In terms of data protection, ORANGE ANDALUSIA INVESTMENTS S.L. should be considered responsible for the processing, in relation to the files/processing identified in this policy, specifically in the section Data processing.
Data identifying the owner of this website:
Company name: ORANGE ANDALUSIA INVESTMENTS S.L. NIF: B21530068 Address: Paseo de las Cumbres, s/n, 21449-ISLANTILLA-LEPE-HUELVA Telephone: 959873344 Email: firstname.lastname@example.org DPO data: email@example.com
The personal data requested, where appropriate, will consist only of those strictly necessary to identify and respond to the request made by the holder of the same, hereinafter the Interested Party. On the other hand, personal data will be collected for specific, explicit and legitimate purposes and will not be further processed in a way that is incompatible with such purposes.
The data collected from each interested party will be adequate, relevant and not excessive in relation to the corresponding purposes for each case, and will be updated whenever necessary.
The owner of the data will be informed, prior to the collection of their data, of the general points in this policy so that they can give their express, precise and unequivocal consent to the processing of their data, in accordance with the following aspects.
Purposes of the treatment
The explicit purposes for which each of the processing operations is carried out are set out in the information clauses incorporated into each of the data collection channels (web forms, paper forms, voiceovers or posters and information notes).
Nevertheless, the personal data of the interested party will be treated with the exclusive purpose of providing an effective response and attending to the requests made by the user, specified together with the option, service, form or system of data collection used by the owner.
As a general rule, prior to the processing of personal data, ORANGE ANDALUSIA INVESTMENTS S.L. obtains the express and unequivocal consent of the owner of the data, through the incorporation of informed consent clauses in the different information collection systems.
However, if the consent of the interested party is not required, the basis of legitimacy of the treatment in which ORANGE ANDALUSIA INVESTMENTS S.L. is protected is the existence of a specific law or regulation that authorizes or requires the treatment of the data of the interested party.
As a general rule, ORANGE ANDALUSIA INVESTMENTS S.L. does not proceed to the transfer or communication of data to third parties, except as required by law. However, if necessary, such transfers or communications of data are informed to the interested party through informed consent clauses contained in the different ways of collecting personal data.
As a general rule, personal data is always collected directly from the data subject, however, in certain exceptions, data may be collected through third parties, entities or services other than the data subject. In this regard, this will be conveyed to the data subject through the informed consent clauses contained in the different information collection channels and within a reasonable period of time, once the data has been obtained, and at the latest within one month.
The information collected from the interested party will be kept as long as it is necessary to comply with the purpose for which the personal data was collected, so that, once the purpose has been fulfilled, the data will be cancelled. Such cancellation will result in the blocking of the data and will be kept only at the disposal of the Public Administrations, Judges and Courts, in order to deal with any possible liabilities arising from the processing, during the period of limitation of the latter. Once the aforementioned period has expired, the information will be destroyed.
For information purposes, below are the legal deadlines for the conservation of information in relation to the different matters:
DOCUMENT: Documentation of a labour or social security nature
TERM: 4 years
REF. LEGAL: Article 21 of the Royal Legislative Decree 5/2000, of 4 August, which approves the revised text of the Law on Infractions and Penalties in Social Order.
DOCUMENT: Accounting and tax documentation for commercial purposes
TERM: 6 years
REF. LEGAL: Art. 30 Commercial Code
DOCUMENT: Accounting and tax documentation for tax purposes
TERM: 4 years
REF. LEGAL: Articles 66 to 70 General Tax Law
DOCUMENT: Building access control
TERM: 1 month
REF. LEGAL: Instruction 1/1996 of the AEPD
DOCUMENT: Video surveillance
TERM: 1 month
REF. LEGAL: Instruction 1/2006 of the AEPD Organic Law 4/1997
Rights of the interested parties
Data protection regulations grant a series of rights to interested parties or data owners, website users or users of ORANGE ANDALUSIA INVESTMENTS S.L. social network profiles.
These rights that assist the interested parties are the following:
– Right of access: the right to obtain information on whether their own data is being processed, the purpose of the processing being carried out, the categories of data concerned, the recipients or categories of recipients, the period of conservation and the origin of such data.
– Right of rectification: right to obtain the rectification of inaccurate personal data or incomplete.
– Right of deletion: right to obtain the deletion of data in the following cases:
- When the data is no longer necessary for the purpose for which it was collected
- When the data subject withdraws consent
- When the data subject opposes the processing
- When they must be deleted in compliance with a legal obligation
- When the data has been obtained by virtue of an information society service in accordance with Article 8, paragraph 1 of the European Data Protection Regulation.
– Right to object: right to object to a certain processing operation based on the consent of the data subject.
– Right of limitation: the right to obtain limitation of the processing of the data when it is one of the following cases:
- When the person concerned contests the accuracy of the personal data, for a period of time.
- Where the processing is unlawful and the data subject opposes the deletion of the data.
- Where the data subject no longer needs the data for the purpose for which it was collected, but the data subject needs them for the formulation, exercise or defence of a claim.
- Where the data subject has opposed the processing while it is verified whether the grounds the legitimate interests of the company take precedence over those of the person concerned.
– Right to portability: right to obtain data in a structured form, to be used and machine-readable, and to pass them on to another controller when:
- The processing is based on consent.
- The processing is carried out by automated means.
– The right to lodge a complaint with the competent supervisory authority.
Data subjects may exercise the above rights by contacting ORANGE ANDALUSIA INVESTMENTS S.L. by writing to the following address: firstname.lastname@example.org, indicating in the Subject line the right they wish to exercise.
In this sense, ORANGE ANDALUSIA INVESTMENTS S.L. will attend to your request as soon as possible and taking into account the deadlines set out in the regulations on data protection.
The security measures adopted by ORANGE ANDALUSIA INVESTMENTS S.L. are those required, in accordance with Article 32 of the RGPD. In this sense, ORANGE ANDALUSIA INVESTMENTS S.L., taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the processing, as well as the risks of variable probability and severity for the rights and freedoms of individuals, has established the appropriate technical and organizational measures to ensure the level of security appropriate to the existing risk.
In any case, ORANGE ANDALUSIA INVESTMENTS S.L. has implemented sufficient mechanisms to
- a) To guarantee the confidentiality, integrity, availability and permanent resilience of processing systems and services.
- b) Restore the availability and access to personal data in a timely manner, in case of technical or physical incident.
- c) Verify, evaluate and assess the effectiveness of technical and organisational measures implemented to guarantee the security of the processing.
- d) Pseudonymize and encrypt personal data, when appropriate.