Privacy policy

Following the principles of lawfulness, fairness and transparency, creatit provides this Privacy Policy, which describes how we process the personal data you provide through the website, through our forms, and in the course of our relationship with clients, candidates and contacts.

1. Data controller

2. What personal data do we process?

We process the categories of data you provide directly and those derived from your browsing:

• Identifying and contact data: first name, surname, email, telephone and company.
• Enquiry data: the information you include in contact forms, in requests for proposals, or in your communications with us.
• Candidate data: the contents of your CV and any documentation provided during recruitment processes.
• Browsing data: IP address, device and cookie identifiers, and site usage data, on the terms of our Cookie Policy.

The data we request is adequate, relevant and strictly necessary. You are not obliged to provide it, but withholding it may prevent us from providing the service or handling your enquiry.

3. For what purpose and on what legal basis do we process your data?

• Handling your enquiries and requests for information about our services. Legal basis: your consent and/or pre-contractual measures at your request (art. 6.1.a and 6.1.b GDPR).
• Managing the contractual relationship with clients and suppliers. Legal basis: performance of the contract (art. 6.1.b GDPR) and compliance with legal obligations (art. 6.1.c GDPR).
• Managing recruitment processes . Legal basis: your consent (art. 6.1.a GDPR).
• Sending you commercial communications and marketing insights, if you subscribe or are a client. Legal basis: your consent, or legitimate interest in the case of clients (art. 6.1.a and 6.1.f GDPR). You may object or unsubscribe at any time.
• Analysing site usage and measuring campaigns through analytics and marketing cookies. Legal basis: your consent (art. 6.1.a GDPR and art. 22 LSSI-CE).

4. How long do we keep your data?

We keep your data for the minimum time necessary for the purpose for which it was collected and, in any case, for as long as a relationship with us exists. As a general rule:

• Enquiry and contact data: while your request is being handled and, afterwards, for the period necessary to address any potential liabilities.
• Contractual data: for the duration of the relationship and, after it ends, for the statutory limitation periods (commercial and tax, up to a maximum of 6 years).
• CVs in recruitment processes: a maximum of 12 months unless you tell us otherwise, after which they are securely deleted.
• Data for commercial communications: until you withdraw your consent or unsubscribe.

5. Who do we share your data with?

As a general rule we do not transfer your data to third parties, except where legally required. To provide our services we work with technology suppliers who act as processors and access the data solely in order to provide us with their service, under the corresponding agreement: website hosting and infrastructure providers, analytics and digital advertising platforms (such as Google and Meta), and email management and email marketing tools.

For the management of recruitment processes we use the recruitment platform Teamtailor (Teamtailor AB, Sweden), which acts as processor. Applications submitted through the careers section of the site are managed and stored in Teamtailor, which processes the data on servers located within the European Union and under the corresponding data processing agreement.

6. International transfers

Some of our suppliers (for example, Google or Meta) may process data on servers located outside the European Economic Area, principally in the United States. Such transfers are covered by appropriate safeguards under the GDPR, such as adherence to the EU-U.S. Data Privacy Framework or the signing of Standard Contractual Clauses approved by the European Commission.

7. What are your rights?

You may exercise the following rights in relation to your personal data, free of charge:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request the deletion of your data (the «right to be forgotten»).
• Objection: to object to certain processing.
• Restriction: to request the restriction of processing in the cases provided for.
• Portability: to receive your data in a structured, commonly used format.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

8. How to exercise your rights

You may exercise your rights by writing to legal@creatit.es or in writing to our registered office, stating the right you wish to exercise and attaching, where necessary to verify your identity, a copy of an identity document.

If you take part in a recruitment process, you can also manage your consent and request access to or deletion of your application directly on the platform Teamtailor, through the links included in the communications you receive from our processes, or through the candidate privacy options that Teamtailor makes available to you.

Likewise, if you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (AEPD), at www.aepd.es.

9. Security measures

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, preventing the loss, misuse, alteration and unauthorised access to your data. All personnel involved in the processing are bound by a duty of confidentiality.

10. Minors

Our services and forms are aimed at people over 14 years of age. If you are under that age, please do not provide personal data without the consent of your parents or guardians.

11. Changes to this policy

We may update this Privacy Policy to adapt it to legislative or case-law developments, or to changes in our processing. We recommend reviewing it periodically; the date of the last update appears at the top.

Document drawn up in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD). The Spanish version of this policy is the legally binding one; this English text is provided for information purposes only.