3.4. PRIVACY POLICY3.4.1. IntroductionBY JOBGAR SL shall ensure that the personal data of the data subject are processed following the principles relating to processing:Processed lawfully, fairly, and transparently in relation to the data subject ("lawfulness, fairness, and transparency").Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes ("purpose limitation").Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ("data minimization").Accurate and, where necessary, kept up to date, with appropriate technical and organizational measures to ensure that inaccurate data is erased or rectified with respect to the purposes for which they are processed ("accuracy").Retained in a form that permits identification of the data subject for no longer than is necessary for the purposes of processing ("storage limitation").Processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures ("integrity and confidentiality").Therefore, BY JOBGAR SL shall be responsible for complying with the above provisions and must be able to demonstrate it afterward ("proactive responsibility").Likewise, the processing carried out by the entity will only be lawful if it meets at least one of the following conditions ("lawfulness of processing"):The data subject has given consent to the processing of their personal data for one or more specific purposes.The processing is necessary for the performance of a contract to which the data subject is a party or for the application of pre-contractual measures requested by the data subject.The processing is necessary for compliance with a legal obligation applicable to the data controller.The processing is necessary to protect the vital interests of the data subject or of another natural person.The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, in particular where the data subject is a child. This legitimate basis shall not apply to processing carried out by public authorities in the exercise of their functions. When the processing is based on the data subject's consent, the data controller must be able to demonstrate that the data subject has consented to the processing of their personal data.If the data subject's consent is given in the context of a written statement that also refers to other matters, the request for consent shall be presented in a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.The data subject shall have the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Before giving consent, the data subject shall be informed thereof. Withdrawing consent shall be as easy as giving it.Moreover, personal data revealing ethnic or racial origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data aimed at uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation may only be processed in the cases provided for in Article 9 of the GDPR.The processing of personal data relating to criminal convictions and offenses or related security measures may only be carried out under the control of public authorities or when authorized by EU or Member State law providing for adequate safeguards for the rights and freedoms of data subjects.BY JOBGAR SL must include in the forms used for the collection of personal data the information necessary to comply with the duty to inform as set out in Articles 13 and 14 of the General Data Protection Regulation (GDPR).In this regard, and in order to comply with the applicable and current data protection regulations, when BY JOBGAR SL obtains personal data directly from a data subject, it shall:Provide the identity and contact details of the Data Controller and, where applicable, of its representative, the contact details of the Data Protection Officer, where applicable, and the purposes of the processing to which the personal data are intended, as well as the legal basis for the processing.Specify the legitimate interests pursued by the controller or by a third party when the processing is necessary for the satisfaction of those interests. Provided that such interests do not override the interests or fundamental rights and freedoms of the data subject.Provide information about the recipients or categories of recipients of the personal data, if applicable, the intended transfer of personal data to a third country or international organization and the existence or absence of a decision on the adequacy of the Commission.Indicate the period for which the personal data will be stored or the criteria used to determine that period.Inform the data subject of the existence of the right to request from the Data Controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing, as well as the right to data portability.Inform about the possibility of withdrawing consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. As well as, make them aware of the possibility of lodging a complaint with a Supervisory Authority.Specify whether the provision of personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract, and whether the data subject is obliged to provide the personal data and the possible consequences of not providing such data.Inform about the existence of automated decisions, including profiling, and, at least in such cases, provide meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.When BY JOBGAR SL does not obtain personal data from the data subject, it shall provide them with the information described in the previous section. As well as, the categories of personal data processed, the source from which the data originates, and, if applicable, whether they come from public sources.If BY JOBGAR SL obtains personal data directly from the data subject, the information must be made available to them at the time the data is requested, prior to the collection or registration.In cases where the data is not obtained from the data subject but from a legitimate transfer or from publicly accessible sources, BY JOBGAR SL shall inform the data subjects within a reasonable period, and in any case, no later than one month after obtaining the personal data, in the first communication with the data subject or before the data is communicated to other recipients.If BY JOBGAR SL plans to further process personal data for a purpose other than that for which it was collected, it shall provide the data subject, prior to that further processing, with information about that other purpose and any other relevant information.