Protection of Personal Data

In accordance with the European Data Protection Regulation, the LOPD, the criteria of the Spanish Data Protection Agency and the LSSIC, we inform you of your personal data protection rights.

Who is responsible for the processing of your data?

    • Company name: TALENT IN PEOPLE BRETEMA, S.L.
    • Postal address: C/ Loreto y Chicote2; Madrid CP. 28004, Madrid
    • Web:
    • Telephone: 915940644
    • Mail:
    • Register of Foundations: Volume 12.789, Page 42, Section 8, Sheet M-205188, Entry 10 (Madrid Mercantile Registry).
    • Data Protection Officer:;

What are your rights when you provide us with your data?

    • The right to know if your personal data is being processed.
    • The right to request access to your personal data.
    • The right to rectification.
    • The right of cancellation or deletion.
    • The right to object.
    • The right to request the limitation of their processing.
    • The right to data portability.
    • The right not to be subject to automated decisions.

The holders of personal data may exercise their rights by writing to the postal address of the data controller indicated above, or to, including in both cases a photocopy of their ID card or other equivalent identification document, both holder and of their representative if acting through them and, in this case, a document accrediting said status. The specific right(s) being exercised must be indicated.


Children under the age of 14 shall not submit, and are prohibited from submitting, any personal information without the consent of their parent or guardian. The controller is not responsible for any personal information submitted by children under 14 years of age without the appropriate and required authorisation.

Can consent be withdrawn?

You may revoke your consent to the processing of your data at any time and it will take effect in legal cases, but processing operations that were carried out based on the prior consent you gave will be valid.

Where can you lodge a complaint about personal data protection?

You can address your complaints to the Spanish Data Protection Agency which is located at: y en la calle Jorge Juan 6, Madrid, 28001.

What data, purposes, deadlines, basis for legitimisation and transfers are there?

The following table provides information on each of these aspects:

Treatment Purpose Data Conservation Legitimation Destination
Web users To deal with requests made by the web visitor using the contact form. The identification data that we require in the contact form provided (name, surname, e-mail, company,) and those that you voluntarily provide us with in the established text field. For the time required to meet your request where this is the case, and thereafter for no more than one year. The express consent given by the user. Your data will only be passed on to a third-party if you have given your express prior consent or if there is a legal basis for doing so.
Analytics When browsing you provide us with your IP address, MAC address, what operating system or browser you use, the duration of your visit and other metadata collected by the cookies which are reported at the url:

For the duration of your browsing on our website.

In the case of cookies, for the time established by each cookie that has been accepted or that must be downloaded for the technical performance of the service. For more information on these retention periods:

The legitimate interest of the controller in maintaining the accessibility, readability, usability, and security of the system.

To Google Inc., previously anonymised, for the purpose of analysing the management of the website’s sources, analysis of the operation, performance, and visits to the website.

Your data will only be disclosed to a third party if you have given your express prior consent or if there is a legal basis.

Social Networks Create a community of followers around the controller’s activities and services.

The identification data that you provide yourself as a user of the social network.

Information that you voluntarily provide when you contact us to make comments or via instant messaging on the network.

Users may cancel the processing of their data on the Social Network by configuring the options available to them to stop following us or deactivate “Like” and other similar options activated on their social profile.

In any case, for the minimum time necessary for any of the purposes described for which they have been provided to us.

The user’s express consent to become a follower or “Like” on our page.

The contractual terms and conditions of the Social Network.

Legitimate interest of the data controller.

The data of its followers is not communicated to any third party outside the social network.

The social networks used by the controller are [1]: LinkedIn; Youtube; Instagram; Facebook; Twitter.

Where applicable, the data controller will only communicate your data to a third party if:

a) You have previously given your express consent to do so.

b) Because there is legal protection.

c) Because the terms and conditions accepted by the user of the social network previously so permit when using its functionalities, such as being quoted by means of the @ in comments and similar uses or functionalities of the platform.


To be aware of the commercial proposals made by the supplier to the controller.

Where appropriate, to carry out all preparatory acts for the conclusion of a subsequent contract.

When contracting, to be able to comply with the rights and obligations of the contractual relationship entered.

Identification data arising from the means of contact used by the provider and those contained in the agreed contracts or those arising from the execution of the contractual relationship.

Normally: name and surname, VAT number, postal address, e-mail address, telephone number, signature, image (video surveillance) in isolated cases.

In general, personal data shall be kept for as long as the data subject does not request their deletion.

In any case, for the duration of the contractual relationship entered or preliminary dealings maintained.

After the end of the contractual relationship entered, they will remain blocked for the legal time necessary to meet the liabilities that may arise from the contractual relationship maintained or for any legal requirement.

In this respect, in general:

for 4 years in relation to tax obligations according to art.66 of the LGT.

for 5 years for relations affected by liabilities governed by art.1964 of the Civil Code.

for 6 years for those derived from art.30 of the Commercial Code.

for 10 years for liabilities deriving from offences defined in the Criminal Code unless the latter provides for a shorter period.

The data subject’s express consent or the data controller’s legitimate interest for preliminary dealings for a possible contract.

The contract entered where there is a contractual relationship.

The data will only be communicated to a third party if you have previously given your express consent; there is legal protection or to direct or auxiliary data processors.

To financial institutions to fulfil the obligations arising from the contractual relationship; to the State Tax Administration Agency; to other administrations, such as the Justice Administration if applicable.

Subscribers The sending of communications on current events, news, and proposals from the data controller.

The identification data that we require in the contact form provided (name, surname, e-mail).

In addition, when sending communications we collect and process your IP, MAC address, which operating system or browser you use and analogous metadata variables for the delivery of sent communications; opening data; clicked links and other analogous.

If the interested party does not request to unsubscribe from the communications service to which he/she has subscribed.

Your data will only be communicated to a third party if you have previously given your express consent or if there is legal protection.

The data may also be disclosed to processors necessary to manage the communication system, such as mail marketing, DNS management or cloud protection services.

Prior and express consent of the user: when the user has voluntarily subscribed to a newsletter advertised on our application, website, or platform.

Legal: The Law on Information Society Services when the data collected for sending originates from a previous donation or activities analogous to those derived from it.

Candidates To opt to take part in a recruitment process of the controller and to participate in it once admitted.

Identification, contact data (name and surname, ID, telephone, postal address, email, social networks…), training (academic, skills) and professional profile (professional experience, projects) and personal data limited to what is specific to a CV (other skills).

The data comes from the data subject himself/herself, who provides it when sending his/her CV via job portals or professional social networks where the data subject publishes his/her job application, or through third parties who propose the data subject’s profile to the data controller.

In any case, for the minimum time that the selection process lasts until the candidate is hired or discarded.

If the candidate is not finally selected, their data will be kept for a maximum of one year for incorporation into subsequent processes.

The express consent of the user.

Contractual: When the candidate’s profile comes from a platform or entity dedicated to personnel selection.

Legitimate interest of the data controller: when it receives the data subject’s profile from other third parties and it is not automatically discarded.

Your data will only be passed on to a third party if you have given your express prior consent or if there is a legal basis for doing so.
Advertising To advertise in a personalised and recurrent manner the activities and services of the controller.

Your Google Account information, such as your age range and gender

The general location of the web user.

The web user’s browsing activity.

The current search query.

Previous search activity.

Google Account sign-in activity.

Past ad interactions.

The types of websites the user visits.

Types of mobile application activity on the user’s device.

Activity on other devices.

Time of day.

Information you provide to an advertiser, such as when the user signs up for a newsletter with their email address.

For the maximum time that the advertising platform has established to show the personalised ad to the interested party, or the interested party clicks on or blocks the display of the ad.

Prior and express consent of the data subject.

Legitimate interest of the data controller.

Advertising platform responsible for managing the advertisements contracted by the data controller (Google Adsense; Doubleclick[2]).