1. DATA CONTROLLER

The data controller for the data collected on this website is:

• · Company name: VICARLI TRUCK S.L.U.

• · Tax ID number: B71266340

• · Address: C/ Badostáin, 1, Polígono Industrial Areta, 31620 Huarte (Navarra)

• · Telephone: +34 948 332 233

• · Privacy email: privacidad@ontime.es

• · Data protection officer: Mesher Consulting Data, SL

2. PURPOSE, LEGITIMACY AND RETENTION

We collect and process your personal data through the forms found on our website and the features available on the Customer Portal:

In order to assist you through the Website and the available contact channels, we may process, as appropriate, the following categories of data:

• · Identification and contact details that you provide when you contact us (e.g. name, company, telephone number, email address and the content of your enquiry).

• · Professional and employment data that may be contained in the CV you have sent us via atencionrrhh@ontime.es.

• · Browsing data and Website metrics, when you consent to the use of analytical and similar cookies (see the Cookies Policy).

We collect your data mainly through:

• · Enquiries sent via the telephone numbers, postal addresses or email addresses available on the Website.

• · CVs sent via the email address provided for this purpose.

• · Cookie-based measurement/analytics tools, where applicable and with your consent.

3. PURPOSES AND LEGAL BASES

We process your personal data for the following purposes and on the following legal bases:

Responding to enquiries and requests for information about transport, warehouses/logistics and/or the VICARLI-WMS system.

• · Purpose: to respond to your enquiries and manage the commercial or pre-contractual relationship.

• · Legal basis: implementation of pre-contractual measures at the request of the data subject and/or performance of a contract (Art. 6.1.b GDPR) where applicable; and, where appropriate, legitimate interest in communications management and security (Art. 6.1.f GDPR).

VIP access for customers/suppliers to the VICARLI-WMS system.

• · Purpose: to manage the commercial relationship.

• · Legal basis: performance of a contract (Art. 6.1.b GDPR) where applicable.

Selection processes and applications (CVs)

• · Purpose: to manage your application to work with us and, where applicable, to conduct interviews and carry out the necessary checks for the process.

• · Legal basis: implementation of pre-contractual measures (Art. 6.1.b GDPR) and, where applicable, your consent to keep your CV for future processes (Art. 6.1.a GDPR).

Web analytics (cookies and similar technologies)

• · Purpose: to better understand the preferences of Website users and make improvements.

• · Legal basis: your consent (Art. 6.1.a GDPR) given via the cookie banner/panel for non-technical cookies.

When the processing is based on your consent, you may withdraw it at any time through the mechanisms provided or by writing to us at privacidad@ontime.es. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

We do not collect data considered particularly sensitive, such as: race or ethnic origin, political opinions or religious or philosophical beliefs, trade union membership, health, sexual activity or orientation, biometric or genetic data.

It is the responsibility of each user to provide data that is true, accurate, complete and up to date, and they alone shall be liable for any direct or indirect damage or harm that may arise as a result of a breach of this obligation. The user guarantees that the data provided is true, accurate, complete and up to date, and is responsible for any direct or indirect damage or harm that may be caused as a result of a breach of this obligation.

If the user provides data from third parties, they declare that they have their consent and undertake to pass on the information contained in this clause to them, exempting VICARLI TRUCK from any liability in this regard. However, VICARLI TRUCK may carry out checks to verify this fact, taking the appropriate due diligence measures in accordance with data protection regulations.

4. RETENTION PERIODS

We will retain your personal data for as long as necessary to fulfil the purposes indicated and, subsequently, for the limitation periods of possible liabilities or the legally required periods, where applicable.

When deletion is appropriate, the data will be deleted and, where applicable, blocked (identified and reserved, preventing its processing and ordinary access) solely to address possible liabilities and only for the limitation period of these, remaining available to judges and courts, the Public Prosecutor's Office or competent public administrations. Once these periods have elapsed, the data will be permanently deleted.

As a guide, we indicate the following periods:

• · Enquiries and requests: for the time necessary to respond to them and, subsequently, for a maximum period of 12 months for follow-up and traceability, unless liabilities arise or a contractual relationship exists.

• · Contractual relationship/services: for the duration of the relationship and, after its termination, for the legal limitation periods for obligations and liabilities.

• · CVs: these will be kept for a maximum period of 1 year from receipt, unless you request their deletion earlier.

• · Cookies: according to the periods indicated in the Cookies Policy and your consent settings.

5. DATA RECIPIENTS

In general, your personal data will not be disclosed to third parties. However, it may be made available to third parties when there is a legal obligation to do so or when such disclosure is necessary for the proper provision of the service or management of the relationship.

The following is a non-exhaustive list of possible categories of recipients, provided for information purposes only:

• · Public administrations and competent authorities (e.g. tax authorities, courts and tribunals), when there is a legal obligation to do so.

• · Professional advisors (e.g., legal/accounting advisors), when necessary and with adequate safeguards.

• · Suppliers acting as data processors (e.g. hosting, maintenance, email, analytics or support tools), who will process the data in accordance with our instructions and under contract in accordance with Article 28 of the GDPR.

Likewise, your data may be communicated to companies within the group when necessary for internal management and the proper provision of services, or for internal administrative reasons, on the basis of a legitimate interest, ensuring confidentiality and security in all cases. The companies in the group currently mentioned are: VICARLI LOGÍSTICA S.L.U., VICARLI HANDLING S.L., VICARLI CONSULTING S.L.U. and GLOBAL LOGISTICS INVESTMENT S.L.

In the event of corporate transactions (e.g. merger, acquisition or transfer of assets), your data may form part of the transferred assets. In such cases, you will be informed in advance when required by law.

6. EXERCISE OF RIGHTS

As the data subject, you may exercise the rights explained below at any time by sending an email to the data protection officer at privacidad@ontime.es:

a. Right of access: You have the right to be informed by VICARLI TRUCK as to whether or not your personal data is being processed and, if so, to access that data and receive information on the purposes for which it is being processed, the categories of data affected by the processing, the recipients to whom your personal data has been disclosed and the expected period of data retention, among other information.

b. Right of erasure and objection: You have the right to request the erasure of personal data provided that the legal requirements are met, or to object to the processing at any time, on grounds relating to your particular situation, if the processing is based on our legitimate interest.

c. Right to Rectification: You have the right to request the rectification of inaccurate data concerning you when, among other reasons, it is no longer necessary for the purposes for which it was collected.

d. Restriction of processing and withdrawal of consent: In certain circumstances (for example, if the applicant disputes the accuracy of their data, while the accuracy of the data is being verified), you may request that the processing of your personal data be restricted, and the data will only be processed for the exercise or defence of claims. You also have the right to withdraw your consent at any time.

e. Portability of your data: You have the right to receive the personal data you have provided to VICARLI TRUCK in a structured, commonly used and machine-readable format, and to be able to transmit it to another data controller without the controller to whom you have provided it preventing you from doing so, in the cases provided for by law for this purpose.

f. Automated individual decisions: In addition to the above rights, in the event of automated decisions, including profiling, you have the right to obtain human intervention from VICARLI TRUCK, to express your point of view and to challenge the decision.

Finally, we inform you that you may lodge a complaint regarding the protection of your personal data with the Spanish Data Protection Agency (www.aepd.es), when the data subject considers that VICARLI TRUCK has violated the rights recognised by the applicable data protection regulations. The deadline for exercising your right as a data subject is one month from receipt of the request, which may be extended for a further two months in cases of complexity or due to the number of requests received.

7. DATA PROTECTION OFFICER

The company has a data protection officer who you can contact to ask questions, make complaints or raise any other issues affecting privacy in the processing of personal data. Their email address is privacidad@ontime.es

8. SECURITY MEASURES

VICARLI TRUCK will treat the User's data at all times in an absolutely confidential manner and will maintain the mandatory duty of secrecy regarding the same, in accordance with the provisions of the applicable regulations, adopting the necessary technical and organisational measures to guarantee the security of your data and prevent its alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the data stored and the risks to which it is exposed.

9. MINORS

This Website and its services are not intended for minors under the age of 14. If you are under the age of 14, please do not provide us with any personal data without the consent of your parents or guardians.

10. ACCEPTANCE AND CONSENT

The User declares that they have been informed of the conditions regarding personal data protection and accepts the content of this Privacy Policy.

11. MANDATORY PROVISION OF DATA

The data requested in the forms is, in general, mandatory (unless otherwise specified in the required field) in order to fulfil the purposes for which it is being collected. Therefore, if you do not provide them or do not provide them correctly, your requests cannot be dealt with, without prejudice to your ability to freely view certain content on our website.

12. UPDATING THE PRIVACY POLICY

This Privacy Policy may be altered due to possible regulatory updates or guidelines from the AEPD. We reserve the right to modify it to adapt it to these criteria. In the event of significant changes, this will be communicated via the Website. In any case, please check regularly for the latest version of the Privacy Policy.

Last update: 26/02/2026