Privacy policy

Data subjects: Individual clients, employees, professionals and company representatives

Processing activities

What processing do we carry out with your personal data?

In compliance with Regulation (EU) 2016/679 and the Spanish Organic Law on Personal Data Protection, we inform you that your personal data may be subject to some of the following processing activities:

TR04 – Advertising campaigns (Legal basis: Law 34/1988, of 11 November, General Advertising Law.)
TR08 – Gathering the opinion of data subjects (Legal basis: Regulation (EU) 2016/679 on data protection and LOPD.)
TR03 – Recruitment of own staff (Legal basis: Royal Legislative Decree 3/2015, of 23 October, approving the consolidated text of the Employment Law.)
TG01 – Own accounting and bookkeeping, as data controller. (Legal basis: Royal Decree 1514/2007, of 16 November, regulating the General Accounting Plan.)
TG25 – Data collection for own tax management (Legal basis: Law 58/2003, of 17 December, General Tax Law.)
TG12 – Own employment management: data collection (Legal basis: Royal Legislative Decree 1/1994, of 20 June, approving the consolidated text of the General Social Security Law.)
TR09 – Assurance of technical and organisational measures in the software used (Legal basis: Regulation (EU) 2016/679 on data protection and LOPD.)
TE08 – Personal Data Protection (Legal basis: Regulation (EU) 2016/679 and Organic Law 3/2018.)
TE02 – Occupational risk prevention (Legal basis: Law 31/1995, of 8 November, on Occupational Risk Prevention.)
TE07 – Destruction of documents (Legal basis: Regulation (EU) 2016/679)
TV01 – Sales / Provision of Services (Legal basis: Commercial and Tax Legislation)
TE03 – Transport and/or parcel delivery service (Legal basis: Royal Decree of 22 August 1885 publishing the Commercial Code.)
TR05 – E-mails (Legal basis: Commercial Code and other applicable legislation.)
TR01 – Information requests received (Legal basis: Commercial Code and other commercial provisions.)
TR07 – Management of incidents and/or security breaches (Legal basis: Regulation (EU) 2016/679 on data protection and LOPD.)
TE04 – Management of own legal affairs (Legal basis: Applicable commercial and employment legislation.)
TE01 – Maintenance of IT systems (Legal basis: Commercial Code.)

Data controller

Who are we?

We are the controllers of the processing of your data. Accordingly, both data subjects and the competent authorities are expressly, precisely and unequivocally informed of the following aspects relating to the data controller:

PEREZ CAÑAVATE, JUAN PEDRO
39686346F
Calle Aragó, 23. IBIZA – 07800. ILLES BALEARS
DPO: FORMACIÓN Y CERTIFICACIÓN DE DELEGADOS DE PROTECCIÓN DE DATOS, S.L., NIF: B73982266(dpd@gruposmz.es)

Purposes

What do we use your personal data for?

In this organisation, we may process your personal data exclusively for the purposes set out below:

Checking that all the technical measures needed for the correct management of personal data with the software used are being carried out.
Sending commercial and/or advertising information by e-mail.
Managing requests for information received from the data subject about our products or services.
Exclusive management of internal incidents detected in complying with the requirements of the GDPR.
Running advertising campaigns to promote our services and/or products.
Gathering the opinion of data subjects.
Recruiting staff to fill the necessary job vacancies.
Complying with all the requirements of the Occupational Risk Prevention Law.
Sending parcels and correspondence.
Managing any legal matter affecting the company.
Managing, maintaining and repairing IT storage systems.
Actions to carry out our own employment management.
Actions to carry out our own tax and accounting management.
Complying with the principle of limiting the retention period of personal data.
Complying with the requirements of Regulation (EU) 2016/679 and Organic Law 3/2018.
Administrative management of individual clients.
Carrying out the sale or provision of the contracted service

A commercial or user profile may be created based on the information provided or obtained. You are expressly informed that profiles will never be created with the data of a minor.

The personal data you provide will be kept for as long as the contractual relationship lasts or, where applicable, until you exercise your right to object or withdraw the consent given. To do so, you can go to the corresponding section of our website or send an e-mail to the address indicated in the section on the data controller.

Legitimacy

Why do we use them? We are entitled to process your personal data for the following reasons:

Your unequivocal, informed and express consent, in those cases where it is legally required, without the withdrawal of such consent in any case conditioning the performance of other processing with a different legal basis, and without such withdrawal affecting the lawfulness of the processing carried out before it.
A legal obligation of the data controller.
The performance of the contract for the provision of services and/or the purchase and sale of the corresponding products, entered into by you.
The legal basis for processing your data is a legitimate interest of the data controller. This interest is based on a prior proportionality or balancing test between the legitimate interest of the controller and the interests or rights and freedoms of the data subjects. This balancing test involved assessing the interest, assessing the impact of the processing on the data subjects, weighing the two previous concepts and implementing additional safeguards. As the final balance is favourable to the controller, the processing may be carried out in accordance with the applicable personal data protection regulations.

For any questions or clarification, you can contact us through the e-mail address provided in the section on the data controller.

Recipients

Who may we share your personal data with?

Your personal data will be disclosed to the following companies and bodies:

Spanish Tax Agency (Agencia Tributaria)
State Public Employment Service
General Treasury of the Social Security
National Data Protection Agency
Banks and savings banks

Your personal data will not be transferred to any third country or international organisation.

Sources

What data do we process and how did we obtain it?

Your personal data will be included in the following files, owned by the organisation:

FG01 Own accounting management
FG02 Own employment management
FG15 Own tax management. Data collection
FE01 IT maintenance
FE02 Occupational risk prevention
FE03 Transport and shipping
FE04 Own legal affairs
FR01 Information requests received
FR03 Recruitment of own staff
FR04 Advertising campaigns
FR05 E-mails
FR07 Management of incidents and/or security breaches
FR08 Gathering the opinion of data subjects
FR09 Software and hardware security
FE07 Destruction of documents
FE08 Personal Data Protection
FP01 Clients

The personal data we process in our organisation come from the following sources:

The data subject themselves

Rights

What rights can you exercise?

We guarantee the exercise of the rights you have in relation to the processing of your personal data.

In particular, we inform you that you have the right to:

Obtain confirmation as to whether your data are being processed.
Exercise the right of access to the personal data we hold, obtaining information on the purposes of the processing, the categories of data processed, the possible recipients, the retention period, the origin of the data and, where applicable, the existence of profiling or automated decision-making.
Exercise the right of rectification. For this purpose, we remind you that the personal data we hold must always faithfully reflect reality, so do not hesitate to exercise your right if any data is modified, changed or cancelled. You guarantee that the personal data you have provided to us by any means are true and accurate, and you undertake to notify any change or modification to them, being solely responsible for any loss or damage caused to the controller or to any third party as a result of communicating erroneous, inaccurate or incomplete information.
On grounds relating to your particular situation, object to the processing of your data, in which case our organisation will stop processing the data unless there are legitimate grounds that prevent it.
Request the erasure of your personal data when, among other reasons, they are no longer necessary for the purposes described above or we no longer have a legal basis to process them.
Request the portability of your data, when the processing is carried out by automated means and provided that it is linked to our organisation on the basis of a signed contract or you have given consent for the processing carried out. In these cases, you will have the right to receive your personal data in a structured, commonly used and machine-readable format, or to have them transmitted directly to another controller, where technically feasible.
In certain circumstances, request the restriction of the processing of your data, in which case we will only keep them for the exercise or defence of claims.
Object to automated decision-making, including profiling.

These rights may be exercised free of charge, except in the cases provided for by law, by means of a written request signed by you or, where applicable, by your representative, addressed to the data controller at the addresses provided for this purpose in the first section, or in person at any of our establishments.

You also have the right to lodge a complaint either with the Spanish Data Protection Agency (on its website https://www.agpd.es/) or with the relevant supervisory authority.

You may also go to the Courts of Justice to claim compensation.

Finally, you have the right to withdraw your consent as easily as you gave it. To do so, you can visit our website, where you will find the information needed to quickly and easily cancel the authorisation you have given us to send these communications. You can also send an e-mail to the address indicated in the section on the data controller.

We also inform you that, for each processing of your personal data, the possible threats and the impacts they could have are identified, mitigating or eliminating, where possible, the potential harm through the application of the corresponding security measures, which are periodically reviewed to determine their effectiveness.

Our control system also makes it possible to comply with the principles governing the processing of your data, allowing us to demonstrate to the data subject compliance with the principle of purpose limitation, the principle of storage limitation, the principle of data minimisation and the principle of integrity and confidentiality.

Lastly, we also inform you that you will periodically receive surveys that will allow us to learn your opinion and any suggestions regarding the processing of your personal data, as well as to comply with the principle of transparency and accuracy of the data processed.

For any questions or clarification, you can contact us through the e-mail address provided in the first section. Yours faithfully,

The Data Controller.