Privacy pOLICY

1. Who We Are

This Privacy Policy explains how Hollow Rock collects, uses and protects
your personal data when you visit www.hollow-rock.gi, apply for a job, subscribe to our newsletter or contact us.

We are the data controller responsible for your personal data. You can reach us at:

• Company: Hollow Rock
• Address: 94 Devil's Tower Rd, Gibraltar GX11 1AA
• Email: hiring@hollow-rock.com

We process personal data in line with the EU General Data Protection Regulation (GDPR)
and applicable local data protection laws.

2. Information We Collect

We only collect the personal data we need for the purposes described in this policy.

Information you give us

• Contact enquiries: name, email address, phone number and the content of your message.
• Newsletter sign-up: email address and, if provided, your name and preferences.
• Job applications: first and last name, email address, phone number, location, availability, the position you apply for, your message and your CV or resume, plus any other information you choose to include.

Information collected automatically

• Device and usage data: IP address, browser type, device type, operating system, pages visited, time spent on pages and referring website.
• Cookies and similar technologies: see Section 4.

Please do not include sensitive information (for example health data, religious beliefs or political opinions) in your CV or messages unless it is strictly necessary.

3. How We Use Your Information

We use your personal data only for the purposes below, each with a legal basis under the GDPR.

• Responding to your enquiries – based on our legitimate interests and on taking steps at your request before entering into a contract.
• Assessing job applications and contacting candidates – based on taking steps before entering into an employment contract and on our legitimate interests.
• Sending newsletters and marketing emails – based on your consent.
• Analysing Website use to improve it – based on your consent to analytics cookies.
• Showing relevant advertising – based on your consent to marketing cookies.
• Keeping the Website secure and working – based on our legitimate interests.
• Meeting legal and regulatory obligations – based on our legal obligations.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew. We do not use your data for automated decision-making that has legal or similarly significant effects on you.

4. Cookies and Similar Technologies

Cookies are small text files stored on your device when you visit a website. We place only strictly necessary cookies by default; all others require your consent through our cookie banner.

• Necessary cookies keep the Website working and secure and remember your cookie choices. They do not require your consent.
• Analytics cookies help us understand how visitors use the Website, using aggregated statistics. They are only used with your consent.
• Marketing cookies let us and our advertising partners show relevant ads and measure campaigns. They are only used with your consent.

Analytics and marketing cookies are switched off until you opt in. You can change or withdraw your consent at any time via the "Cookie settings" link in the Website footer, or by deleting cookies in your browser settings.

5. Sharing Your Information

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf and under written agreements, such as:

• Website hosting and forms: [e.g. Webflow], which hosts the Website and receives form submissions.
• Email and newsletter services: [e.g. Brevo], which sends our newsletters and emails.
• Analytics and advertising providers: [e.g. Google, Meta], only if you have consented to the relevant cookies.
• Professional advisers and authorities: where required by law or to protect our legal rights.

Some providers may store or process data outside the European Economic Area (EEA). Where this happens, we make sure appropriate safeguards are in place, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

6. How Long We Keep Your Data

We keep personal data only as long as needed for the purpose it was collected for.

• Job applications and CVs (unsuccessful candidates): [6 months] after the recruitment process ends, unless you agree to a longer period.
• Contact enquiries: [12 months] after our last correspondence.
• Newsletter data: until you unsubscribe.
• Analytics data: [14 months].

7. How We Protect Your Data

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls and trusted providers. No method of transmission over the internet is completely secure, but we work to protect your information.

8. Your Rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten").
• Restrict or object to certain processing, including direct marketing.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Complain to your local data protection authority.

To exercise any of these rights, email us at [privacy@example.com]. We will respond within one month.

9. Children's Privacy

The Website is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page with the date of the last update.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, contact us
at hiring@hollow-rock.com or let’s meet in our office on Casemates Square, 1st floor,
Gibraltar Distillery Co.