PRIVACY POLICY FOR SUPPLIERS OF GRUPO PLANETA COMPANIES IN SPAIN
Who is the controller responsible for the processing of your data?
This Privacy Policy (hereinafter, the "Policy") informs you of the manner in which the Grupo Planeta company to which you provide your personal data (hereinafter, "the Company", the "Controller", "we" or "our") collects and uses your personal data in connection with your registration and use of the Company's supplier portal (hereinafter, the "Portal").
This information is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter, the "GDPR"). It relates to the personal data collected by the Company in connection with the contractual relationship with:
suppliers who are natural persons (for example, independent service providers, consultants, trainers or lecturers);
suppliers who are legal entities.
The personal data concerned includes:
your own data, if you are a supplier who is a natural person;
the personal data of the natural persons acting on behalf of the supplier that is a legal entity (for example, legal representatives, employees, staff, or any other contact person).
Suppliers undertake to forward this Policy to all individuals within their organisations whose personal data may be processed in connection with the contractual relationship with the Company.
What categories of personal data do we collect?
Unless otherwise indicated, or where the collection of certain data requires your prior consent, all personal data we collect is necessary for the management of our contractual relationship. If you do not provide such data, we may be unable to enter into or perform the contract binding us to you, or to process your requests (in particular, in relation to invoicing).
We may collect the following categories of personal data:
Identification data, such as first and last name, date and place of birth, residential address, identity document details, tax code and VAT number;
Contact data, such as email address(es), telephone number(s), fax number(s), and postal address(es);
Information relating to professional or business activity, such as possible registration with professional bodies, business sector, positions held within the organisation, goods and services offered, curriculum vitae, etc.;
Academic data: this data includes, among others, a copy of the qualifications evidencing academic credentials, etc.;
Information relating to orders placed and/or contracts entered into;
Payment and billing information, such as payment methods, bank account number, IBAN code, and billing email address;
Connection data: cookies; for further information, please refer to our Cookie Policy.
Any other information voluntarily provided by the Supplier.
Do we make automated decisions?
We do not make any decisions based solely on the automated processing of your personal data, including profiling.
How do we collect the Supplier's personal data?
Most of the data we collect is provided to us by the Supplier at the time the contract is signed and throughout the contractual relationship. In addition, we may collect the Supplier's personal data through third parties (for example, providers of commercial information services) or public registers.
For what purposes and on what legal basis do we process the Supplier's personal data?
The Supplier's personal data will be processed for the following purposes:
To enter into and perform the contract to which the Supplier is a party, and to carry out the activities necessary to comply with the obligations set out therein, or to adopt pre-contractual measures requested by the Supplier;
To settle the corresponding invoices, which may involve disclosing your personal data to the banking institutions involved in their processing, in order to correctly identify the payee and subsequently process the payment;
If the Supplier has given consent, to disclose its identification and contact data to such banking institutions, so that they may contact the Supplier and offer the possibility of early payment of its invoices;
To comply with the legal obligations to which we are subject;
To assess the Supplier's technical, economic and financial suitability, and to verify that it meets the requirements necessary for its qualification or the updating thereof;
To assert, exercise or defend a right before judicial or administrative bodies, or in arbitration or conciliation proceedings;
To carry out preparatory activities or activities related to extraordinary corporate transactions, such as transfers of business units, acquisitions, mergers and spin-offs;
To carry out actions relating to the technical aspects of the supplier portal, such as:
Providing technical support and resolving incidents: using the contact data of portal users (name, email, telephone number) so that the support team can contact the supplier in the event of a fault, log and follow up support requests, and ensure the traceability of reported incidents.
Improving and maintaining the portal: managing information relating to supplier accounts in order to gather feedback, test new functionalities in secure environments, and ensure the correct migration or updating of data during technical system upgrades.
How do we store the Supplier's personal data?
We implement security measures to protect the Supplier's personal data against the risk of destruction, loss or (accidental or unlawful) alteration of personal data, as well as unauthorised disclosure of, or access to, such data.
For how long do we retain the Supplier's personal data?
Most of the Supplier's personal data will generally be retained for the entire duration of the contractual relationship and for 10 years thereafter. Certain data may be retained for a shorter period if the specific purpose for which it was collected has been fulfilled or no longer applies.
To whom is the Supplier's personal data disclosed?
Personal data may be accessed, known to, or disclosed to the following persons, who will act as authorised personnel, controllers or independent parties, as applicable:
Our employees or staff, in any capacity;
Employees or staff, in any capacity, of possible parent, subsidiary or affiliated companies;
Providers of goods and services and consultants, such as accountants, auditors and lawyers;
Financial institutions involved in settling issued invoices and identifying the payee. Likewise, where the Supplier has given consent, its data may be disclosed to such financial institutions so that they may contact the payee and offer the possibility of early payment;
Public authorities or bodies, if and to the extent required or imposed by law;
Prospective purchasers, in the event that we intend to transfer ownership or control of all or part of our business.
Please note that, should any of the parties referred to above be established outside the European Economic Area (EEA), we will transfer personal data, in the absence of an adequacy decision and without relying on any of the derogations under Article 49 GDPR, on the basis of the standard contractual clauses referred to in Article 46(2)(c) and (d) GDPR.
The Supplier's rights under personal data protection law
In accordance with Articles 15 to 22 GDPR, the Supplier has the right to:
Be informed of the purposes and methods of the processing of personal data;
Access their personal data;
Rectify personal data that is incomplete, inaccurate or outdated;
Obtain the erasure of personal data;
Obtain, in the cases provided for by law, the restriction of the processing of personal data;
Object, wholly or in part, in the cases provided for by law, to the processing of personal data;
Obtain, where technically feasible, the portability of personal data.
Where consent is required for the processing of personal data, the Supplier may also withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent given prior to its withdrawal.
The Supplier may exercise the rights referred to above and request any information regarding the processing of personal data by contacting the Controller at the following email address: lpdproveedores@planeta.es
You may contact our Data Protection Officer by writing to dpo@planeta.es or to Grupo Planeta, Attn: Data Protection Officer, Avda. Diagonal 662-664, 08034 Barcelona.
Likewise, should you consider it appropriate, you may lodge a complaint with the Spanish Data Protection Agency, in particular where you consider that we have not duly satisfied the exercise of your rights.
Changes to the Privacy Policy
This Policy was last updated on 30/06/2026.
The Company recommends that you review this document each time you access the website, in order to remain duly informed of the processing of your personal data and to be aware of any changes that may occur.
PRIVACY POLICY FOR SUPPLIERS OF GRUPO PLANETA COMPANIES IN FRANCE
Who is the controller responsible for the processing of your data?
This Privacy Policy (hereinafter, the "Policy") informs you of the manner in which the Grupo Planeta company to which you provide your personal data (hereinafter, "the Company", the "Controller", "we" or "our") collects and uses your personal data in connection with your registration and use of the Company's supplier portal (hereinafter, the "Portal").
This information is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679, known as the General Data Protection Regulation (hereinafter, the "GDPR"). It relates to the personal data collected by the Company in connection with the contractual relationship with:
suppliers who are natural persons (for example, independent service providers, consultants, trainers or lecturers);
suppliers who are legal entities.
The personal data concerned includes:
your own data, if you are a supplier who is a natural person;
the personal data of the natural persons acting on behalf of the supplier that is a legal entity (for example, legal representatives, employees, staff, or any other contact person).
Suppliers undertake to forward this Policy to all individuals within their organisations whose personal data may be processed in connection with the contractual relationship with the Company.
What categories of personal data do we collect?
Unless otherwise indicated, or where the collection of certain data requires your prior consent, all personal data we collect is necessary for the management of our contractual relationship. If you do not provide such data, we may be unable to enter into or perform the contract binding us to you, or to process your requests (in particular, in relation to invoicing).
In connection with your registration and use of the Portal, we may collect the following categories of personal data:
Identification data: this data includes first name, last name, date and place of birth, residential address, identity document details, tax code and VAT number, social security number, etc.;
Contact data : this data includes email address(es), telephone number(s), fax number(s), postal address(es), etc.;
Professional or business data : this data includes possible registration with professional bodies, business sector, positions held within the organisation, goods and services offered, curriculum vitae, etc.;
Academic data : this data includes a copy of qualifications evidencing academic credentials, etc.;
Contractual data : this data includes information relating to orders placed, services provided and/or contracts entered into with the Company, etc.;
Payment and billing data : this data includes payment methods, bank details (IBAN, BIC), and the email address for sending invoices, etc.;
Connection data: cookies; for further information, please refer to our Cookie Policy.
Any other information or data that you choose to voluntarily provide to us in the course of our exchanges or the contractual relationship.
Do we collect sensitive data?
In accordance with Article 9 GDPR, sensitive data corresponds to personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation.
In certain specific cases, we may collect sensitive data concerning you, only where this is strictly necessary and for determined purposes, such as ensuring that a lecturer or instructor has no legal or judicial incompatibilities preventing them from carrying out activities involving direct contact with students.
How do we collect your personal data?
Most of the data we collect is provided to us directly by you or by the supplier at the time a contract is entered into and throughout the contractual relationship. In addition, we may collect personal data concerning you through third parties (for example, providers of commercial information services) or through publicly accessible sources, such as official registers.
On what legal bases do we process your personal data?
We process your personal data in accordance with the legal bases provided for under the GDPR, in particular:
Performance of a contract : where processing is necessary for entering into or performing a contract to which you are a party, or for the implementation of pre-contractual measures taken at your request;
Compliance with legal obligations : where we must comply with legal or regulatory obligations (for example, accounting, tax, or anti-corruption obligations);
Our legitimate interest, provided that your rights and freedoms do not override it: this means that we have a valid and balanced reason for using your personal data, and that such processing is carried out in a manner that does not adversely affect your rights and interests.
Your consent : In certain cases, we may need to request your explicit consent before processing your personal data. Such processing is carried out only where you have previously consented to it, and you may withdraw your consent at any time.
For what purposes do we process your personal data?
We may collect and use your personal data in connection with your use of the Portal for the following purposes:
Entering into and managing contracts : processing the information necessary for the drafting, signing, monitoring and performance of contracts with suppliers;
Managing administrative and financial aspects : processing invoices, monitoring payments, and accounting management;
Assessing the supplier's capacity: analysing technical, economic and financial suitability, verifying compliance with selection and qualification criteria, and updating information;
Asserting, exercising or defending our rights : in the event of a dispute or proceedings before a court or an administrative authority, or in the context of arbitration or conciliation proceedings;
Preparing for or supporting extraordinary transactions : such as transfers of business units, acquisitions, mergers and spin-offs.
Carrying out actions relating to the technical aspects of the supplier portal: such as
o Providing technical support and resolving incidents by using users' contact details (name, email address, telephone number) to contact suppliers, manage support requests, and ensure incident traceability.
o Improving and maintaining the Portal by processing supplier account information to gather feedback, test new features in secure environments, and ensure the correct migration or updating of data during system upgrades
Do we make automated decisions?
We do not make any decisions based solely on the automated processing of your personal data, including profiling.
How do we protect your personal data?
We take the necessary measures to ensure that your personal data collected via the website is not lost, accessed, altered or disclosed by unauthorised third parties.
To this end, we have implemented technical measures (such as firewalls) to protect your data against unlawful or accidental destruction, alteration or loss, misuse, and unauthorised access, modification or disclosure.
In addition, organisational measures (such as data access authorisation management systems, etc.) help preserve the confidentiality of your data. For example, access to your personal data is strictly limited to expressly authorised personnel of the Controller and to our partners and processors, who act in accordance with our instructions, our contractual provisions, and applicable law.
For how long do we retain your personal data?
Your personal data is retained for the period strictly necessary to achieve the purposes described in this Privacy Policy.
As a general rule, personal data will be retained for the entire duration of the contractual relationship.
At the end of this relationship, certain data may be retained for an additional period, in particular to comply with legal or regulatory obligations.
For example, data relating to invoicing and accounting is retained for 10 years, in accordance with the legal obligations regarding the retention of accounting records.
To whom is the Supplier's personal data disclosed?
Your personal data may be disclosed to the following persons or entities, within the limits of their respective duties:
External service providers: certain data may be accessible to third-party service providers acting on our behalf and in accordance with our instructions, for the purposes described in this Policy (for example, IT service providers, payment services, and Portal hosting providers).
These third parties are contractually required to:
comply with strict confidentiality and data protection obligations;
process data solely for the purposes defined in the contract binding them to us;
implement appropriate technical and organisational measures to ensure the security and integrity of the data.
Employees or staff, in any capacity, of possible parent, subsidiary or affiliated companies;
Professional advisers: we may also share certain data with our professional advisers (for example, accountants, auditors, lawyers, insurers) where this is necessary for the management of the contractual relationship or the defence of our interests.
Public or judicial authorities : in certain cases, we may be legally required to disclose your data to administrative, judicial or regulatory authorities, in particular in the event of litigation or where required or imposed by law;
Third parties in connection with extraordinary transactions : if we are considering a restructuring, merger, acquisition or business transfer transaction, your data may be disclosed to the parties concerned (for example, prospective purchasers).
Is your personal data transferred outside the European Economic Area (EEA)?
In connection with our relationships with partners or service providers located outside the European Economic Area (EEA), we may transfer your personal data to third countries. In the absence of an adequacy decision issued by the European Commission, and without relying on the derogations under Article 49 GDPR, such transfers are governed by the standard contractual clauses adopted by the European Commission, in accordance with Article 46(2)(c) and (d) GDPR, in order to ensure an adequate level of data protection.
Your rights under personal data protection law
In accordance with Articles 15 to 22 GDPR, you have the following rights:
Access the personal data concerning you that we retain;
Rectify personal data that is incomplete, inaccurate or not up to date;
Obtain the erasure of personal data, in the cases provided for by law. Please note that in certain cases, we may be required to retain your personal data for legal or legitimate reasons;
Obtain, in the cases provided for by law, the restriction of the processing of personal data;
Object, wholly or in part, in the cases provided for by law, to the processing of personal data;
Obtain, where technically feasible, the portability of personal data. This right applies where the processing is based on consent or on a contract, and is carried out by automated means.
Where consent is required for the processing of personal data, you may also withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent given prior to its withdrawal.
Pursuant to Article 48 of Law No. 78-17 of 6 January 1978 (the "French Data Protection Act"), you may issue instructions regarding your data in the event of your death.
You may exercise the rights referred to above and request any information regarding the processing of personal data by contacting us at the following address:
Email: rgpdfournisseur@planetaformation.fr
If you believe that your rights have not been respected, you also have the option of lodging a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL).
Amendments to the Policy
Last updated: [To be completed]
We may update this Policy in order to improve transparency towards you and to reflect any change in the way we process your data. We recommend that you review this document each time you access the website, in order to remain duly informed of the processing of your personal data and to be aware of any changes that may occur.