July 1, 2026 - 3-minute read.
Description of our policies
There's no fine print here—just plain text.
Privacy Policy
Privacy Policy
Within the framework of the service agreement, Almaglobal S.L.U will process the personal data provided to it in accordance with the provisions of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data, and repealing Directive 95/46/EC (hereinafter,the “GDPR”), and Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (hereinafter,the “LSSI”).
This privacy policy applies to the processing of personal data of users who browse the website https://www.dokify.net/(the“Website”) and to users of the platform known as “Dokify,” operated by Almaglobal S.L.U. (the“Platform”).
1. Data Controller
| Headline | Almaglobal S.L.U. (hereinafter, "AlmaGlobal") |
| Registered Office | CALLE PROCIÓN, NO. 7, ENTRANCE 4, FLOOR HIJ 28023 MADRID - (MADRID) |
| Tax ID Number | B86311693 |
| Public Registry | Registered in the Madrid Commercial Registry, Volume: 29387, Book: 0, Folio: 99, Section: 8, Page: M 528963, Entry or annotation: 1 / Date: 11/25/2011 |
| Phone and Fax | 918 38 80 49 |
| dpo.nalanda@onceforall.com |
2. Purposes and basis of processing
All data provided by our customers, employees, job applicants, Website users, and Platform users will be processed in accordance with the provisions of applicable personal data protection regulations.
Before providing any personal information, the data subject must have carefully read and understood this Privacy Policy. By accepting this Privacy Policy, you warrant that the personal information provided to AlmaGlobal is accurate, truthful, and up-to-date.
The personal data collected will be processed for the following purposes and on the basis of the following legal grounds:
| Purpose | Categories of personal data | Basis of legitimization |
|---|---|---|
| 1. Contract Management and Oversight | ||
Establishment, implementation, development, maintenance, management, and oversight of the contractual relationship, including:
|
Identifying and contact information: first and last names, email addresses, and phone numbers of customers, users, their representatives, and employees. Registered usernames and login credentials for the Platform. Payment information. |
Article 6.1.b) of the GDPR: entering into, executing, carrying out, maintaining, managing, and monitoring the contractual relationship with AlmaGlobal. |
| 2. Application Management | ||
| Evaluation and management of applications for professional positions in recruitment processes. | Identifying and contact information: users' first and last names and phone numbers Professional information, including a resume. |
Article 6.1.b) of the GDPR: implementation of precontractual measures. |
| 3. Employee Portal | ||
| Employee Portal Management. | Identifying and contact information: employees’ first and last names, email addresses, ID numbers, and phone numbers. Registered usernames and login credentials for the Platform. |
Article 6.1.b) of the GDPR: entering into, executing, carrying out, maintaining, managing, and monitoring the contractual relationship with AlmaGlobal. |
| 4. Contact Form, Contact Email, and Social Media | ||
| Managing and responding to inquiries submitted by users via email, contact forms, and social media. | Identifying and contact information: first and last name, phone number, email address, and social media username. Information related to the user’s inquiry. |
Article 6.1.b) of the GDPR: management, oversight, and fulfillment of the contractual relationship between the user and AlmaGlobal. Article 6.1.a) of the GDPR: user consent. |
| 5. Website Security and Operation, and Use of Cookies | ||
| Managing the normal use of the Website and conducting statistical analyses of its use and performance to improve its quality. | Browsing data and IP address. | Article 6.1.f) of the GDPR: AlmaGlobal’s legitimate interest in analyzing the use and performance of the Website in order to improve it. |
| Ensure the website's IT security; develop, prepare, and conduct tests with the primary goal of improving the site and identifying errors and anomalies. | Browsing data and IP address. | Article 6.1.f) of the GDPR: AlmaGlobal’s legitimate interest in ensuring the security of the Website, improving it, and identifying errors and anomalies. |
| Management of various cookies that are not strictly technical. | Navigation data. | Article 6.1.a) of the GDPR: user consent. |
| 6. Sending Commercial Communications | ||
| Sending commercial communications containing information about AlmaGlobal's products and services, as well as events and activities organized by AlmaGlobal and other companies within the AlmaGlobal group. | Identifying and contact information: users' first and last names, email addresses, and phone numbers. | Article 6.1.f) of the GDPR: AlmaGlobal’s legitimate interest in sending marketing communications regarding products or services similar to those contracted by the customer. Users may exercise their right to object, in accordance with the terms set forth in this privacy policy. Article 6.1.a) of the GDPR: the user’s consent to receive marketing communications. |
| Sending commercial communications about the products and services of third parties with which AlmaGlobal and its business group have partnership agreements. | Identifying and contact information: users' first and last names, email addresses, and phone numbers. | Article 6.1.a) of the GDPR: user consent to receive marketing communications. |
| 7. Legal Obligations | ||
| AlmaGlobal's Compliance with Legal Obligations. | Identifying and contact information: first and last names, email address, phone number, and any other personal data of the data subjects required by the competent public authorities within the scope of their powers. Payment information. Billing information. |
Article 6.1.c) of the GDPR: compliance with AlmaGlobal’s legal obligations. |
| 8. Photos and Videos | ||
| The publication of photographs and videos on the Website for promotional and advertising purposes. | Photos and videos of interested parties. | Article 6.1.a) of the GDPR: consent of the data subject to the collection and subsequent publication of photographs and videos. |
| 9. Exercising Data Protection Rights | ||
| Managing the exercise of data subjects' rights and ensuring compliance with legal obligations regarding data protection. | Identifying and contact information: first and last names, email address, ID number, and phone number Personal data identified in the exercise of your rights. |
Article 6.1.c) of the GDPR: compliance with AlmaGlobal’s legal obligations. |
The personal data listed will be included in the personal data processing activity log, which is created and maintained under the responsibility of AlmaGlobal. Our policy is not to create profiles of users of our services.
3. Transfers and communications of personal data
Your personal data may be shared with companies within the AlmaGlobal group. In this regard, AlmaGlobal is part of the Nalanda Global group of companies and is also affiliated with Once For All Ltd.
Notwithstanding the foregoing, we do not disclose your personal data to anyone, except for those public or private entities to which we are required to provide your personal data in order to comply with the law. For example, tax law requires us to provide the Tax Agency with certain information regarding financial transactions that exceed a specific amount.
In addition, AlmaGlobal’s data processors—that is, service providers contracted by AlmaGlobal who need access to personal data in order to perform their duties—may have access to such data.
In the event that, apart from the cases mentioned above, we need to disclose your personal information to other entities, we will ask for your prior permission through clear options that will allow you to decide in this respect.
4. International data transfers
Within the scope of the processing activities set forth above, personal data may be transferred to other countries, including those outside the European Economic Area (EEA) (i.e., European Union member states, along with Norway, Iceland, and Liechtenstein), which may have data protection standards that differ from those of your country of residence.
Please note that data processed in a foreign country may be subject to foreign laws and may be accessible to foreign governments, courts, law enforcement agencies, and regulatory agencies.
In the case of a transfer to a country outside the EEA, this transfer is protected by one of the following: (i) standard contractual clauses or (ii) an adequacy decision.
5. Conservation
Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, or, where applicable, until the data subject exercises their right to object to the processing. Once this period has elapsed, the data will be blocked from further use and will remain available solely for the purpose of addressing judicial, administrative, or tax claims, for the period specified by the applicable regulations in each case.
Subsequently, the customer may request the complete deletion of their information. In that case, the data will no longer be accessible. To process this request, please contact our Data Protection Officer via email at dpo.nalanda@onceforall.com.
For greater clarity, in accordance with the principle of data retention limits, we reserve the right to retain the data and documentation for the duration of the contractual relationship or for as long as necessary for the specific purposes for which they were collected, and subsequently to comply with the legal obligations and responsibilities arising from such processing, in accordance with applicable regulations. This includes preparing for potential inspections; therefore, we agree to retain the data for a subsequent prudential period.
The specific retention periods are as follows:
- Customer and user data will be retained for the duration of the contractual relationship and for a period of six (6) years following its termination, for any reason (e.g., Article 30.1 of the Commercial Code). Data relevant for the purposes of preventing money laundering will be retained for a period of ten (10) years (e.g., Article 25 of Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing).
- Data on potential customers will be retained for a period of two (2) years.
- Candidate data will be retained in accordance with Nalanda’s Privacy Policy for Recruitment and Employer Branding.
- The personal data of users who have given their consent to receive marketing communications will be retained until the user revokes that consent.
All Customers and Users are hereby informed that Almaglobal has a data retention policy, which is publicly available through its Trust Center on the corporate website. In the event of any discrepancy, contradiction, or outdated information between this Privacy Policy and the data retention policy published in the Trust Center, the most recent version of said data retention policy available in the Trust Center shall prevail with respect to the retention periods applicable in Spain.
6. Security
In order to guarantee the security of the data managed, measures have been implemented to ensure the confidentiality, integrity and availability of the same. Specific security levels have been adopted for the protection of personal data, and both technical and organizational means have been implemented to prevent the loss, misuse, alteration, unauthorized access and theft of personal data provided through the Web Platform.
AlmaGlobal is ISO/IEC 27001:2022 certified, which attests to its compliance with the requirements related to Information Security Management Systems (ISMS), as well as certified for compliance with the National Security Scheme (ENS) and the specific NIS2 compliance profile.
For more information about the Nalanda Group's security policies, please refer to our Information Security Policy and Guidelines, available at the following link: Information Security Policy and Guidelines.
7. Your Rights
We inform you that you may exercise the following rights:
A - The right to access your personal data, to find out which data are being processed and the processing operations carried out on them.
B - Right to correct any inaccurate personal data.
C - The right to have your personal data erased when, among other reasons, such data is no longer necessary for the purposes for which it was collected, or when there is a legal requirement permitting its erasure. If the data cannot be erased for legal reasons, it will be blocked and retained for as long as necessary to comply with applicable legal obligations.
D - Right to restrict the processing of your personal data when the accuracy, lawfulness, or necessity of the data processing is in question; in such cases, we may retain the data for the purpose of asserting or defending legal claims.
E - The right to object to the processing of your personal data; in such cases, we would cease processing your data unless we are required to continue doing so to fulfill our contractual or legal obligations, for compelling legitimate reasons, or to exercise or defend against potential claims.
F - The right to data portability, in a structured, commonly used, and machine-readable format, as well as the right to have your data transmitted by AlmaGlobal to another data controller.
G - Right to Revoke Consent Granted to AlmaGlobal
We would also like to remind you that you have the right to withdraw any consent you may have given for the processing of your data, without this affecting the lawfulness of the processing based on consent prior to its withdrawal.
AlmaGlobal informs you that you may exercise your rights regarding your personal data by sending a written request to NALANDA GLOBAL, S.A. (at the mailing address Calle Proción, 7—Edificio América II, Portal 4, 2nd Floor, Apartment I, 28023, or by email to dpo.nalanda@onceforall.com), providing proof of your identity.
AlmaGlobal will provide you with the requested information within a maximum of 1 month from the date of receipt of the request. Please note that this period may be extended by an additional 2 months, depending on the complexity and number of requests.
Finally, we would like to inform you that you may file a complaint with the competent data protection supervisory authority, which in Spain is the Spanish Data Protection Agency (www.aepd.es). However, before doing so, you may contact the Data Protection Officer, who will resolve the complaint within a maximum of two months.
8. Updates
AlmaGlobal reserves the right to modify this policy to bring it into line with new legislation or case law that may affect compliance with it, providing timely notice when appropriate.
9. Third-Party Data
If a customer or user provides Almaglobal with personal data belonging to third parties, the customer and/or user expressly declares that the personal data is being provided with the express consent of the data subject and after having previously informed the data subject of the processing of their personal data.
10. Other Processing of Personal Data
Cookies and Similar Technologies:
You can access our Cookie Policy via the following link: https://www.dokify.net/legales/legales-cookies
11. Changes to This Policy and Which Version Prevails
We periodically review this Policy to ensure that it is up to date and accurate. We recommend that you check this page periodically to see if there are any updates or changes to our Policy.
In the case of Clients who have entered into a subcontracting agreement or a data processor agreement with Nalanda, such agreement shall take precedence over this Policy with respect to the processing of personal data carried out by Almaglobal on behalf of the Client, to the extent that there is any discrepancy, contradiction, or incompatibility between the two.
AlmaGlobal S.L.U ©, Last updated: June 2026
12. Change Log – Privacy Policy
| Version | Date | Major changes |
|---|---|---|
| Initial document | - | Updated document |
| V.2. | 01/07/2025 |
- Inclusion of Once For All Ltd. as part of the business group. - Update to the legal basis for the use of cookies (informed consent). - More detailed information on data retention (customers, users, employees, candidates, suppliers). - Reference to security certifications (ISO/IEC 27001:2003, ISO 9001:2015) and the Nalanda Group’s security policies. - Adjustments regarding international data transfers and applicable security measures. - Revision of the wording regarding commercial communications and consent. |
| V3 | July 1, 2026 |
Clarification of the precedence of the subcontracting or data processor agreement over the Policy in the event of a conflict.
Editing and legal consistency of the text |
Security policies