1. Who we are / Data controller

This Privacy Policy applies to the website www.corex-iberia.com (the “Site“), operated by:

  • Corex Iberia
  • Tax/Company registration number: [to be completed by the company]
  • Registered office: Rua Comendador Sá Couto, 829, 4535-439 S. Paio de Oleiros, Portugal
  • Email: info@corex-iberia.com
  • Phone: +351 227 471 760

Corex Iberia is part of Corex Group, a division of VPK Group (headquarters: Kareelstraat 108, 9300 Aalst, Belgium), and acts as the data controller for personal data collected through the Site, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR“) and applicable national implementing legislation.

No formally appointed Data Protection Officer (DPO) is currently in place; any privacy-related queries should be directed to the general contact above, marking the subject line “Data Protection / Privacy.”

2. What personal data we collect and why

The Site collects personal data only when voluntarily provided by the User, through the following forms:

  1. a) Contact / quote request form Data collected: name, email address, company, country/location, phone number (where provided), and the content of the message or request. Purpose: to respond to commercial, technical or quote-related inquiries, and to manage the resulting commercial relationship.
  2. b) Job applications (“Careers”) Data collected: name, contact details, CV/résumé, cover letter, and any other information the applicant chooses to include in their application (which may include educational background, professional experience and, where relevant, nationality or work authorisation information). Purpose: evaluating applications for open positions and managing recruitment and selection processes within Corex Group/VPK Group.
  3. c) Technical browsing data As the Site is hosted on WordPress and offers content in multiple languages, it automatically generates technical server access logs (IP address, date/time of access, pages visited, browser type) and may set cookies strictly necessary for its operation (e.g., to remember the user’s language preference). See Section 8 (“Cookies”) for further details.

Corex Iberia does not collect special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, etc.) through the Site, and asks Users not to include such information in the forms, except where strictly necessary and voluntarily provided in the context of a job application (e.g., for reasonable accommodation purposes), and only with the data subject’s explicit consent.

3. Legal basis for processing

The processing of personal data is based on the following legal grounds (Art. 6 GDPR):

  • Performance of pre-contractual steps and of the contract (Art. 6(1)(b)): responding to quote requests and managing the commercial relationship;
  • Legitimate interest of the controller (Art. 6(1)(f)): managing unsolicited applications, improving the Site, and IT security, always balanced against the rights and freedoms of data subjects;
  • Consent of the data subject (Art. 6(1)(a)): where applicable, in particular for sending marketing communications or using non-essential cookies, which may be withdrawn at any time without affecting the lawfulness of prior processing;
  • Compliance with a legal obligation (Art. 6(1)(c)): where required by applicable law (e.g., tax, labour or record-keeping obligations).

4. Data retention period

Personal data is retained only for as long as necessary for the purposes for which it was collected, and never beyond what is strictly necessary, in particular:

  • Contact/quote requests: up to 24 months after the last contact, unless a commercial relationship results, in which case applicable legal document-retention and tax retention periods apply;
  • Job applications: up to 24 months after submission, for consideration of future opportunities, unless the applicant objects; if an application results in hiring, data will thereafter be processed in accordance with applicable employment legislation;
  • Technical browsing data/server logs: generally between 6 and 13 months, in line with data protection authority recommendations.

After these periods, data is deleted or irreversibly anonymised, unless a longer retention period is legally required.

5. Recipients of data

Personal data may be shared with:

  • Companies within Corex Group and VPK Group, for centralised commercial management and recruitment purposes, both within and outside Portuguese territory;
  • Service providers acting as data processors on behalf of Corex Iberia, including web hosting, Site maintenance (e.g., Inédito.com.pt), email delivery and applicant-tracking tools, subject to contractual confidentiality and security obligations;
  • Public or judicial authorities, where required by law.

Corex Iberia does not sell or rent personal data to third parties for marketing purposes unrelated to its business.

6. International data transfers

As Corex Group and VPK Group operate across multiple European countries (and, in the case of VPK Group, also outside the European Union), personal data may be transferred to group entities or service providers located outside the European Economic Area (EEA). In such cases, Corex Iberia ensures appropriate safeguards are in place under the GDPR, in particular through Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other legally permitted mechanisms.

7. Data subject rights

Under the GDPR, data subjects may, at any time and free of charge (except for manifestly unfounded or excessive requests), exercise the following rights:

  • Access to their personal data and information about its processing;
  • Rectification of inaccurate or incomplete data;
  • Erasure (“right to be forgotten”), in cases provided for by law;
  • Restriction of processing, in certain circumstances;
  • Data portability, in a structured, commonly used and machine-readable format;
  • Objection to processing, in particular where based on legitimate interest or for direct marketing purposes;
  • Withdrawal of consent, at any time, where processing is based on this ground, without affecting the lawfulness of processing carried out prior to withdrawal.

These rights may be exercised by written request to info@corex-iberia.com; Corex Iberia may request additional information to confirm the requester’s identity.

Data subjects also have the right to lodge a complaint with the competent supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt) — or with the data protection authority of their habitual place of residence within the European Union.

8. Cookies

The Site may use cookies and similar technologies, in particular:

  • Strictly necessary cookies: essential for the Site’s operation (e.g., remembering the PT/ES/EN language preference, session security), which do not require prior consent;
  • Performance/analytics cookies (if implemented, e.g., Google Analytics): help understand Site usage for continuous improvement purposes, subject to the User’s prior consent;
  • Third-party functionality cookies: associated with embedded content (e.g., YouTube videos, interactive location maps), subject to the privacy policies of the respective providers.

If the Site implements non-essential cookies, a cookie consent banner should be displayed, allowing the User to accept, reject or customise their preferences before such cookies are activated, in line with applicable ePrivacy/EU cookie rules. Users may also manage or delete cookies directly through their browser settings.

9. Data security

Corex Iberia implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or improper disclosure, including access controls, encryption in transit (HTTPS/SSL), and confidentiality agreements with service providers. However, no system is completely secure, and Corex Iberia cannot guarantee absolute security in the transmission of data over the Internet.

10. Minors

The Site is not directed at individuals under the age of 18, and Corex Iberia does not knowingly collect personal data from minors. Should the inadvertent collection of a minor’s data without proper parental consent be identified, such data will be deleted as soon as reasonably possible.

11. Changes to this Policy

Corex Iberia reserves the right to update this Policy periodically to reflect legal, technical or organisational changes. The version in force will always be the one published on the Site, with an indication of the relevant update date.

12. Contact

For questions about this Policy or to exercise your rights:

  • Email: info@corex-iberia.com
  • Phone: +351 227 471 760
  • Address: Rua Comendador Sá Couto, 829, 4535-439 S. Paio de Oleiros, Portugal