REQUEST
That the person in charge of the treatment provide you with the right(s) indicated above, free of charge, within a month*** from the receipt of this request, and that the information be notified to the address indicated above. and/or corresponding result associated with each right.
* Mandatory fields
** In the event that you have indicated the representation of a third party, you must indicate the name, surname, ID number of the represented person in order to corroborate the representation. In addition, it will be necessary to send an updated photo for the verification and identification of your recording.
*** The term may be extended for another two months , taking into account the complexity and number of requests, according to art. 12.3 of GDPR 2016/679.
INDICATIONS ON THE EXERCISE OF RIGHTS
- The exercise is free, however, if the requests are manifestly unfounded or excessive (eg, repetitive), the controller may charge a fee proportional to the administrative costs incurred and/or refuse to act.
- Requests must be answered within a month, although, if the complexity and number of requests are taken into account, the term can be extended for another two more months.
- The person in charge is obliged to inform you about the means to exercise these rights. These means must be accessible and this right cannot be denied for the sole reason that you opt for another means.
- If the request is submitted by electronic means, the information will be provided by these means when possible, unless the interested party requests that it be otherwise.
- If the person in charge does not proceed with the request, he will inform, no later than one month, of the reasons for his non-action and the possibility of claiming before a Control Authority (AEPD). Likewise, in the event that you consider that the company has not acted correctly in response to your request to exercise your rights, you can file a claim with the Spanish Agency for Data Protection, which you can contact through the website agpd.es or telephone 91 266 35 17.
- The person in charge may request documentation or additional information, in the event that they have reasonable suspicions that you are not the owner of the data. In this case, the minimum information necessary for said verification will be collected.
- If a legal or voluntary representative exercises your rights, an authorization signed by you will be required indicating who acts as your representative, if you are over 16 years of age. Documentation or additional information may be requested, in the event that there are reasonable suspicions that the proper authorization / legal representation is not available. In this case, the minimum information necessary for said verification will be collected (eg display of ID/passport, request for a copy with masked data...).
- It is possible that the person in charge is the one who attends to your request on behalf of the person in charge if both have established it in the contract or legal act that binds them.
- In some cases it may be necessary for you to provide documentation that justifies the exercise of your rights, such as for the rectification of data. In this case, the request must be accompanied by any document certifying said information. If you want to exercise your right to the portability of your data directly to another person in charge, you must attach the data of said person in charge, as well as an email or contact telephone number with him.
- In the event that the company considers that the application is incomplete or that it needs more information to be able to respond to the exercise of the requested right, it will contact you to request said information.
- The company has a legal period of one month to respond adequately to the exercise of the requested right, which begins to count from the delivery of the request, if it is correct, or from the moment in which the failures that may exist in the application have been corrected. the original request.
- If you consider that you should provide more information than what this form allows, you can attach a separate text to the request, where you comment on what you think is necessary.
RIGHT OF ACCESS: Regulated in art. 15 of the EU Regulation 2016/679, General Data Protection (GDPR), it is about your right to contact the person responsible for the treatment to know if it is processing your personal data or not and, in the event that it is being carried out said treatment, obtain the following information : a copy of your personal data that is the object of the treatment; the purposes of the treatment; the categories of personal data processed; the recipients or the categories of recipients to whom the personal data was communicated or will be communicated, in particular, recipients in third countries or international organizations; the planned period of conservation of the personal data, or if this is not possible, the criteria used to determine this period; the existence of the right of the interested party to request from the controller: the rectification or deletion of their personal data, the limitation of the processing of their personal data or to oppose such processing; the right to file a claim with a Control Authority; where the personal data has not been obtained directly from you, any available information about its origin; the existence of automated decisions, including profiling, and at least in such cases, significant information on the logic applied, the importance and the expected consequences of that processing for the data subject; When personal data is transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards under which the transfers are made.
RIGHT OF RECTIFICATION: Given the nature of the data (image) this right cannot be applied.
RIGHT OF SUPPRESSION (RIGHT TO BE FORGOTTEN): Regulated in art. 17 of EU Regulation 2016/679, General Data Protection (GDPR), you can exercise this right before the person in charge by requesting the deletion of your personal data when any of the following circumstances occur : if your personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; if the processing of your personal data has been based on the consent you gave to the person in charge, and you withdraw it, provided that the aforementioned processing is not based on another legitimizing cause; if you have objected to the processing of your personal data by exercising the right of opposition when the treatment of the person in charge was based on the legitimate interest or in the fulfillment of a mission of public interest, and no other reasons have prevailed to legitimize the treatment of your data, or when your personal data is the subject of direct marketing, including profiling related to said marketing; if your personal data has been processed unlawfully; if your personal data must be deleted to comply with a legal obligation established in the Law of the Union or of the Member States that applies to the data controller; if the personal data has been obtained in relation to the offer of information society services mentioned in article 8, paragraph 1 (conditions applicable to the processing of data of minors in relation to information society services) . In addition, this right to erasure is extended in such a way that the data controller who has made the personal data public is obliged to instruct the data controllers who are processing such personal data to delete any links to them, or copies or replicas of them. such data. However, this right is not unlimited, in such a way that it may be feasible not to proceed with the deletion when the treatment is necessary for the exercise of freedom of expression and information, for the fulfillment of a legal obligation, for the fulfillment of a mission carried out in the public interest or in the exercise of public powers vested in the controller, for reasons of public interest, in the field of public health, for purposes of archiving in the public interest, scientific or historical research purposes or statistical purposes, or for the formulation, exercise or defense of claims. In addition, in the event that your personal data has been communicated to other data controllers, this deletion will be communicated. Likewise, and in the event that it is agreed that it is not appropriate to carry out the requested deletion in whole or in part, you will be notified with reasons so that, if applicable, you can complain to the corresponding Control Authority.
RIGHT OF OPPOSITION: Regulated in art. 21 of EU Regulation 2016/679, General Data Protection (GDPR), means that you can oppose the person responsible for processing personal data in the following cases : when the processing is for direct marketing purposes, also including the aforementioned profiling, your personal data will no longer be processed for said purposes; When they are subject to processing based on a mission of public interest or legitimate interest, including profiling, the data will no longer be processed unless the data controller proves compelling reasons that prevail over the interests, rights and freedoms (in the first two cases), or a mission carried out in the public interest (in the third case). In such cases, the interested party must prove the personal situation for which they oppose the processing of their personal data.
RIGHT OF LIMITATION: Regulated in art. 18 of the EU Regulation 2016/679, General Data Protection (GDPR), is that you can obtain the limitation of the treatment of your data carried out by the person in charge, although its exercise has two aspects : you can request the suspension of the treatment of your data when you challenge the accuracy of your personal data, during a period that allows the controller to verify it and when you have objected to the processing of your personal data that the controller performs based on legitimate interest or mission of public interest, while the controller verifies whether these motives take precedence over yours. In addition, you can request the person in charge to keep your data: when the treatment is illegal and you have opposed the deletion of your data and instead request the limitation of its use; and when the person in charge no longer needs the personal data for the purposes of the treatment, but the interested party needs them for the formulation, exercise or defense of claims. Likewise, this limitation will be communicated to each of the recipients to whom we have communicated your personal data.
RIGHT TO THE PORTABILITY OF YOUR DATA: Regulated in art. 20 of EU Regulation 2016/679, General Data Protection (GDPR), you can exercise this right, when the treatment is carried out by automated means, receiving your personal data in a structured, commonly used, machine-readable and interoperable format , and you can transmit them to another person responsible for the treatment , provided that the treatment is legitimized based on consent or in the framework of the execution of a contract and is technically possible. To do this, you must indicate in the section About the following data/treatments , the name or company name of the person in charge to whom you want it to be transmitted directly. However, this right, by its very nature, cannot be applied when the treatment is necessary for the fulfillment of a mission of public interest or in the exercise of public powers conferred on the person in charge.
