Privacy Policy

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and Spanish Personal Data Protection and Digital Rights Act (Law 3/2018), Indra Sistemas, S.A (hereafter referred to as Indra) complies with the standards and policies that enable us to safeguard and maintain the confidentiality of your personal data.

Who is responsible for data processing?

Indra, as the data controller, undertakes to respect and ensure that your personal data are protected. The identification data of the person responsible for processing are:

For what purpose, legitimacy and duration do we process your personal data?

Users (data subjects) can only access certain Indra functions after submitting certain mandatory personal data categories, since these data are necessary to process the corresponding request. Upon failure to provide these data, user requests may not be answered.

More specifically, and based on the legitimacy specified below, we process your personal data for the following purposes:

Information about the processing of data for the contact and sending of communications from Indra

The data provided will be processed by Indra for the purpose of establishing contact with the User, in addition to providing information concerning Indra's products, services, publications and reports, activities and/or social and professional events.

The express consent granted by the User is the legal basis for the aforementioned purposes. Users are given an option to unsubscribe at any time through the corresponding mechanism included in every communication sent. The personal data provided will be kept for the period necessary to respond to the User's request or until the User's deletion or withdrawal of consent is requested. Data will subsequently be retained for a term of 3 years to fulfill potential liabilities arising from the purpose and processing of the data. Once this period has elapsed, the data will be destroyed.

Talent recruitment

The data provided will be processed by Indra for the development, performance and management of the selection process in which the User registers. The legal basis for data processing is the need to apply pre-contractual measures.

On the other hand, if the User consents, personal data will be added to the company's candidate database to manage participation in future selection processes.

The personal data provided shall be stored for one (1) year from the most recent update and so long as the data subject has not withdrawn his or her consent. Data will then be retained for a term of 3 years to fulfill potential liabilities arising from the purpose and processing of the data. Once this period has elapsed, the data will be destroyed.

Direct Channel

The data provided through the Direct Channel will be processed for the purpose of receiving, admitting and recording the information communicated, in addition to taking as many actions as deemed appropriate for the clarification of the facts or conduct of the reported persons or entities.

The legal basis for processing is compliance with the law regulating whistleblower protection and measures against corruption, in addition to application of article 6.1.e) of the General Data Protection Regulation (GDPR), and article 24 of the Spanish Data Protection and Digital Rights Act (Law 3/2018 of December 5).

Personal data will be stored for the period necessary to comply with the Spanish Whistleblower Protection and Anti-Corruption Act (Law 2/2023 of February 20). Under no circumstances may the data be kept for a period longer than ten years. Data will then be retained for a term of 3 years to fulfill potential liabilities arising from the purpose and processing of the data. Once this period has elapsed, the data will be destroyed.

Web navigation (Cookies)

Indra uses proprietary and third-party cookies to record user browsing activities, quantify the number of users and perform statistical service usage analysis.

Cookies are files downloaded to the user's device (computer/mobile phone/tablet) when visiting a website. Cookies are used to store and retrieve information about the user's browsing habits.

The user's consent to use cookies constitutes a legal basis.

Personal data provided will be stored for the period necessary to respond to the User's request until either the data are deleted or the User has withdrawn consent. Data will then be retained for a term of 3 years to fulfill potential liabilities arising from the purpose and processing of the data. Once this period has elapsed, the data will be destroyed.

Do we share your data with third parties?

In order to comply with the aims set out in this Privacy Policy, in certain cases we need to communicate your data to the following recipients:

• Indra Group Companies. The full list of companies that make up the group can be viewed via the following link: https://www.indracompany.com/es/sociedades-pertenecientes-indra-sistemas
• Government authorities and public agencies for the fulfillment of obligations directly required of Indra.

If it is necessary to transfer data to a third country that does not guarantee an adequate level of data protection, Indra guarantees the adoption of security measures recognized by international standards. In any case, Indra guarantees that it will adopt security measures to safeguard the confidentiality of the personal data provided by users.s. 

How long do we keep your personal data for processing?

The personal data provided are stored for the terms specified in the section entitled “For what purpose, legitimacy and duration do we process your personal data?“, and in general for the time necessary to attend to the User's request or until the User requests the erasure of such data or withdraws consent.

As necessary, personal data will then be retained for as long as needed to fulfill potential liabilities arising from the purpose and processing of the data. Once this period has elapsed, the data will be destroyed.

What are your rights?

El Usuario tiene derecho a ejercer los derechos que le asisten en materia de protección de datos de conformidad con la normativa aplicable. ParaThe User has the right to exercise the data protection rights in accordance with the pertinent legislation in force. To do so, we are committed to guaranteeing the transparent exercise of their rights. In this regard, it is reported that the User may exercise the following rights: 

• Access to your data: The User has the right to not only secure confirmation that we are processing personal data at Indra concerning the user and, in such a case, but also gain access to such data.
• Correction or deletion of their data: In certain circumstances, the User has the right to rectify inaccurate personal data on record that we are processing, and also request that we delete them when these data are no longer necessary for the purposes for which they were collected, or any other reason.
• Limitation of the processing of their data: The User also has the right in certain circumstances, to request the restriction of data processing, in which case we shall only store the data necessary to exercise that right or in our legitimate defense on claims.
• Portability of your data:  The right to receive personal data concern you that you have provided us in a structured, commonly used, and machine-readable medium, and to transfer them to another data controller.

• Opposition to data processing: In certain circumstances and for reasons related to the particular situation, the User shall have the right to oppose the processing of his/her data, in which case we would no longer process them unless there are legitimate reasons or for the establishment, exercise or defense of legal claims.
• If the User has granted his/her consent to process his/her personal data for any of the purposes described in this Policy, he/she may withdraw it at any time without affecting the lawfulness of the processing based on the consent prior to withdrawal.

The User may exercise the rights contemplated in the terms set out in the corresponding data protection legislation by writing to the Data Privacy and Protection Office at Indra Sistemas, S.A., Avenida de Bruselas, 33-35, 28018, Alcobendas, Madrid or,  sending an email to dpo@indra.es specifying, in both cases, the rights to exercise. 

Likewise, the User may file any complaints he/she deems appropriate with the competent control authority.

Personal data security

Indra has adopted the technical and organizational measures necessary to protect the confidentiality, security and integrity of personal data. Personal data may only be accessed by employees and authorized service providers on a need-to-know basis. Likewise, the company guarantees continuous data protection training for all employees. In this regard, Indra has an Information Privacy Management System that is certified under international standard ISO/IEC 27701, whose objective is to define, implement and improve the controls and procedures that enable risks to be minimized and managed in the company's internal processes.

Likewise, with a view to ensuring early detection and effective management of data breaches (security incidents affecting personal data), Indra has formalized an incident management team called the Computer Security Incident Response Team (Indra CSIRT). Indra CSIRT works jointly with the Data Protection and Privacy Office to asses incident risk and privacy implications. In the event of any suspicious event or vulnerability that might affect personal data, the company makes the following addresses available to users: csirt@indra.es and dpo@indra.es, for the purpose of reporting on incidents, situations or events with such characteristics.

Changes to the Privacy Policy

Indra reserves the right to make changes to the website without prior notice with the aim of keeping its information up to date, adding, modifying, correcting or deleting published content. Users are advised to review this Policy regularly.