DATA SUBJECTS: Private clients, employees, professionals and company representatives
PROCESSING ACTIVITIES
What personal data processing do we carry out?
In compliance with Regulation (EU) 2016/679 and the Organic Law on Personal Data Protection, we inform you that your personal data may be subject to the following processing activities:
- TR04 – Advertising campaigns *(Legal basis: General Advertising Law 34/1988 of 11 November)*
- TR08 – Gathering data subjects’ opinions (Legal basis: GDPR and Spanish Data Protection Act)
- TR03 – Internal staff recruitment *(Legal basis: Royal Legislative Decree 3/2015 of 23 October – Employment Act)*
- TG01 – In-house accounting management *(Legal basis: Royal Decree 1514/2007 of 16 November – General Accounting Plan)*
- TG25 – Tax data collection *(Legal basis: General Tax Law 58/2003 of 17 December)*
- TG12 – HR management data collection *(Legal basis: Royal Legislative Decree 1/1994 of 20 June – Social Security Act)*
- TR09 – Software security measures (Legal basis: GDPR and Spanish Data Protection Act)
- TE08 – Personal Data Protection *(Legal basis: GDPR and Organic Law 3/2018)*
- TE02 – Workplace risk prevention *(Legal basis: Workplace Risk Prevention Law 31/1995 of 8 November)*
- TE07 – Document destruction (Legal basis: GDPR)
- TV01 – Sales/service provision (Legal basis: Commercial and Tax Legislation)
- TE03 – Parcel delivery services (Legal basis: Commercial Code Royal Decree of 22 August 1885)
- TR05 – Email communications (Legal basis: Commercial Code)
- TR01 – Information requests (Legal basis: Commercial Code)
- TR07 – Security incident management (Legal basis: GDPR and Spanish Data Protection Act)
- TE04 – Legal case management (Legal basis: Commercial and Labour Legislation)
- TE01 – IT system maintenance (Legal basis: Commercial Code)
DATA CONTROLLER
Who are we?
We are the data controller for your information. We hereby expressly, precisely and unequivocally inform both data subjects and competent authorities of the following details regarding the controller.
PURPOSES
Why do we process your personal data?
We only process your personal data for the following purposes:
- Verify implementation of necessary technical measures for proper personal data management
- Send commercial/advertising information via email
- Manage information requests about our products/services
- Handle internal GDPR compliance incidents
- Conduct advertising campaigns for our services/products
- Gather data subjects’ opinions
- Recruit staff for vacant positions
- Comply with Workplace Risk Prevention Law requirements
- Manage parcel and mail deliveries
- Address legal matters affecting the company
- Maintain and repair IT storage systems
- Conduct internal HR management
- Perform fiscal and accounting management
- Comply with data retention limitation principles
- Fulfil GDPR and Organic Law 3/2018 requirements
- Administer private client accounts
- Execute contracted sales/service provision
Commercial or user profiles may be created based on provided/obtained information. We expressly confirm we never create profiles using minors’ data.
Your personal data will be retained while our contractual relationship exists or until you exercise your right to object/withdraw consent (via our website or email to the address provided in the Controller section).
LEGAL BASIS
Why are we permitted to process your data?
We process your data based on:
- Your explicit, informed consent (where legally required)
- Our legal obligations as controller
- Execution of service contracts you’ve entered
- Legitimate interests (following proportionality assessments between our interests and your rights, with implemented safeguards)
For queries, contact us via the email provided in the Controller section.
RECIPIENTS
Who might we share your data with?
Your data may be disclosed to:
- Spanish Tax Agency
- State Employment Service
- Social Security Treasury
- Spanish Data Protection Agency
- Banks/Savings Banks
No international transfers to third countries/organisations will occur.
DATA SOURCES
What data do we process and how is it obtained?
Your data will be included in our organisation’s following registers:
[Full list of registers maintained as per original]
Data originates from:
- The data subject themselves
YOUR RIGHTS
What rights can you exercise?
You’re guaranteed the following rights regarding your personal data:
- Confirmation of whether we process your data
- Access to your data (including processing purposes, categories, recipients, retention periods, origins and any profiling)
- Rectification of inaccurate data
- Objection to processing (unless compelling legitimate grounds override)
- Erasure when data is no longer necessary
- Data portability (for automated processing based on contract/consent)
- Restriction of processing in specific circumstances
- Objection to automated decision-making/profiling
These rights may be exercised free of charge via signed written request to our contact details.
You may also:
- Lodge complaints with the Spanish Data Protection Agency (www.agpd.es) or relevant supervisory authority
- Seek judicial redress for compensation
- Withdraw consent as easily as given (via our website or controller’s email)
We implement security measures to mitigate risks, regularly reviewing their effectiveness. Our control system ensures compliance with data protection principles (purpose limitation, storage limitation, data minimisation, integrity and confidentiality).
You may periodically receive surveys about our data processing to help us maintain transparency and accuracy.
For further enquiries, contact us via the email provided in the Controller section.