In compliance with the regulations in force on data protection, (EU) Regulation 2016/679 of the European Parliament and the Council dated 27th April 2016 (GDPR) and the Organic Law on Data Protection and Digital Rights Guarantee (LOPDGDD, Law 3/2018, 5th December), we inform you about the Personal Data Protection Policy, with regard to personal data processing, which is the one detailed below.
Personal Data Controller
The data controller is the legal entity that determines the purposes and means for personal data processing. In other words, the controller decides how and with what purpose personal data are processed.
For the purposes of this Data Protection Policy, the personal data controller is:
- Identity: Asociación DIH DATALIFE – HUB DE INNOVACIÓN DIXITAL DATALIFE – Fiscal Identity Number: G70603063
- Address: Avenida do Mestre Mateo, 2, Edificio EMPRENDIA, sito no Campus Vida en Santiago de Compostela (A Coruña)
- Contact telephone: (+34) 604 085 297
- Contact e-mail: info@dihdatalife.com
What personal data do we process and how do we protect them?
Personal data is all information about an identified or identifiable natural person.
For the purposes established in this Privacy Policy, the controller collects and processes personal data explained on each type of processing, and which will depend on the different services requested or on the contractual relationship kept with our entity.
Our organisation undertakes to process with an absolute confidentiality and to apply suitable security measures, of a physical, technical and organizational type, for the protection of your personal data.
You guarantee and are responsible, in any case, for the veracity, accuracy and authenticity of the provided personal data and for their being in force, and undertake to keep them duly updated.
Processing of “Employee” Data
- What type of personal data do we process?
- Identity data: name, National Identity Card, date of birth, address, telephone, e-mail address, signature, image.
- Personal characteristics data: sex, marital status, nationality, age, date and place of birth and family data.
- Social circumstances data: licences and permits.
- Economic-financial data: bank account, payroll data, tax deductions, other withholdings (where applicable).
- Academic and professional data: profession, position, experience, qualifications.
- Data to control presence.
- With what purpose do we process your personal data?
We process personal data you provide us with for managing the labour relationship, payrolls, for administrative and payment management, for the compliance with tax and labour obligations of the company, for accesses control, for the management of training and professional development, and for labour risk prevention.
Personal data provided will be kept while the labour relationship continues. If after the labour relationship has ended you decide to cancel your personal data, they will be kept until the expiration of the legal terms defined by accounting, tax and labour regulations, and when these terms have elapsed, your data will be deleted from our system.
- What is the legitimation for the processing of your data?
The legal base for processing your data is compliance with a labour contract, together with compliance with a legal obligation of the controller.
- To what addressees will your data be communicated?
Your personal data will not be assigned to any entity, except for the ones that are necessary, to public bodies and due to a legal obligation.
Your data may be processed on our own account by the tax and labour consultancy.
International personal data transfers have also not been foreseen.
Processing of “Employment Candidates” Data
- What type of personal data do we process?
- Identity data: name, National Identity Card, date of birth, address, telephone, e-mail address and image.
- Personal characteristics data: sex, nationality, age, date and place of birth.
- Academic and professional data: profession, position, experience, qualifications.
- Social circumstances data, like hobbies.
- With what purpose do we process your personal data?
We process personal data you provide us with for the management of recruitment processes of our organisation.
Personal data provided will be kept while the data subject has not withdrawn consent to continue keeping his/her curriculum vitae for future recruitment processes, for a maximum term of 1 year. If you decide to cancel your personal data, they will be deleted of our database of employment candidates.
- What is the legitimation for the processing of your data?
The legal base for processing your data is the express consent requested.
- To what addressees will your data be communicated?
Your personal data will not be assigned to any entity.
Your data may be processed on our own account by the employment agency.
International personal data transfers have also not been foreseen.
Processing of “Client and Supplier” Data
- What type of personal data do we process?
- Identity data: name, National Identity Card, address, telephone, e-mail address and nationality.
- Financial data: bank account, credits, bank guarantees, insurances and taxes.
- Academic and professional data: profession, position, experience, qualifications.
- Data about transactions: supplied products and services.
- Data about commercial information: activities and businesses, licences.
- With what purpose do we process your personal data?
The purpose of the processing is data management of company clients and suppliers, to keep the commercial relationship, for accounting, administrative and invoicing management, and for the management of tax obligations.
The purposes of advertising and commercial research have also been foreseen, and for these, the express consent of the data subject is requested.
Personal data provided will be kept while the commercial relationship continues. If you decide to cancel your personal data, these may be kept in our databases during terms foreseen by legislation to be able to comply with tax and accounting obligations, and they will be deleted once the legal terms have expired, or the terms that are applicable. As a general rule, the expiration term will be 5 years.
- What is the legitimation for the processing of your data?
The legal base for processing your data is the execution of a contract, and the compliance with a legal obligation of the controller.
The communication of offers and promotions which might interest you is based on the express consent requested to you.
- To what addressees will your data be communicated?
Your personal data will not be assigned to any entity, except for the ones that are necessary, to public bodies and due to a legal obligation, for example the Tax Agency (tax data and withholdings).
Your data may be processed on our own account by the tax and labour consultancy, and by the entity rendering legal services to our company.
International personal data transfers have also not been foreseen.
Processing of “Contact and Potential Client” Data
- What type of personal data do we process?
- Identity data: name, telephone and e-mail address.
- With what purpose do we process your personal data?
We process the personal data you provide us with in the contact form for managing data of commercial contacts and potential clients.
The purposes of advertising and commercial research have also been foreseen, and for these, the express consent of the data subject is requested.
Personal data provided will be kept while the commercial relationship continues. If you decide to cancel your personal data, they will be deleted of our contact database.
- What is the legitimation for the processing of your data?
The legal base for processing your data is the express consent requested from you.
- To what addressees will your data be communicated?
Your personal data will not be assigned to any entity.
Your data may be processed on our own account by the web hosting company.
International personal data transfers have also not been foreseen.
Processing of “DIH Associates” Data
- What type of personal data do we process?
- Identity data: name, National Identity Card, address, telephone and e-mail address.
- Professional data: profession and position.
- With what purpose do we process your personal data?
The purpose of the processing is keeping a registry of associates and members of governing bodies, with the purpose of complying with the provisions of the Articles of Association (collection of fees, exercise of rights resulting from the condition of associate, notice of meetings, communication to Administration about the members of the Governing Board, etc…).
Personal data provided will be kept while the associate relationship continues. If you decide to cancel your personal data, these can be kept in our databases for the terms foreseen by legislation in order to be able to comply with obligations with regard to registry of associations, and will be deleted once the legal terms have expired, or those which are applicable, and this will take place, as a general rule, after 4 years.
- What is the legitimation for the processing of your data?
The legal base for processing your data is the execution of a contract, and the compliance with a legal obligation of the controller arising from Organic Law 1/2000 regulating the right of association.
- To what addressees will your data be communicated?
Your data will be communicated to the General Administration of the Galician Autonomous Community, pursuant to data communication obligations established in Organic Law 1/2000, and in the Regulation governing the registration of associations.
Your personal data will not be assigned to any entity, except for the ones that are necessary, to public bodies and due to a legal obligation.
Your data may be processed on our own account by the tax and labour consultancy, and by the entity rendering legal services to our company.
International personal data transfers have also not been foreseen.
What are your rights when you provide us with your data?
In accordance with applicable regulations on data protection, you have some rights with regard to the processing of your personal data. The exercise of these rights will be free for you, except for the cases when clearly unfounded or excessive requests are made, especially repetitive ones.
These rights are the following:
- Information right: You are entitled to be informed in a clear, transparent and intelligible way, easily accessible, with a clear and simple language, about the use and processing of your personal data.
- Access right: You are entitled to request from us at any time that we confirm you if we are processing your personal data, to request from us that we provide access to the same, to the information about their processing, and to obtain a copy of those data. The copy of your personal data provided by us will be free, but the request of additional copies can be subject to collection of a reasonable amount based on administrative costs. As for us, we can request from you a proof of your identity, or require from you more information necessary to handle your request.
- Rectification right: You are entitled to request rectification of inaccurate personal data, not updated or not complete and concerning you. You can also request completion of incomplete personal data, including an additional statement.
- Deletion right:You are entitled to request deletion of your personal data when, among other reasons, data are no longer necessary for the purposes for which they were collected. However, this right is not absolute, so our organisation can continue keeping them duly blocked in the cases foreseen by applicable regulations.
- Right to restrict processing: You are entitled to request that we restrict processing of your personal data, and this means we may continue keeping them, but we cannot continue processing them if any of these conditions are met:
- That you object to the accuracy of the data, for a term allowing the controller to verify the accuracy of the same;
- Processing is unlawful and you oppose to data deletion, and instead request restriction of their use;
- Our entity no longer needs data for the purposes of the processing, but you need them to file, exercise or defend claims;
- You have opposed to processing, while it is verified if legitimate reasons of our entity prevail over yours.
- Right to data portability:You are entitled to the fact that your data are transferred to another data controller in a structured format, of a common use and machine readable. This right is applied when processing of your personal data is based on consent or in the execution of a contract, and the processing is carried out by automated means.
- Right to object: This right allows you to object to the processing of your personal data, including profiling. We cannot meet your right only when we process your data if we prove legitimate reasons for the processing, or for filing, exercising or defending claims.
- Right not to be subject to automated decisions, including profiling: This right allows you not to be the subject of a decision only based on automated processing, including profiling, producing –those decisions- legal effects or affecting you in a similar way. Except when that decision is necessary for entering into or executing a contract, or is authorised by a law, or is based on consent.
- Right to withdraw consent: In cases in which we have obtained your consent for processing your personal data with regard to certain activities (for example, in order to send you commercial communications), you can withdraw it at any time. In this way, we will stop carrying out that specific activity for which you had given your prior consent, except when there is another reason justifying continuity of the processing of your data for these purposes, in which case, we will notify you that situation.
- Right to file a claim before a control authority: You are entitled to file a claim before the Spanish Data Protection Agency, C/ Jorge Juan, 6, 28001 Madrid, 901 100 099 – 912 663 517 (www.agpd.es), or in the electronic address: https://sedeagpd.gob.es/sede-electronica-web/vistas/formQuejasSugerencias/seleccionarQuejaSugerencia.jsf
You can exercise the rights indicated before, sending us a communication to the physical address or to the electronic address indicated at the beginning of the document, attaching a document proving your identity, and providing the details necessary to process your request.
Data subjects can obtain additional information on their rights in the web page of the Spanish Data Protection Agency, www.agpd.es.
In accordance with the provisions of article 23 of Organic Law 3/2018, 5th December, on Personal Data Protection and digital rights guarantee (LOPDGDD), we inform you that you can restrict non desired advertising, registering your data freely and voluntarily in an advertising exclusion file. Currently, we only have the file called Robinson List, managed by the Spanish Association of Digital Economy (ADIGITAL).
The Robinson List must be consulted by those who are going to carry out an advertising campaign to exclude registered people from the same. However, even when you have registered in the Robinson List, traders can send you advertisements of their products or services if you are a client or if you have given your consent.
When you register in the Robinson List you can choose the communication media or channels through which you do not wish to receive advertisements (post, telephone calls, e-mail or other media). You must take into account that registration in the Robinson List is effective from the third month from the date in which you register your data; therefore, it is possible for you to continue receiving commercial communications within that term.
You can consult the systems for excluding advertisements in the web page of the Spanish Data Protection Agency: https://www.aepd.es/areas/publicidad/index.html.
Finally, if you wish to register in the Robinson List, you can do it using this link: https://www.listarobinson.es/
