Authority in Mexico.

 

 

15. Montenegro

Section 6 - "What rights you have when making your data available to us":

We inform you of your right to bring a complaint before the responsible data protection supervisory authority which in Montenegro  is Agency for Personal Data Protection and FA to Inf in (http://www.azlp.me)

 

 

16. New Zealand

Section 2: Why we process and origin of your personal data

Under Information Privacy Principle 3, the main consequences if you do not provide some or all of the required personal information are that we may cease consideration of you as a potential candidate for employment and not proceed any further.

Section 4: How long will we keep your data?

If we received personal information from you that we did not solicit, we may, if it is lawful and reasonable to do so, destroy the information or ensure that the information is de-identified.

We will also keep your data for the development, performance and management of the recruitment processes.

Section 6: What your rights are when making your data available to us

If we consider it necessary to be able to identify you, we may request further information or a copy of a document evidencing your identity.

Any requests for access to or correction of personal information should be directed to dataprotection@inditex.com

 

 

17. North Macedonia

Section 3 - "Our legal basis for the processing of your data":

In North Macedonia, an additional legal basis for processing your data when you participate in a recruitment process is the necessity to take steps at your request prior to entering into an employment contract with you and the necessity for the performance of such employment contract once you have provided us with your personal data.

Section 4 - "How long we will keep your data" - "For the development, performance and management of the recruitment processes":

Regarding the registration as a user of the Global Platform, we will process your Personal Data while your account remains active. In this regard, we inform you that your registered user account will expire after 12 months without your having started a session. Before proceeding to delete your account, you will receive a message of reminder by e-mail informing you of the manner in which you may proceed to prevent your account from expiring and thus having your data cancelled.

Section 6 - "What rights you have when making your data available to us":

We inform you of your right to bring a complaint before the responsible data protection supervisory authority which in North Macedonia is the Directorate for Personal Data Protection (https://dzlp.mk/).

 

 

18. Norway

Section 1 – Who your data controller is

INDUSTRIA DE DISEÑO TEXTIL, S.A. (INDITEX, S.A) together with its Norwegian subsidiary INDITEX Norge AS, 980 64 32 63, c/o ITX Sverige AB, Norra Klara Kyrkogata 29, 11122 Stockholm, are the controllers of your data and act as both joint and independent controllers of your data during the recruitment process. 

Section 2 - Purpose of your data processing

In addition to the personal data categories specified in the Privacy Policy, we also process your personal identity number when necessary for the recruitment and hiring process.

Section 3 -  Legitimate basis for the processing of your personal data

We rely on the following legitimate basis for processing your data within the recruitment process in Norway:

-      For the performance of a contract or to enter into a contract according to article 6(1)(b) of the General Data Protection Regulation;

-       Agree to the processing of non-special category personal data according to article 6(1)(a) of the General Data Protection Regulation.

-       Legitimate interest, in accordance with article 6(1)(f) of the General Data Protection Regulation.

Section 4 - How long we will keep your data

We will process your personal data as long as it is necessary for the purpose of processing. For example, we have a legitimate interest to keep the personal data for 3 years after the recruitment period has ended to protect ourselves against legal claims in accordance with the Norwegian Act on Discrimination[A3] .

 

 

19. Portugal

Section 2 - "Why we process and origin of your personal data":

In Portugal, an additional purpose of your data processing is to comply with legal obligations. We process your data to comply with the legal obligation regarding the equality and non-discrimination of the recruitment procedures.

Section 3 - "Our legal basis for the processing of your data":

In Portugal, an additional legitimate basis for your data processing is to comply with legal obligations. We use your personal data because we have to comply with the legal obligation regarding the equality and non-discrimination of the recruitment procedures.

Section 4 - "How long we will keep your data":

In Portugal, another reason for retaining your data is to comply with legal obligations. We will process your data for a period of 5 years for the fulfilment of the legally imposed obligations for registration of recruitment procedures and for the period necessary for the establishment, exercise or defense of legal claims.

Section 6 - "What rights you have when making your data available to us":

If we consider this necessary to be able to identify you, we may request you for a copy of a document evidencing your identity.

 

 

20. Serbia

Section 6 - "What rights you have when making your data available to us":

We inform you of your right to bring a complaint before the responsible data protection supervisory authority which in Serbia  is Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia  (https://www.poverenik.rs/en/)

 

 

21. Slovenia

Section 1 – "Who is the controller of your data?":

Section 3 - "Our legal basis for the processing of your data", the following legal basis should be added for Slovenia:

The legal basis for the processing of your personal data when applying for open vacancies in Slovenia is compliance with legal obligations resulting from the Slovenian employment protection legislation (Article 6(1)(c) of the GDPR in connection with Articles 28, 29 and 48 of the Slovenian Employment Relationships Act (Zakon o delovnih razmerjih)).

In addition, data privacy shall include the exact reference to relevant legal basis for processing as stipulated in Article 6 of the GDPR. Thus, the following references apply to each individual legal basis:

  • Registration as a user of the Global Platform: Performance of the terms of use that regulate the use of the Global Platform / contract, according to Article 6(1)(b) of the GDPR;
  • Inditex Group recruitment processes: Compliance with legal obligations resulting from the Slovenian employment protection legislation (Article 6(1)(c) of the GDPR in connection with Articles 28, 29 and 48 of the Slovenian Employment Relationships Act (Zakon o delovnih razmerjih);
  • Ancillary services or functionalities: Consent for activating the box available in the Newsletter, according to Article 6(1)(a) of the GDPR; and
  • Consultations management: Legitimate interest, according to article 6(1)(f) of the GDPR.
  • Section 6 - "What rights you have when making your data available to us":

    If we consider this necessary for identification purposes in later stages of recruitment process, we may request you for a copy of a document evidencing your identity, in which case the copy will not be stored and will be permanently deleted once the identity is duly confirmed.

     

     

    22. South Korea

    Section 1 – "Who is the controller of your data?":

    Data Protection and Privacy Department of Industria de Diseño Textil, S.A. (INDITEX, S.A) is in charge of matters concerning protection of personal information of users and customers and handling complaints relating to such matters. If you have questions or have a complaint, please contact us at: dataprotection@inditex.com

     

    Section 4 - "How long we will keep your data":

    When destroying personal information, we take commercially reasonable and technically feasible measures to make the personal information irrecoverable or irreproducible. Electronic documents or files containing personal information will permanently be deleted using a technical method that makes recovery or retrieval of such information impossible.  Non-electronic documents or files containing personal information will be shredded or incinerated. In case any personal information is required to be retained for a period beyond the period of retention and use as prescribed by applicable law, to the extent technically possible, such information will be stored or maintained separately from other items of personal information.

     

    Section 5- “Will We Share Your Data With Third Parties”:

    5.1 Delegation of personal information processing (including Inditex Group companies)

     

    Some third-party service providers and/or affiliates of INDITEX, S. A. perform functions on behalf of INDITEX, S. A. and they have access to the personal information they need to perform their functions as described below:

     

    Name of Recipient

    Description of Delegated Work to be Performed by Recipient

    ZARA RETAIL KOREA, CO. LTD.

    Corporate HR Management Services.

     

     

    5.2 Transfer of personal information to third parties (including Inditex Group companies)

    We may share your personal information with one or more of our affiliates and third parties, as described below:

    Name of Recipient

    Location of Recipient (Country)

    Purpose of  Retention and Use by Recipient

    Items of Personal Information Transferred

    Period of Retention and Use by Recipient

    ZARA RETAIL KOREA, CO. LTD.

    South Korea

    Please, refer to section 2 of this Privacy Policy

    Please, refer to section 2 of this Privacy Policy.

    Please, refer to section 4 of this Privacy Policy.

    INDITEX VASTGOED KOREA, LTD.

    South Korea

    BERSHKA KOREA, LTD.

    South Korea

    MASSIMO DUTTI KOREA, LTD.

    South Korea

    STRADIVARIUS KOREA, LTD.

    South Korea

    PULL & BEAR KOREA, LTD.

    South Korea

    OYSHO KOREA, LTD.

    South Korea

    ITX KOREA LIMITED

    South Korea

    ZARA HOME KOREA LIMITED

    South Korea

     

     

    it may be necessary for us to disclose or transfer the information that you made available to us to certain Inditex Group companies to the extent to which they need to access your data because they are directly involved in the recruitment processes in which you participate or because this is necessary given our mutual preferences and interests

    For more information about the Group companies we share the data with, the countries to which we transfer the data, or the safeguards with which we transfer the data, please write an email to the Data Protection Officer's address as indicated in the section below.

    Section 11 – Measures to Ensure the Security of personal information

    We are committed to protecting the security of your personal data. We use a variety of security technologies and procedures, including managerial, technical and physical measures, to help protect your personal data from unauthorized access, use or disclosure, such as periodical security trainings for the employees that may have access to the personal data, mechanism to ensure access control to the personal data or to the servers, backups and recovery plan, etc.

     

     

    23. South Africa

    Section 2 – “Purpose of your data processing”

    We may be required to collect special personal information about you, including information related to your race and disability, in order to comply with legal obligations imposed on INDITEX, S.A., such as obligations under the South African Employment Equity Act, 1998. We will only collect this information where we are required to do so by law.

    Section 5 – “We will share your data with third parties”.

    The Inditex Group conducts business in various jurisdictions. Your personal information may, in appropriate circumstances, accordingly be transferred, or reside, outside of South Africa. In circumstances where the recipient Group entity is not subject to a law that provides an adequate level of protection of personal information, a manner similar to what is contained in the South African Protection of Personal Information Act, we will ensure that the recipient is subject to binding corporate rules or a binding transfer agreement that ensures adequate protection[A4] .

     

     

    24. Sweden

    Section 1 – Who your data controller is

    INDUSTRIA DE DISEÑO TEXTIL, S.A. (INDITEX, S.A) together with its Swedish subsidiary ITX Sverige AB, 556569-8577, Klara Norra Kyrkogata 29, 11122 Stockholm, are the controllers of your data and act as both joint and independent controllers of your data during the recruitment process. 

    Section 2 - Purpose of your data processing

    In addition to the personal data categories specified in the Privacy Policy, we also process your personal identity number (Sw. personnummer) when necessary for the recruitment and hiring process.

    Section 3 -  Legitimate basis for the processing of your personal data

    We rely on the following legitimate basis for the processing of your data within the recruitment process in Sweden:

    -      For the performance of a contract or to enter into a contract according to article 6(1)(b) of the General Data Protection Regulation;

    -       Agree to the processing of non-special category personal data according to article 6(1)(a) of the General Data Protection Regulation.

    -       Legitimate interest, in accordance with article 6(1)(f) of the General Data Protection Regulation.

    Section 4 - How long we will keep your data

    We will process your personal data as long as it is necessary for the purpose of processing. For example, we have a legitimate interest to keep the personal data for 2 years after the recruitment period has ended to protect ourselves against legal claims in accordance with the Swedish Discrimination Act[A5] .

     

     

    25. Switzerland

    Section 6 – “What your rights are when making your data available to us”:

    We inform you of your right to lodge a complaint with the relevant data protection authority, in particular the Spanish Agencia Española de Protección de Datos (www.aepd.es) and if the company where you are employed is located in Switzerland or your permanent residence is in this country, namely with the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html).

     

     

    26. Taiwan, China

    Section 6 - "What your rights are when making your data available to us":

     

    To supplement, you have the right to request to review, have access to, request a copy of, request to supplement or correct, request to cease the collection, processing or use of your Personal Data and request to delete your Personal Data by sending an email to dataprotection@inditex.com.

     

     

    27. Turkey

    Section 2- "Purpose of your data processing":

    Your collected personal data shall be processed within the personal data processing conditions and purposes specified in article 5 of the Law on The Protection of Personal Data No 6698(KVKK): Explicitly foreseen in laws as specified in article 5/2 (a); being necessary for the establishment or performance of the contract as specified in article 5/2 (c); fulfilling the legal obligation as specified in article 5/2 (ç); publicizing the data by person concerned as specified in article 5/2 (d); data processing obligation for establishing, using or protecting a right as specified in article 5/2 (e); in accordance with the legal reasons that data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned as specified in article 5/2 (f); with regard to your explicit consent about personalized/commercial communication submissions.

    Section 6- "What rights you have when providing us with your data":

    All the rights are specified in article 11 of the Law on The Protection of Personal Data No 6698 (KVKK).

    By submitting your request regarding the exercise of your rights stated above, by the petition “MM Plaza Nisbetiye Mah. Aytar Cad. Başlık Sok. No: 3 Kat: 4 34340 Beşiktaş / İstanbul ”, you can personally forward it to our address and send it through a notary. In addition, as mentioned in article 5 of the “Procedures and Principles of Application to the Data Officer” law, issued by the Board, the request can be sent to “dataprotection@inditex.com” with the subject “Veri Koruma – ITX Turkey" by registered e-mail address, secure electronic signature, mobile signature or the e-mail address registered in our systems that you have previously notified to our Company[A6] .

     

     

    28. UK

    Section 5 – “We will share your data with third parties”:

    For service efficiency purposes, some of these providers are located in territories outside the UK that do not offer a level of data protection comparable to that of the UK. In such cases, we inform you that we transfer your data with adequate safeguards and always keeping your data safe, using the most convenient international data transfer tools, for example the Standard Contractual Clauses and any relevant supplementary measures[A7] .

     

     

    29. Ukraine

    Section 6 - "What rights you have when providing us with your data":

    Please see full scope of your rights with regard to your data protection in article 8 of the Law of Ukraine № 2297-VI “On the personal data protection” as of 01.06.2010 at https://zakon.rada.gov.ua/laws/show/2297-17.