PRIVACY POLICY

PERSONAL DATA PROTECTION POLICY
In compliance with the data protection legislation in force, comprising the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 —GDPR—) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we hereby inform you of our Personal Data Protection Policy.


Data controller
The data controller is the legal person that determines the purposes and means of the processing of personal data. In other words, the controller decides how and for what purposes personal data are processed.

For the purposes of this Data Protection Policy, the controller of the personal data is:

• Company name: XENÉTICA FONTAO, S.A. — Tax ID (NIF): A27222207
• Registered office: Lg. Fontao, s/n, 27210 Esperante (Lugo), Spain
• Email for data protection matters and the exercise of rights: rgpd@xeneticafontao.com
• Telephone: +34 982 284 391

Data protection officer
XENÉTICA FONTAO, S.A. has appointed ADENDA CONSULTORÍA JURÍDICA, S.L. as its Data Protection Officer (DPO) (Article 37(7) GDPR and Article 34.3 LOPDGDD). 
You may contact the DPO about any matter relating to the processing of your personal data and the exercise of your rights and, on an optional basis, to file a complaint before applying to the Spanish Data Protection Agency (Article 37 LOPDGDD):

• Data Protection Officer: ADENDA Consultoría Jurídica, S.L. (Tax ID B27836139). Contact person: Diego Estévez García.
• Address: Rúa República Arxentina, 20, 6.º, oficina 35, 36201 Vigo (Pontevedra), Spain.
• Email: destevez@adenda.net
• Telephone: +34 986 120 145

What personal data do we process and how do we protect them?
Personal data means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

For the purposes set out in this Privacy Policy, the controller collects and processes the personal data described for each type of processing, which will depend on the services you request or on the contractual relationship you have with our organisation.

Our organisation undertakes to process your personal data in the strictest confidence and to apply appropriate physical, technical and organisational security measures to protect them.

In all cases, you guarantee and are responsible for the truthfulness, accuracy, validity and authenticity of the personal data provided, and you undertake to keep them duly updated.


Record of processing activities
XENÉTICA FONTAO, S.A. is a regional public company majority-owned by the Xunta de Galicia (Regional Government of Galicia) through the Galician Agricultural Guarantee Fund (FOGGA). In keeping with this status and with the principle of transparency (Article 31.2 LOPDGDD, Spanish Law 19/2013, of 9 December, and Galician Law 1/2016, of 18 January, on transparency and good governance), it publishes below the inventory of the processing activities it carries out as controller, with the information required by Article 30 GDPR and the legal basis for each processing activity.

Unless otherwise stated, the data are obtained from the data subjects themselves or from their legal representatives. No special categories of data or data relating to criminal convictions and offences are processed.

• Purpose: Administrative and employment management of staff: recruitment, payroll, Social Security, disciplinary matters, internal communications and compliance with the obligations of an entity of the regional public sector.
• Legal basis: Performance of the employment contract (Art. 6(1)(b) GDPR). Compliance with legal obligations in employment, tax and Social Security matters (Art. 6(1)(c) GDPR; Spanish Workers' Statute and General Social Security Act). Consent (Art. 6(1)(a) GDPR) for the use of images and personal contact details, which may be withdrawn at any time.
• Data subjects: Employees.
• Categories of data:  Identification data (name and surname, national ID/foreigner ID number, Social Security number, address, telephone, signature); personal characteristics; academic and professional data; employment details; economic, financial and insurance data. No special categories of data are processed.
• Recipients (disclosures): General Treasury of the Social Security and managing bodies; State Tax Administration Agency and Galician Tax Agency; banks (payment of salaries); insurance companies; collaborating mutual insurance company; Xunta de Galicia (FOGGA) and supervisory bodies of the regional public sector, where required by law.
• International transfers: None.
• Retention period: For the duration of the employment relationship and thereafter for the limitation periods applicable to any liabilities: 4 years for employment and Social Security records (Art. 4 of the Spanish Law on Social Order Infringements and Penalties, LISOS) and 6 years for records with accounting value (Art. 30 of the Spanish Commercial Code).

2. Occupational risk prevention

• Purpose: Management of occupational risk prevention, health surveillance through the external prevention service, and coordination of business activities.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Spanish Law 31/1995 on Occupational Risk Prevention, LPRL).
• Data subjects: Employees and staff of other companies working at the workplace.
• Categories of data: Identification data; job data; prevention training; fitness-for-work conclusions. Health data are processed exclusively by the medical staff of the external prevention service (Art. 22.4 LPRL).
• Recipients (disclosures): Labour authority and Labour and Social Security Inspectorate, when requested; collaborating mutual insurance company.
• International transfers: None.
• Retention period: 5 years (Art. 23 LPRL and Art. 4.3 LISOS). The list of workers exposed to biological agents will be kept for 10 years after the end of exposure (Art. 9 of Royal Decree 664/1997).

3. Working time records

• Purpose: Daily recording of working hours (start and finish times).
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Art. 34.9 of the Spanish Workers' Statute).
• Data subjects: Employees.
• Categories of data: Name and surname, national ID/foreigner ID number, user ID and time records.
• Recipients (disclosures): Labour and Social Security Inspectorate, when requested, and workers' legal representatives.
• International transfers: None.
• Retention period: 4 years (Art. 34.9 of the Spanish Workers' Statute).

4. Equality plan

• Purpose: Preparation of the situation assessment, the equality plan and the pay register.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Spanish Organic Law 3/2007 on effective equality between women and men; Royal Decrees 901/2020 and 902/2020).
• Data subjects: Employees.
• Categories of data: Identification data; personal characteristics; social circumstances; academic and professional data; employment and pay details. Aggregated or pseudonymised data are used wherever possible.
• Recipients (disclosures): Negotiating committee and workers' legal representatives; competent labour authority.
• International transfers: None.
• Retention period: For the duration of the plan and 4 years thereafter.

5. Harassment prevention protocol

• Purpose: Prevention of harassment and handling of the reports and proceedings provided for in the protocol.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Art. 48 of Organic Law 3/2007 and occupational risk prevention legislation).
• Data subjects: Employees (complainants, persons concerned and witnesses).
• Categories of data: Identification data; employment details; reported facts and information resulting from the investigation.
• Recipients (disclosures): Members of the investigating committee; labour authority, Labour Inspectorate and courts, where appropriate.
• International transfers: None.
• Retention period: 4 years from the resolution of the case (5 years if a penalty was imposed).

6. Staff training

• Purpose: Management of staff training and, where applicable, the related subsidies.
• Legal basis: Performance of the employment contract (Art. 6(1)(b) GDPR) and compliance with legal obligations regarding preventive training (Art. 6(1)(c) GDPR; Art. 19 LPRL).
• Data subjects: Employees and participants in training activities.
• Categories of data: Identification data (including, where applicable, images); personal characteristics; academic and professional data.
• Recipients (disclosures): Training providers and the State Foundation for Training in Employment (FUNDAE), when the training is subsidised.
• International transfers: None.
• Retention period: 4 years from the date of the training activity.

7. Presence control

• Purpose: Control of restricted staff access to departments and areas of the facilities.
• Legal basis: Performance of the employment contract (Art. 6(1)(b) GDPR).
• Data subjects: Employees.
• Categories of data: Name and surname, department and access records.
• Recipients (disclosures): No data are disclosed to third parties.
• International transfers: None.
• Retention period: 1 month. Where the records are used as working time records, 4 years (Art. 34.9 of the Spanish Workers' Statute).

8. Customers and suppliers

• Purpose: Management of the commercial and contractual relationship with customers (livestock farmers, associations, purchasers of semen doses, embryos and laboratory services) and suppliers, including invoicing and public procurement.
• Legal basis: Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Compliance with legal obligations regarding accounting, tax and public sector procurement (Art. 6(1)(c) GDPR; Spanish Law 9/2017 on Public Sector Contracts). Legitimate interest in processing the contact details of persons providing services in legal entities (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD).
• Data subjects: Customers, suppliers and contact persons.
• Categories of data: Identification data (name and surname, national ID/tax ID, address, telephone, signature); commercial information; economic, financial and insurance data; transactions of goods and services.
• Recipients (disclosures): Tax authorities; banks; external audit bodies (Galician Court of Auditors — Consello de Contas de Galicia — and Spanish Court of Auditors — Tribunal de Cuentas); publication on the Galician Public Procurement Platform where required by procurement legislation.
• International transfers: None.
• Retention period: For the duration of the relationship and 6 years thereafter (Art. 30 of the Spanish Commercial Code). Public procurement files: at least 5 years from the end of the contract.

9.Tax and accounting management

• Purpose: Compliance with the tax and accounting obligations arising from the organisation's activity.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Spanish Law 58/2003, General Tax Act, and Commercial Code).
• Data subjects: Customers, suppliers and employees.
• Categories of data: Identification data (name and surname, national ID/tax ID, address, telephone) and economic data.
• Recipients (disclosures): State Tax Administration Agency and Galician Tax Agency; banks; auditors; supervisory bodies of the regional public sector.
• International transfers: None.
• Retention period: 6 years for accounting books and records (Art. 30 of the Spanish Commercial Code); 4 years for tax records (Arts. 66 to 70 of the General Tax Act), extendable up to 10 years in the cases provided for in Art. 66 bis.

10. Contacts

• Purpose: Responding to enquiries received through the website, by email or by telephone, and sending information on the Centre's activities, services and catalogues to those who request it.
• Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
• Data subjects: Contact persons, persons requesting information and customers.
• Categories of data: Name and surname, postal or email address, telephone and content of the enquiry.
• Recipients (disclosures): No data are disclosed to third parties.
• International transfers: None.
• Retention period: Enquiries: 1 year from the reply; information mailings: until the person unsubscribes or withdraws consent.

11. Personal data breaches

• Purpose: Recording and management of personal data breaches and, where applicable, their notification to the supervisory authority and communication to the data subjects concerned.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Arts. 33 and 34 GDPR).
• Data subjects: Persons whose data are affected by the incident (employees, suppliers, customers, contact persons and representatives).
• Categories of data: The data affected by the incident and those necessary to manage it.
• Recipients (disclosures): Spanish Data Protection Agency; law enforcement agencies; insurance companies; data subjects concerned, where appropriate.
• International transfers: None.
• Retention period: At least 3 years from the closure of the incident (Art. 72 LOPDGDD).

12. Exercise of rights

• Purpose: Handling requests to exercise the rights recognised by data protection legislation.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Arts. 12 to 22 GDPR).
• Data subjects: Applicants and their representatives.
• Categories of data: Identification and contact data, signature and content of the request.
• Recipients (disclosures): Spanish Data Protection Agency and courts, in the event of a complaint.
• International transfers: None.
• Retention period: 3 years from the reply. Any identity documents provided are deleted once identity has been verified.

13.Video surveillance

• Purpose: Ensuring the security of people, animals, facilities, property and the genetic material held at the Centre. Images may be used for employee monitoring under the terms of Art. 89 LOPDGDD.
• Legal basis: Performance of a task carried out in the public interest (Art. 6(1)(e) GDPR), in conjunction with Art. 22 LOPDGDD; for employee monitoring, Art. 89 LOPDGDD and Art. 20.3 of the Spanish Workers' Statute.
• Data subjects: Employees, visitors, suppliers and customers accessing the facilities.
• Categories of data: Images. No sound is recorded.
• Recipients (disclosures): Law enforcement agencies and courts, where necessary.
• International transfers: None.
• Retention period: Maximum of 1 month from recording, unless the images must be kept as evidence of acts against people, property or facilities (Art. 22.3 LOPDGDD).

14. Visitor access log

• Purpose: Control of access to the facilities by visitors and third parties for security and biosecurity reasons.
• Legal basis: Legitimate interest in the security of the facilities (Art. 6(1)(f) GDPR).
• Data subjects: Visitors, suppliers, customers and employees.
• Categories of data: Name and surname, organisation, signature, date and time of access.
• Recipients (disclosures): No data are disclosed to third parties.
• International transfers: None.
• Retention period: 1 month.

15. Internal reporting system (whistleblowing channel)

• Purpose: Managing reports of possible breaches of the law and deciding whether to open an investigation, in accordance with Spanish Law 2/2023, of 20 February. The channel is available at https://transparencia.xunta.gal/es/canle-de-denuncias.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Arts. 10, 13 and 30 of Law 2/2023).
• Data subjects: Whistleblowers, persons concerned by the reported facts and witnesses.
• Categories of data: Identification and contact data (except in anonymous reports) and information on the reported facts. The whistleblower's identity is kept confidential.
• Recipients (disclosures): Judicial authorities, Public Prosecutor's Office and competent administrative authority, in the context of an investigation.
• International transfers: None.
• Retention period: Deleted after 3 months if no investigation has been opened; under no circumstances kept for more than 10 years (Arts. 26 and 32 of Law 2/2023).

16. Livestock organisations and genetic improvement programmes

• Purpose: Management of the relationship with livestock associations and farms and provision of genetic improvement, germplasm bank and molecular genetics laboratory services, as a public-interest task entrusted to the Galician Animal Selection and Reproduction Centre.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR; Regulation (EU) 2016/1012 on animal breeding, and Spanish Royal Decree 45/2019 on zootechnical standards) and, where applicable, performance of the service contract (Art. 6(1)(b) GDPR).
• Data subjects: Livestock farm holders, members of breeders' associations and their representatives.
• Source of the data: The data subjects themselves, partner associations and organisations, and public registers of farms.
• Categories of data: Identification data (name and surname, national ID/tax ID, address, telephone), bank details, agricultural holding code (REGA) and herd-book registration number of the holding (CONAFE).
• Recipients (disclosures): Breeders' associations and organisations recognised for the management of herd books and breeding programmes; public authorities with responsibility for livestock and animal health.
• International transfers: None.
• Retention period: For as long as participation in the breeding programmes lasts and thereafter for the periods required by zootechnical and animal health legislation (records of reproductive material: at least 3 years; 6 years where they support a sale). Historical programme records may be kept for archiving purposes in the public interest.

17. Staff recruitment

• Purpose: Comprehensive management of recruitment processes for employees: applications, verification of requirements, assessment of merits and tests, selection panels, publication of lists and results, complaints and appeals, and creation and management of job pools.
• Legal basis: Pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR) and compliance with the legal obligations to respect the principles of equality, merit, ability and publicity (Art. 6(1)(c) GDPR; first additional provision of the Spanish Basic Statute of Public Employees).
• Data subjects: Candidates in recruitment processes and job seekers.
• Categories of data: Identification data (name and surname, national ID/foreigner ID number, address, telephone, signature); personal characteristics; academic and professional data; employment details.
• Recipients (disclosures): Members of selection panels or committees; publication of lists on the website and notice board, using the identification method set out in the seventh additional provision of the LOPDGDD; supervisory bodies and courts, in the event of an appeal; workers' legal representatives, where appropriate.
• International transfers: None.
• Retention period: Process file: until the process becomes final and 5 years thereafter. Job pools: for as long as they remain in force. Published lists are removed once the process becomes final.

Data processors
In addition to the disclosures indicated for each activity, XENÉTICA FONTAO, S.A. uses providers who access the data on its behalf, as data processors, for the provision of the following services. All of them are bound by the processing agreement provided for in Article 28 GDPR and may only process the data in accordance with the organisation's instructions:

• Employment, tax and accounting advisory services.
• IT, systems and information security services.
• Website development, hosting and maintenance.
• Supply and maintenance of management software applications.
• External occupational risk prevention service.
• Data protection consultancy and Data Protection Officer services.

International transfers and automated decisions
No international transfers of data are made to countries outside the European Economic Area. Nor are any decisions taken based solely on automated processing, including profiling, which produce legal effects concerning data subjects or similarly significantly affect them.


Security measures
XENÉTICA FONTAO, S.A. applies technical and organisational measures appropriate to the risk of each processing activity (Article 32 GDPR), determined on the basis of the organisation's risk analysis, including: physical access control to the facilities and departments, logical access control to systems with personal credentials, an information security policy and staff confidentiality undertakings, back-ups, processing agreements with providers who have access to data, and a personal data breach management procedure.


What are your rights when you provide us with your data?
In accordance with the applicable data protection legislation, you have a number of rights in relation to the processing of your personal data. You may exercise these rights free of charge, except where requests are manifestly unfounded or excessive, in particular because of their repetitive character.

These rights are as follows: You may exercise the above rights free of charge by writing to XENÉTICA FONTAO, S.A. (Lg. Fontao, s/n, 27210 Esperante, Lugo, Spain), by email to rgpd@xeneticafontao.com, or by contacting the Data Protection Officer, stating the right you wish to exercise and the details needed to process your request. You will only be asked for proof of identity where there are reasonable doubts about it (Article 12(6) GDPR). We will reply within one month of receipt of the request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and the reasons for it within the first month (Article 12(3) GDPR).

Data subjects can obtain further information about their rights on the website of the Spanish Data Protection Agency, www.aepd.es.

Our organisation reserves the right to amend its Privacy Policy at its own discretion or as a result of legislative or case-law changes or changes in the doctrine of the Spanish Data Protection Agency. Users will not be explicitly notified of changes or updates to this Privacy Policy. We recommend that you consult this page periodically to keep up to date with the latest changes or updates.

This policy was last reviewed on 3 October 2026.