Ambit Building Solutions Together, S.A. (hereinafter Ambit BST) has as fundamental values the security and privacy in data processing. Consequently, we assume the commitment to guarantee the User's right to privacy when processing their data and we understand that this commitment starts from transparency.

This Privacy Policy contains information on the processing of personal data of users of Ambit Building Solutions Together S.A. (www.ambit-bst.com ):

• Who is controller for the processing of your personal data?
• What personal data do we process?
• For what purposes do we process your data?
• Why may we process your data?
• How long do we keep your data?
• Do we share your data with third parties?
• What rights do you have?
• What security measures are applied?

If you would like to access privacy information on other data processing carried out by Ambit BST, please go to:

• Animal Data Source Privacy Policy
• Join Ambit Privacy Policy

1.Who is the controller of the personal data?

The controller of the personal data is Ambit BST:

2. What processing of personal data do we perform?

In this section we explain why we process data (i.e. for what purpose), what data we process and why we may process it (in other words, what the legal basis is):

2.1.    Management of contact and information requests

Purpose: When you contact us through any of our forms or ask us for information we need some data to be able to answer you and manage the request.

Personal data:

• Name and surname
• Email
• Subject
• Message

Legal Basis:

Consent

Contract execution or preparation

Data retention period: The data will be kept for the time necessary for the purpose.

2.2.    Sending commercial communications

Purpose: We may use your personal data to send you commercial communications about products and services of interest to you.

Communications will be sent on the basis of the consent given or, if you are a customer, on the basis of legitimate interest..

Personal data:

• Name and surname
• Email

Legal basis:

Consent

Legitimate interest

Data retention period: The data will be kept for the time necessary for the purpose.

2.3.    Use of cookies

Purpose: We use cookies for statistical, website optimization and marketing purposes based on consent. We also use cookies necessary for the proper functioning of the website.

Personal data:

• Navigation data

Legal basis:

Legitimate interest

Consent

Data retention period: Each cookie is mantained during a determined time, consult cookie policy.

2.4.    Ethical channel management

Purpose: Process, investigate and propose resolutions on communications and complaints made through the ethics channel.

Personal data:

• Name and surname
• Email
• Subject
• Message

Legal basis:

Public interest: prevention of breaches of regulations, particularly with respect to criminal offenses.

Legal obligation: in compliance with Directive (EU) 2019/1937.

Data retention period: The data will be kept in the ethical channel system for a maximum period of 3 months. Once it is decided whether or not to follow up on the complaint, the data will be removed from the system, and the data may be kept anonymized in order to prove the existence of the ethical channel.

If an investigation is initiated, the data will be removed from the Ethical Channel and kept in the corresponding system.

2.5.    Join Ambit

Purpose: If you want to be part of Ambit, you can send us your CV and apply for a job position through the following portal Join Ambit

Personal data:

• Identifying information
• Employment, academic and professional details
• Linkedin Profile

Legal basis:

Consent

Data retention period: The data will be kept for 24 months from the date of receipt, unless the candidate expresses the wish to keep it for a longer period of time.

2.6.    Ambit Professional Academy

Purpose: User management on the company's e-learning platform (Ambit Professional Academy).

Personal data:

- Identifying information

- Employment, academic and professional details

Legal basis:

Contract execution

Data retention period: The data will be kept for the time necessary for the purpose.

2.7.    GxPharmaCloud

Ambit BST's obligations with respect to the data it may access in its role as a provider of cloud services and Infrastructure as a Service (IaaS) are defined in its agreements with its customers and are not governed by this privacy policy.

If you are a GxPharmaCloud customer and would like to request the Data Processing Agreement (DPA), please write an email to dpo@ambit-bst.com.

3. How long do we keep your data?

The period of data retention will depend on the purpose of the processing.

Your data will be kept for the time strictly necessary to achieve the purposes of the processing. The data will be kept for as long as there is a legal obligation of the data controller and as long as you do not request their deletion, limitation or opposition.

In the case of cookies, the retention period is set out in the cookie policy.

4. Do we share your data with third parties?

Ambit subcontracts certain external suppliers for the provision of ancillary services.

We use the following suppliers who act as processors:

• GoogleAds: Google Ireland limited, IE6388047V, 3Rd Floor, Gordon House, Barrow Street, Dublin 4 Ireland. DPO.
• CRM: HubSpot Ireland Limited IE 984947F 2Nd Floor, 30 North Wall Quay, Dublin 1, Ireland. DPO.
• Cookie consent manager: Cybot A/S, DK34624607,Havnegade 39, 1058 Copenhagen, Denmark, Phone: + 45 50 333 777, E-mail: mail@cookiebot.com,
• Recruitment platform: Teamtailor AB, Östgötagatan 16, 116 21, Stockholm, Sweden, Contact: https://career.teamtailor.com/data-privacy
• E-learning campus: EVOLMIND S.L., B99151615, Calle Bari 31, oficina 020, 50197, Zaragoza, España.

• Webinar software: Gotomeeting GoTo Technologies Ireland Unlimited Company, The Reflector 10 Hanover Quay Dublin 2, D02R573, Ireland, dpa@goto.com

The international transfers of data outside the European Economic Area that may be carried out by Ambit BST's data processors are carried out under the appropriate guarantees and security measures to ensure a level of security in line with that of the European Union.

5.What rights do you have?

You may address your communications and exercise your rights to the data controller. If necessary, you can also send them to Ambit by e-mail to dpo@ambit-bst.com .

Your data protection rights are as follows:

• Right of access: you may request information about the personal data that is processed about you.
• Right of rectification: you can communicate any change in your personal data.
• Right of erasure and right to be forgotten: you can request the deletion of your personal data after it has been blocked.
• Right to limit the processing: this involves restricting the processing of personal data.
• Right of opposition: you can withdraw your consent to the processing of data, opposing further processing.
• To request data portability in the cases provided for in the regulations.
• To withdraw the consent given.
• Any other rights recognized in the applicable regulations.

You may also file a complaint with the competent data protection authority. The supervisory authority in Spain is the Spanish Data Protection Agency (Agencia Española de Protección de Datos - https://www.aepd.es/ ).

6.What security measures are applied?

In order to safeguard the security of your personal data, we inform you that we have adopted all the necessary technical and organizational measures to ensure the security of the personal data provided and prevent its alteration, loss and unauthorized processing or access.

In addition, Ambit BST is ISO27001 certified for Information Security.

7. Changes in the privacy policy

This Privacy Policy might be modified to adapt it to the changes in the processing or to the changes in the regulations.

Last update: 29/07/2022