Candidate’s data protection policy

1. Data Controller

In compliance with data protection regulations, we inform you that by signing this document, you consent Ferrovial S.E. (hereinafter “Ferrovial”), located at at kingsfordweg 151, 1043GR Ámsterdam and registered at the Dutch Trade Register KvK73422134 to process your personal data as Data Controller. Ferrovial will process your personal data for the following purposes set below. “Ferrovial” stands for Ferrovial S.E., and its subsidiary companies (Hereinafter, the “Data Controller”)

The Data Controller is fully committed to compliance with current legislation on data protection and, therefore, has appointed a Data Protection Officer, who can be contacted through the email address dpd@ferrovial.com.

2. Purposes and legal basis for the processing of your personal data

Purpose nº1: Candidate application management for a selection process

Data Processing Operations	We will process your data to manage your application and develop the selection process to which you have applied, which involves the analysis of your professional profile through the information contained in your CV and the information generated during the development of the selection process through interviews, group dynamics and communications exchanged with you.   We may also process your contact information in order to: communicate with you during the process, send you information about your progress, request further information about your profile and, if necessary, make you a job offer.
On what legal basis do we process your data?	The legal basis for the processing of your data is the application of pre-contractual measures in accordance with your registration for the job offer.   In the case of processing special category data, the legal basis is the fulfillment of legal obligations applicable to Ferrovial and the exercise of specific rights in the field of labor law and social security and protection.
What data is processed for this purpose?	Identity and contact data: ID card number, name, surname, telephone, email. Personal characteristics and social circumstances data Academic data Special category of personal data (e.g., health data, criminal records, etc.) -in some cases. Professional and employment data: work experience, job title, etc. Others: those that you decide to share with us by sending your CV and those that may be generated during the selection process.   We also inform you that the data processed for the development of the selection process are provided directly by you through the sending of your CV to the Data Controller by the means provided for this purpose and the results of the interviews and tests conducted for the selection process.

Purpose nº2: Conservation of data for new selection processes

Processing operations	Once the selection process has been completed, if the candidate is not selected, their personal data will be erased. However, if you give your consent, the Data Controller will keep your data for the evaluation of your profile in new selection processes of Ferrovial companies.
On what legal basis do we process your data?	The legal basis for processing is the consent of the data subject, which may be revoked at any time by sending an email to dpd@ferrovial.com.   In the case of processing special category data, the legal basis is the fulfillment of legal obligations applicable to Ferrovial and the exercise of specific rights in the field of labor law and social security and protection.
What data is processed for this purpose?	Identity and contact data: DNI/NIE, name, surname, telephone, email. Personal characteristics and social circumstances data Academic data Special category data (e.g., health data, data on criminal offenses, etc.) -in some cases-. Professional and employment data: work experience, job title, etc. Others: those that you decide to share with us by sending us your CV and those that may be generated during the selection process.   We also inform you that the data processed for the development of the selection process are provided directly by you through the sending of your CV to the Data Controller by the means provided for this purpose. Additionally, results from interviews and tests conducted during the selection process will also be considered.

Purpose nº3: Quality surveys on the selection process

Data processing operations	The Data Controller might handle your personal data to reach out and email you surveys about your views on the selection procedures, with the aim of enhancing them.
On what legal basis do we process your data?	The legal basis for the processing is the legitimate interest of the Data Controller in carrying out such quality surveys to improve and optimize job offers and our Portal.   *You can request more information about the legitimate interest of the Data Controller and its balancing with the rights and freedoms of data subjects, as well as object to this purpose of processing, by writing to dpd@ferrovial.com.
What data is processed for this purpose?	Identity and contact data: name, surname, telephone number, e-mail address Personal characteristics and social circumstances data Academic data Professional and employment data: work experience, job position, etc.

3. Communication of your data

The personal data processed by the Data Controller to achieve the purposes detailed above may be communicated to the following recipients depending on the legal basis for the communication:

DATA RECIPIENTS	COMMUNICATED DATA	LEGAL GROUNDS
Competent bodies of the Public Administrations determined by the legislation in force at any given time, the Social Security and the Tax Agency, for the purposes of complying with the legal obligations that correspond to them, exclusively, with the scope determined by such legislation.   To third parties with which the Data Controller maintains contractual relations for the sole purpose of fulfilling the obligations in terms of Occupational Risk Prevention, coordination of business activities, in cases where the candidate must access the facilities of such third parties.	– Identification data – Social circumstances data – Employment details – Economic, financial and insurance data	Legal requirements compliance
All other entities belonging to Ferrovial. To this extent, Ferrovial companies are all those entities linked by sharing Ferrovial S.E. as the parent company and which are listed in the notes to the latest consolidated financial statements published on the website www.ferrovial.com.   You can request further information on Ferrovial companies by writing to us at the following e-mail address: dpd@ferrovial.com.	– Identification data – Personal characteristics data – Social circumstances data – Employment details – Sensitive data (e.g., health data, trade union membership, etc.) – Economic, financial and insurance data	Data subject’s consent

4. Data Retention Period

Once the selection process has concluded, if the candidate is not hired, the personal data will be erased, unless you give your consent for your data to be retained for processing in new selection processes of Ferrovial companies. If you give your consent, the data will be kept for a maximum period of one year.

Once the personal data has been erased, it will be blocked so that it can only be made available to the relevant authorities in the event of requests for information and, once the applicable legal prescription periods of actions have elapsed, your personal data will be materially deleted.

5. Rights regarding the processing of your data

The Data Controller informs you that you have the right to access your personal data and obtain confirmation of how such data is being processed. You also have the right to request the rectification of inaccurate data or, where appropriate, request their deletion when, among other reasons, the data is no longer necessary for the purposes for which they were collected by the Data Controller.  In certain circumstances, you may request the limitation of the processing of your data, in which case the Data Controller will only keep them for the exercise or defense of possible claims. Likewise, also in certain circumstances, you may object to the processing of your personal data for the purpose informed by the Data Controller. In this case, the Data Controller will cease to process the personal data, unless there are legitimate reasons, or to ensure the exercise or defense of possible claims. Also, you may request the right to portability and to obtain for yourself or for another service provider certain information derived from the relationship entered into with the Data Controller. Finally, if your consent is the legal basis for your data being processed, you have the right to withdraw or revoke it at any time.

Such rights may be exercised, identifying yourself as the owner of the data or his representative, by sending an email to the address dpd@ferrovial.com.

The Data Controller will provide the requested information within a maximum period of one month from receipt of the request. This period may be extended for a further two months if necessary, taking into account the complexity and number of requests. In any case, you may lodge a complaint with the supervisory authority responsible for data protection. However, in the first instance, you may file a complaint with the Data Protection Officer.

6. International Transfers

The Data Controller informs that the purposes of data processing indicated below may involve the communication of candidate data to other Ferrovial companies, which implies the performance of international data transfers.

Purposes of data processing that may involve international data transfer.

• To enable the formalization, execution and management of the corresponding selection process;
• To keep personal data for new selection processes of Ferrovial companies.

In such cases, the Data Controller ensures the security of the data transfers by means of appropriate safeguards, such as: (i) that the country of destination has been the subject of an adequacy decision issued by the European Commission, (ii) Standard Contractual Clauses issued by the European Commission, (iii) Binding Corporate Rules, (iv) authorization from a data protection authority and/or any others that legitimize in accordance with the regulations in force the security of the transfer according to the standards required by the European authorities.

You may request more information about the guarantees for international transfers that may be carried out by the Data Controller in relation to your personal data by writing to us at: dpd@ferrovial.com.