logo
  1. Privacy and Cookie Policy

Privacy and Cookie Policy

I. GENERAL TERMS AND CONDITIONS

  1. By means of this notice, and in compliance with the provisions of Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on Data Protection (“GDPR”), ULMA C y E, S. Coop. informs the users of each of the “myUlma” (hereinafter referred to as the “Platform”) of its personal data protection policy in order that they may freely and voluntarily determine whether they wish to furnish ULMA C y E, S. Coop. with the personal data that may be requested or required on subscription or in the course of the use of any of the services offered by ULMA C y E, S. Coop. on the Platform.

  2. This Data Protection Policy (hereinafter “Data Protection Policy”) provides information on the ways of protecting the personal data of the users of the Platform.

  3. The individual using the Platform shall hereinafter be referred to as “User”.

  4. The Controller of the personal data of the Users of the Platform is ULMA C y E, S. Coop. (hereinafter referred to as “ULMA”) with registered office at Paseo Otadui 3, 20560 Oñati (Spain).

  5. The User guarantees that the data provided are truthful, accurate, complete and updated, and shall be liable for any direct or indirect damage that may be caused as a result of non-compliance with this obligation. In the event that the data provided belong to a third party, the User guarantees that he/she has informed the said third party of the aspects contained in this document and has obtained his/her authorisation to provide his/her personal data to ULMA for the aforementioned purposes.

  6. When personal data is collected through the web form, the User must provide at least the fields marked with an asterisk; if these data considered necessary are not provided, ULMA will not be able to accept and manage the service offered on the Platform.

  7. The content of the Platform is the property of the Controller and is legally protected. ULMA has adopted the security levels required by law for the protection of personal data and has installed all the technical means and measures within its reach to prevent the loss, misuse, alteration, unauthorized access and theft of the personal data provided.

  8. The Controller declares that the Platform is free of content that violates the rights of third parties or applicable law and, in particular, of content which includes information that causes or constitutes a threat to data protection or security of any person, which promotes illegal activities or behaviours, offensive, threatening, obscene, defamatory or libelous, that incites racial, ethnic, cultural or religious persecution, that promotes or supports criminal activities which violate the rights of third parties, including intellectual property rights, or that otherwise constitutes a violation of legally protected property.

II. AIM OF DATA COLLECTION

  1. ULMA is responsible for this file, and its purpose is the management, administration, offering, expansion and improvement of services the user may decide to subscribe to, in addition to the sending of technical, operational and sales-related information, via traditional and electronic means, in case the user requests it, related to the products and services offered by ULMA now and in the future, as well as information regarding Personal Data Protection and Electronic Security.

    The Controller shall process Users' personal data with the aim and scope necessary for using the Platform, in addition to the following:
    1. should they subscribe to the “Construction Magazine UNews” newsletter, with the aim of sending the newsletter. The legal basis for processing Users' personal data is voluntary consent (article 6, section 1, letter a) of the GDPR). The Controller may also send surveys to Users with the aim of offering and improving ULMA's services. Be that as it may, Users' responses shall be voluntary in nature.
    2. should they use the Contact Form and send a question or query, with the aim of responding to the question or query. The legal basis for processing Users' personal data is the Controller's legitimate interest, which consists of managing correspondence (article 6, section 1, letter f) of the GDPR), in addition to voluntary consent (article 6, section 1, letter a) of the GDPR). The Controller may also send surveys to Users with the aim of offering and improving ULMA's services. Be that as it may, Users' responses shall be voluntary in nature.

  2. The Controller shall process personal data for the purposes specified in point 1:
    1. based on the consent for the use of personal data entered in the system or in the contact form or subscription to the informational bulletin “Construction Magazine UNews”,
    2. because processing is necessary for compliance with the Controller's legal obligation,
    3. because processing is necessary for undertaking of the Controller's aims, derived from legitimate interests such as: correct functioning of the Website and management of correspondence.

  3. User consent is voluntary and the User may withdraw it at any point. At the same time, we inform you that withdrawal of consent to personal data processing does not affect the lawfulness of any processing undertaken on the basis of consent given prior to the withdrawal.

  4. Users' personal data shall not be subject to automated processing, including profiling.

  5. In accordance with Law 34/2002 of 11 July, on the Information Society and E-commerce Services, if the User does not wish to receive e-mails from ULMA in the future, the User may express this wish by sending a request via e-mail to: lopd@ulmaconstruction.es.

III. USERS' RIGHTS

  1. At any point, Users shall have the right to:
    1. exercise their rights to access, rectification, erasure, objection and portability, via the email address lopd@ulmaconstruction.es;
    2. request information on their personal data subject to processing, including information on: the purpose of processing, categories of processed data, retention period, data origin, scope and form of processing, and the bodies to which personal data is communicated;
    3. present objections if the legal basis for personal data processing is the Controller's legitimate interest;
    4. withdraw consent if Users' personal data is processed on the basis of consent.

  2. Present a claim to the Spanish Data Protection Agency.

  3. Requests relating to the exercising of rights detailed in section 1 shall be presented in electronic format and shall be sent to the following address: lopd@ulmaconstruction.es.

  4. The Controller reserves the right to reject the erasure of Users' personal data if its retention is necessary to satisfy claims or if the applicable law so requires.

IV. COMMUNICATION OF DATA TO THIRD PARTIES

  1. Users' personal data may be made available to entities authorised to receive them under the applicable law and, in particular, to Public Administration, Courts and Tribunals.

  2. The Controller has no intention of transferring personal data to third countries outside the European Union.

V. RETENTION PERIOD

  1. Users' personal data shall be stored for the following period:
    1. should they subscribe to the “Construction Magazine UNews” newsletter, until Users withdraw their consent.
    2. should they use the Contact Form and send a question or query, for 4 years from the date of receipt.

VI. COOKIE POLICY

  1. The Platform uses cookies and/or similar technologies that store and retrieve information when you browse. Generally speaking, these technologies can be used for a wide range of purposes, such as, for example, recognising the User, obtaining information about browsing habits, or personalising the way in which content is displayed. The specific uses that ULMA makes of these technologies are described in this policy statement.

  2. Types of Cookies on the Platform:
    • Depending on the entity that manages the cookie:

      First-party cookies: those that we send from our domain to your device in order to provide the service that we offer you.

      Third-party cookies: those that are sent to your computer from a domain that is not managed by us, but by another entity, for example, those used by Google or YouTube, among others.

    • Depending on how long they remain activated:

      Session cookies: These are a type of cookie designed to collect and store data while the user browses a website.

      Persistent cookies: In this type of cookie, data remains stored in the terminal and can be accessed and processed for a period of time defined by the party responsible for the cookie, which can range from a few minutes to several years.

    • According to its purpose:

      Technical cookies: These allow the user to browse a website, platform or application and use the different options or services that it contains, such as, for example, to control traffic and data communication, identify the session, access restricted areas, remember the elements that make up an order, carry out the purchase process of an order, make an application for registration or participation in an event, use security features during browsing, store content for the broadcasting of videos or sound or share content through social networks.

      Analysis cookies: These are the ones that allow the person responsible for them to monitor and analyse the behaviour of the users of the websites to which they are linked. The information collected through this type of cookie is used to measure the activity of the website, application or platform and to create browsing profiles of the users of these sites, applications and platforms, with the aim of introducing improvements based on the analysis of the data on the use made by users of the service.

      Advertising cookies: are those that store information on the behaviour of users obtained through the continuous observation of their browsing habits, which allows a specific profile to be developed in order to display advertising based on this information.


  3. To enable or disable cookies, when users access our website, they will be shown a notice or banner informing them how they can give or refuse their consent to install cookies and they will have a configuration panel at their disposal for this purpose.

  4. ULMA is not responsible for the content or veracity of the privacy policies of third-party organisations which, where applicable, are mentioned in this cookie policy.

  5. The Platform may modify this policy when changes are made that may affect the use of cookies, due to legislative or regulatory requirements, or in order to adapt this policy to the instructions issued by the Spanish Data Protection Agency.

VII. Laws and Application in Mexico

In the case of applying this policy within the United Mexican States, the provisions of the Federal Law for the Protection of Personal Data in the Possession of Individuals, as well as its corresponding laws with the Mexican legislation, shall apply to Ulma Cimbras y Andamios de México, S.A. de C.V., a subsidiary controlled by ULMA CyE, S. Coop.

VIII. Laws and Application in Peru

In the case of applying this document within the Republic of Peru, the provisions of the Law for the Protection of Personal Data Nº29733, as well as its related and corresponding laws with the Peruvian legislation, shall apply to ULMA ENCOFRADOS PERU SA, registered in the record Nº 11270702 of the Register of Legal Persons in Lima-Peru, a subsidiary controlled by ULMA CyE, S. Coop.

IX. Laws and Application in Italy

For Italy, the following articles shall be understood as amended as follows:

II. AIM OF DATA COLLECTION

  1. In accordance with Italian Privacy Code, if the User does not wish to receive e-mails from ULMA in the future, the User may express this wish by sending a request via e-mail to: privacy@ulmaconstruction.it

  2. The processing will be carried out using paper, computerised and telematic tools, with organisational and processing methods strictly related to the purposes indicated above and in any case in such a way as to guarantee the security, integrity and confidentiality of the data, in compliance with the organisational, physical and logical measures provided for by current regulations.

III. USERS' RIGHTS

  1. exercise their rights to access, rectification, erasure, objection and portability, via the email address privacy@ulmaconstruction.it

  2. Present a claim to the “Garante per la protezione dei dati personali” (Piazza Venezia n. 11, Roma).

In the case of applying this document within the Italian Republic, the provisions of the GDPR and the Italian Privacy Code (D. Lgs. 196/2003) shall apply to all processing activities involving Italian residents or entities managed by ULMA Construction Srl, a subsidiary controlled by ULMA CyE, S. Coop.

X. Laws and Application in Poland

For Poland, the following articles shall be understood as amended as follows:

- Additional provisions regarding the processing of personal data

A. THE JOINT CONTROLLERS

The Joint Controllers of the personal data of the Users of the Platform are:

  1. ULMA CyE, S. Coop., with its registered office in Oñati (Guipúzcoa), Spain, Paseo de Otadui 3, Apdo. 13E, 20560, tax identification number (NIF): F20023065, hereinafter referred to as: “ULMA CyE”;
  2. “ULMA CONSTRUCCION POLSKA” SPÓŁKA AKCYJNA, with its registered office in Koszajec, address: Koszajec 50, 05-840 Brwinów, Poland, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register, under KRS number: 0000055818, tax identification number (NIP): 5270203299, hereinafter referred to as: “ULMA POLSKA” hereinafter jointly referred to as “ULMA”, “Company” or the “Controller”.
    We hereby inform you that between the Joint Controllers a Joint Controllership Agreement has been concluded regarding the processing of personal data using IT environments and tools within the ULMA Group (hereinafter: the “Agreement”). This means that each of these entities processes your personal data within an agreed scope. The agreement between the Joint Controllers is set forth in Section G below.

B. CONTACT WITH THE COMPANY, DATA PROTECTION OFFICER

  1. The contact point regarding personal data of the Platform User is ULMA CyE.

    You can contact ULMA CyE:

    1. by traditional mail to the address indicated in point I.4 a) of this Policy – with the note “Personal Data”;
    2. by e-mail: lopd@ulmacontruction.es

  2. You can contact ULMA CONSTRUCCION POLSKA S.A.:
    1. by traditional mail to the address indicated in point I.4 b) of this Policy – with the note “Personal Data”;
    2. by e-mail: rodo@ulmaconstruction.pl

    3. ULMA CONSTRUCCION POLSKA S.A. has appointed a Data Protection Officer, who is Ms. Alicja Sytek, and can be contacted at: iod@ulmaconstruction.pl

C. AIM OF DATA COLLECTION

  1. The Controller shall process Users' personal data with the aim and scope necessary for using the Platform, in addition to the following:
    1. if you contact the Company directly via the contact details provided on the Platform or by using the Contact Form, your personal data will be processed in order to respond to your question or request and to manage correspondence.
      The legal basis for the processing of Users' personal data is the legitimate interest of the Company (article 6(1)(f) of the GDPR), consisting in handling inquiries and responding to messages sent by Users. Where the inquiry relates to the conclusion or performance of a contract, the legal basis may also be the necessity to take steps at the request of the data subject prior to entering into a contract or to perform a contract (article 6(1)(b) of the GDPR).
      The personal data that the Company may process for this purpose include:
      • first and last name;
      • contact details (telephone number and/or e-mail address);
      • personal data indicated in the content of the message;
      • other necessary data related to the matter about which you are contacting us.
    2. should they subscribe to the “Construction Magazine UNews” newsletter, with the aim of sending the newsletter. The legal basis for processing Users' personal data is voluntary consent (article 6, section 1, letter a) of the GDPR).

      The personal data that the Company may process for this purpose include:

      • contact details (telephone number and/or e-mail address).
    3. sending voluntary surveys aimed at offering and improving ULMA services. Participation in the survey is entirely voluntary and choosing not to participate does not affect the ability to use the Company's services. The legal basis for the processing of Users' personal data is the Company's legitimate interest (article 6(1)(f) of the GDPR), consisting in measuring user satisfaction and improving the quality of the services provided.

      The personal data that the Company may process for this purpose include:

      • contact details (telephone number and/or e-mail address).
    4. provision of services and performance of the contract in relation to maintaining a User account in the myUlma service on the Platform, including handling the “Register in myUlma” form, access to project-related documents and the possibility of using software programs provided by the Company, in particular uConcrete, GrafSystem, Revit, and Scafmax. The legal basis for the processing of Users' personal data is the necessity to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (article 6(1)(b) of the GDPR).

      The personal data that the Company may process for this purpose include:

      • first and last name;
      • voivodeship (province/region);
      • company name;
      • job title;
      • contract number, if applicable;
      • phone number;
      • e-mail address;
      • content of the message;
      • other personal data contained in project-related documents;
      • other necessary personal data that may appear as a result of the User using the additional software programs provided by the Company.
    5. monitoring of the Platform provision of services and performance of the contract in order to ensure security, prevent fraud and abuse, and protect the Platform against automated attacks and spam. The legal basis for the processing of Users' personal data is the legitimate interest of the Company (article 6(1)(f) of the GDPR), consisting in ensuring the security and proper functioning of the Platform.

      The personal data that the Company may process for this purpose include:

      • IP address;
      • user behavior on the website;
      • type of web browser used to access the website;
      • cookies set by Google on the user's device;
      • date and time spent on the website;
      • results of analyses conducted by Google reCAPTCHA.
    6. use of necessary cookies in order to ensure the proper operation of the Platform and enable the use of its basic functionalities. The legal basis for the processing of Users' personal data is the legitimate interest of the Company (article 6(1)(f) of the GDPR), consisting in ensuring the proper functioning of the Platform.

      The personal data that the Company may process for this purpose include:

      • information collected through cookies on the Website User's device.
    7. use of cookies other than necessary cookies in order to adjust the Platform's functionalities to Users' preferences and to conduct analytical or marketing activities. The legal basis for the processing of Users' personal data is the User's consent (article 6(1)(a) of the GDPR), which may be withdrawn at any time.

      The personal data that the Company may process for this purpose include:

      • information collected through cookies on the Website User's device.
    8. analysis, statistics and improvement of the Platform in order to analyse how the Platform is used and to develop and improve it. The legal basis for the processing of Users' personal data is the legitimate interest of the Company (article 6(1)(f) of the GDPR), consisting in analysing the use of the Website and improving the quality of services provided, and, to the extent cookies or similar technologies are used, the User's consent (article 6(1)(a) of the GDPR).

      The personal data that the Company may process for this purpose include:

      • IP address;
      • type of web browser used to access the website;
      • browser language;
      • operating system;
      • screen resolution;
      • approximate location (country/city) or precise location (based on given consent);
      • time spent on the website;
      • activity and clicks on the website;
      • visited subpages.
    9. archival and evidentiary purposes in order to secure information that may serve as evidence of facts of legal significance. The legal basis for the processing of Users' personal data is the legitimate interest of the Company (article 6(1)(f) of the GDPR), consisting in securing information for evidentiary purposes.

      The personal data that the Company may process for this purpose include:

      • all necessary data referred to in the purposes of this privacy policy.
    10. establishment, exercise or defence of legal claims and handling possible mediation proceedings. The legal basis for the processing of Users' personal data is the legitimate interest of the Company (article 6(1)(f) of the GDPR), consisting in the possibility of establishing, pursuing or defending against legal claims.

      The personal data that the Company may process for this purpose include:

      • all necessary data referred to in the purposes of this privacy policy.
    11. compliance with obligations arising from the GDPR and other generally applicable laws. The legal basis for the processing of Users' personal data is the necessity to comply with legal obligations imposed on the Company (article 6(1)(c) of the GDPR), as well as the legitimate interest of the Company (article 6(1)(f) of the GDPR), consisting in ensuring compliance of the Company's activities with applicable laws.

      The personal data that the Company may process for this purpose include:

      • all necessary data referred to in the purposes of this privacy policy.

  2. You are not obliged to provide us with your personal data. Providing personal data is voluntary and depends on your decision. However, providing certain personal data is necessary to meet your expectations, for example, in order to contact the Company or to conclude or perform a contract with the Company. Please note that if you contact us regarding any matter, providing your data may be necessary, for example, to enable us to respond to your inquiry.

D. USERS' RIGHTS

Present a claim to the Spanish Data Protection Agency or the President of the Polish Data Protection Authority (PUODO) or any other competent supervisory authority, if you consider that the processing of your personal data infringes applicable data protection laws.

E. RETENTION PERIOD

  1. Users' personal data shall be stored for the following period:
    1. Contact regarding your inquiry (contact form, e-mail, phone)

      - Data will be processed until the correspondence is concluded or until the limitation period for claims arising from a contract has expired (if applicable).

    2. Subscription to the “Construction Magazine UNews” newsletter

      - Data will be processed until consent is effectively withdrawn or subscription is cancelled.

    3. Voluntary surveys related to ULMA services

      - Data will be processed until you effectively object or the purpose of processing is achieved.

    4. Provision of services and performance of the contract in relation to maintaining a User account on the Platform

      - Data will be processed until the limitation period for claims arising from the contract has expired.

    5. Monitoring the Platform to ensure security, prevent fraud and abuse, and protect against automated attacks and spam

      - Data will be processed until you effectively object or the purpose of processing is achieved.

    6. Use of necessary cookies

      - Data will be processed until you effectively object or the purpose of processing is achieved.

    7. Use of cookies other than necessary cookies

      - Data will be processed until consent is effectively withdrawn or you object or the purpose of processing is achieved.

    8. Analysis, statistics, and improvement of the Platform

      - Data will be processed until you effectively object, the purpose of processing is achieved, or consent is effectively withdrawn (for location-based data).

    9. Archival and evidentiary purposes

      - Data will be processed until you effectively object or the purpose of processing is achieved.

    10. Establishment, exercise or defense of legal claims and handling of possible mediations

      - Data will be processed until the limitation period for claims has expired, which may vary depending on applicable law.

    11. Compliance with obligations arising from the GDPR and other applicable laws

      - Data will be processed until it is no longer necessary, you effectively object, or the limitation period for the Data Controller's liability expires.

F. COOKIE POLICY

Policy modification:

The Platform may modify this policy when changes are made that may affect the use of cookies, due to legislative or regulatory requirements, or in order to adapt this policy to the instructions issued by the Spanish Data Protection Agency, the Polish Personal Data Protection Office, or any other competent supervisory authority.

Cookie placed on the Platform:

  • _clck – third-party cookie, valid for 1 year. Function: Analytics – analysis of website traffic.
  • _clsk – third-party cookie, valid for 1 day. Function: Analytics – analysis of user sessions.
  • _ga – third-party cookie (Google), valid for 2 years. Function: Analytics – website visit statistics.
  • _ga_0E6BWWJNGE – third-party cookie (Google), valid for 2 years. Function: Analytics – monitoring website traffic.
  • _ga_60H3ZDVRGY – third-party cookie (Google), valid for 2 years. Function: Analytics – statistics and measurement of website activity.
  • _ga_MSVHZEJJ6H – third-party cookie (Google), valid for 2 years. Function: Analytics – analysis of user behavior on the website.
  • _gcl_au – third-party cookie (Google), valid for 3 months. Function: Marketing – profiling and advertising.
  • _gid – third-party cookie (Google), valid for 24 hours. Function: Analytics – short-term website traffic statistics.
  • CookieConsent – third-party cookie, valid for 1 year. Function: Necessary – managing user consent and privacy settings on the website.
  • myulma_session – first-party cookie, session cookie. Function: Necessary – user session management on the website.
  • u.class – first-party cookie, validity depends on the system. Function: Functional – remembering user preferences on the website.
  • XSRF-TOKEN – token protecting against CSRF attacks, session cookie. Function: Security – protecting forms and sessions from attacks.

G. AGREEMENT BETWEEN THE JOINT CONTROLLERS

Content of the arrangements under the joint controllership agreement to be provided to data subjects

We hereby inform you that between the Joint Controllers:

  1. ULMA Construccion Polska S.A., with its registered office in Koszajec, address: Koszajec 50, 05-840 Brwinów, entered into the register of entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register, KRS: 0000055818, NIP: 5270203299, REGON: 011201520, with a fully paid-up share capital of PLN 10,511,264.00, (hereinafter referred to as: “Joint Controller I” or “ULMA POLSKA”)
  2. ULMA CyE, S. Coop., with its registered office in Oñati (Guipúzcoa), Spain, Paseo de Otadui 3, Apdo. 13E, 20560, Tax ID: F20023065, (hereinafter referred to as: “Joint Controller II” or “ULMA CyE”) hereinafter jointly referred to as the “Parties” or the “Joint Controllers”, A Joint Controllership Agreement has been concluded regarding the processing of personal data using IT environments and tools within the ULMA Group (hereinafter: the “Agreement”). This means that each of these entities processes your personal data within an agreed scope.

ULMA POLSKA is responsible for:

  1. ensuring that the use of tools provided by ULMA CyE by ULMA POLSKA employees is compliant with GDPR, including through employee training and management of access rights, as well as by reporting comments and concerns regarding the provided tools to ULMA CyE;
  2. cooperating with ULMA CyE in the process of implementing IT tools;
  3. fulfilling information obligations towards data subjects, including providing information on behalf of ULMA CyE to data subjects within the scope of processing purposes described in the Agreement;
  4. obtaining consent from individuals where consent constitutes the legal basis for processing.

ULMA CyE is responsible for:

  1. ensuring that IT solutions provided to ULMA POLSKA comply with all GDPR requirements, from implementation through operation to decommissioning, in particular by:
  2. designing IT solutions in accordance with the privacy by design principle;
  3. selecting appropriate technical and organisational measures ensuring a level of security appropriate to the identified risks to the rights and freedoms of individuals;
  4. carrying out data protection impact assessments where required under Article 35 of the GDPR;
  5. ensuring compliance with the accountability principle for the provided tools, including the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems (Article 5(2) GDPR);
  6. regularly testing, assessing and evaluating the effectiveness of technical and organisational measures ensuring the security of processing within the provided systems;
  7. where subprocessors are engaged, ensuring that such entities provide sufficient guarantees of implementing appropriate technical and organisational measures to meet GDPR requirements and verifying such entities;
  8. managing incidents and personal data breaches, where they occur within the provided systems;
  9. supporting ULMA POLSKA in fulfilling data subjects' rights referred to in Articles 15–20 of the GDPR.

Regardless of the above allocation of responsibilities, each Joint Controller remains equally responsible towards you for ensuring that your personal data is processed lawfully and in compliance with applicable regulations.

You may exercise your rights related to your personal data by submitting a request to ULMA POLSKA or ULMA CyE. To facilitate the exercise of your rights, the Joint Controllers have designated contact points available at the following email addresses: i) for ULMA POLSKA: rodo@ulmaconstruccion.pl; ii) for ULMA CyE: lopd@ulmacontruction.es.

However, irrespective of these arrangements and designated contact points, you may exercise your rights against any of the Joint Controllers (in such case, we will forward your request to the appropriate entity internally).

XI. Laws and Application in Canada

In the case of applying this policy within Canada, the provisions of the federal Personal Information Protection and Electronic Documents Act and related provincial legislation shall apply to ULMA Construction Systems Canada Inc., a subsidiary controlled by ULMA CyE, S. Coop.