Purpose: to respond to enquiries and requests for information; to maintain relationships with professional contacts; and, where appropriate, to provide information about O2O’s products, services, content, activities or events, including by electronic means.
Legal basis: the data subject’s consent where necessary; the implementation of pre-contractual measures at the data subject’s request; and, where permitted by law, O2O’s legitimate interest in maintaining and developing professional and commercial relationships.
Categories of data: identifying data, contact details, professional data and information provided by the data subject themselves in their communication.
Recipients and data processors: authorised O2O staff and suppliers acting as data processors where necessary to provide support, hosting, communications or technology management services. Data will not be disclosed to third parties unless required by law or where necessary to respond to the request.
Retention: for as long as necessary to deal with the enquiry and maintain the relationship and, where applicable, until consent is withdrawn or an objection is raised. Where it is necessary to retain certain information to meet legal obligations, it will be blocked for the periods required by law.
Purpose: to manage pre-contractual and contractual relationships, invoicing, collections and payments, administration, the provision and receipt of services, and the management of partnership agreements.
Legal basis: performance of a contract or the implementation of pre-contractual measures; compliance with legal obligations; and O2O’s legitimate interest in managing its business relationships appropriately.
Data categories: identification and contact details, professional details, economic, financial and banking details, commercial information and data relating to transactions involving goods and services.
Recipients and data processors: Public and tax authorities, banks, auditors, advisers and other third parties where there is a legal obligation or where this is necessary for the contractual relationship; and suppliers acting as data processors.
Retention period: for the duration of the contractual relationship and, subsequently, for the limitation and retention periods required by commercial, tax, accounting and other applicable regulations.
Purpose: to manage recruitment processes; employment relations; payroll and personnel administration; training; risk prevention; monitoring of working conditions; employee benefits; promotion; and other obligations arising from the employment relationship.
Legal basis: the implementation of pre-contractual measures; the performance of the employment contract; compliance with legal obligations relating to employment and social security; and, where applicable, O2O’s legitimate interest or the data subject’s consent for additional processing.
Data categories: identification and contact details; academic and professional details; employment, financial and banking information; and any other data necessary for the management of the employment relationship or the recruitment process.
Recipients and data processors: Social Security, the Tax Authorities, banks, mutual insurance societies, insurers, occupational health and safety services, public authorities and other legally designated recipients, as well as suppliers acting as data processors.
Retention: staff data will be retained for the duration of the employment relationship and, subsequently, for the periods necessary to fulfil legal obligations and responsibilities. Data relating to unsuccessful candidates will be deleted upon completion of the recruitment process, unless the data subject authorises its retention for future processes or there is another valid legal basis.
Purpose: to safeguard the safety of individuals, property and premises and, where legally applicable, to carry out workplace monitoring functions.
Legal basis: O2O’s legitimate interest in ensuring safety and, for workplace monitoring, the powers legally granted to the employer.
Data categories: images and, only where the system in place permits it and it is legally justified, voice recordings.
Recipients and data processors: data may be disclosed to law enforcement agencies, courts, tribunals or competent authorities where necessary or where there is a legal obligation to do so.
Retention: generally, for a maximum of one month from the date of collection, unless the data must be retained to substantiate incidents that threaten the safety of persons, property or premises, or at the request of a competent authority.
Purpose: to publish photographs, videos or other audiovisual content on the website, in corporate materials, on social media, in the media or on other platforms used for O2O’s communication and promotion.
Legal basis: the data subject’s consent where required or, where applicable, another legal basis that is applicable depending on the context and specific purpose.
Categories of data: image, voice and other identifying data that may appear in the content.
Recipients and data processors: public dissemination when the content is published on the internet, social media or in the media, as well as suppliers providing communication, design, hosting or similar services.
Retention: for as long as necessary for the purpose for which the data was collected and, where processing is based on consent, until such consent is withdrawn, without prejudice to copies or publications which cannot be technically deleted or which must be retained due to a legal obligation.
Purpose: to receive, manage, analyse and investigate information regarding possible regulatory infringements or breaches in accordance with the provisions of Law 2/2023 and O2O’s internal regulations.
Legal basis: compliance with a legal obligation applicable to O2O, in accordance with Article 6(1)(c) of the GDPR and Law 2/2023 of 20 February.
Categories of data: identification and contact details of the whistleblower where they identify themselves; data relating to data subjects and third parties; and any other data included in the report that is necessary for its processing. Special categories of data may be processed only where there is sufficient legal authorisation.
Recipients and data processors: access is restricted to persons authorised in accordance with Law 2/2023. Data may be disclosed to the judicial authorities, the Public Prosecutor’s Office, the competent administrative authorities or other recipients where necessary for the investigation or where there is a legal obligation to do so. The external management of the channel shall be treated as a data processing engagement.
Retention: data will be retained only for as long as is necessary and proportionate. Within the internal system, three months after receipt, if no investigation has been initiated, the data will be deleted, except where it is retained in anonymised form to demonstrate the system’s functionality. If an investigation is initiated, the information may be retained outside the system for as long as necessary for the investigation and any subsequent proceedings, in accordance with the applicable legal time limits.
O2O guarantees the confidentiality of the identity of the whistleblower and of the persons concerned in accordance with the law.
Purpose: to respond to enquiries made via O2O’s virtual assistant; to monitor its operation; to analyse its usage; to detect errors; and to produce activity and quality reports for human review and service improvement.
Legal basis: the user’s informed consent, expressed through the voluntary use of the assistant to make an enquiry, and O2O’s legitimate interest in monitoring the security, operation and quality of its virtual assistant. O2O applies data minimisation measures and does not request personal data in order to use the assistant.
Data categories: O2O does not request personal data for making enquiries. However, as this is a free-text field, the user may voluntarily enter identifying details, contact details or other personal information. The user must not include confidential information, special categories of data or personal data that are not necessary for their enquiry.
Recipients and data processors: Amazon Web Services (AWS) infrastructure is used to provide the service, via Amazon Bedrock, using the Mistral Large model. AWS acts as O2O’s technology provider under the applicable contractual terms. The model provider does not receive the conversations. No international data transfers are envisaged for this processing.
Retention: Raw conversation logs and the activity and quality reports derived from them are retained for a maximum period of three months. Once this period has elapsed, they are deleted, except for aggregated or anonymised information that no longer allows a person to be identified.
Conversations are not used to train, retrain or improve the artificial intelligence model. Nor does O2O use the assistant to make automated decisions that have legal effects or significantly affect the user
