Legal Notice

Introduction

This Privacy Policy has been drawn up in accordance with the guidelines of the current and applicable Organic Law on the Protection of Personal Data, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the GDPR).

The purpose of this Privacy Policy is to inform the data subjects whose personal data is being collected about the specific aspects relating to the processing of their data, including, among other things, the purposes of the processing, contact details for exercising their rights, the data retention period, and the security measures in place.

Data Controller

In terms of data protection, ESPAI MERIDIONAL S.L. must be considered the Data Controller, in relation to the files/processing identified in the following policy, specifically in the Data Processing section.

The identifying details of the owner of this website are set out below:

Data Controller: ESPACIO MERIDIONAL S.L.

Postal address: ENRIQUE GIMENEZ 5 4ºA, CP: 08034 de Barcelona

Data processing

The personal data that may be requested will consist only of what is strictly necessary to identify and respond to the request made by the data subject (hereinafter, the “data subject”).

This information will be processed fairly, lawfully and transparently in relation to the data subject. Personal data will also be collected for specific, explicit and legitimate purposes and will not be further processed in a manner incompatible with those purposes.

The data collected from each data subject will be adequate and relevant and, in no case, excessive in relation to the purposes applicable in each case, and will be kept up to date whenever necessary.

Purposes of processing

The explicit purposes for which processing will be carried out are set out in the information clauses included in each data collection channel (web forms, paper forms, recordings or signage, and information notices).

In any case, the data subject’s personal data will be processed solely for the purpose of providing an effective response and handling all requests submitted by the user, as specified alongside the option, service, form or data collection system used by the data subject.

Lawful basis

As a general rule, prior to the processing of personal data, ESPACIO MERIDIONAL S.L. will obtain the express and unequivocal consent of the owner of the same, by incorporating informed consent clauses into the different information collection systems.

However, in the event that the consent of the interested party is not necessary, the legitimate basis for the processing to which ESPACIO MERIDIONAL S.L. is based is the existence of a specific law or regulation that authorises or requires the processing or processing of the data of the interested party.

Recipients

As a general rule, ESPACIO MERIDIONAL S.L. will not proceed to transfer or communicate the data to third parties, unless they are legally required, however, if necessary, these transfers or communications of data will be informed to the interested party through the consent clauses informing the content through the different ways of collecting personal data.

Source

As a general rule, personal data is always collected directly from the data subject. However, in certain exceptional cases, data may be collected by third parties, entities or services other than the data subject. In this regard, this will be communicated to the data subject through the informed-consent clauses included in the different information collection channels, within a reasonable period after obtaining the data and no later than one month.

Retention periods

The information collected from the data subject will be kept for as long as necessary to fulfil the purpose for which the personal data was collected. Once that purpose has been fulfilled, the data will be erased. This erasure will involve blocking the data, which will be kept only at the disposal of Public Administrations, Judges and Courts to address any liabilities arising from the processing, for the applicable limitation period. Once this period has elapsed, the information will be destroyed.

For information purposes, the legal retention periods for information in relation to different situations are set out below:

Document

Period

Legal reference

Employment-related documents or documents related to Social Security

4 years

Article 21 of Royal Legislative Decree 5/2000 of 4 August, approving the consolidated text of the Law on Offences and Sanctions in the Social Order.

Accounting and tax documentation for commercial purposes

6 years

Art. 30 of the Commercial Code

Accounting and tax documentation for tax purposes

4 years

Articles 66 to 70 of the General Tax Law

Building access control

1 month

Instruction 1/1996 of the AEPD

Video surveillance

1 month

Instruction 1/2006 of the AEPD; Organic Law 4/1997

Browsing data

With regard to browsing data that may be processed through the website, if data subject to the regulations is collected, we recommend consulting the Cookies Policy published on the website.

Data subject rights

The data protection regulations grant a series of rights to the interested parties or owners of the data, users of the websites or users of the social network profiles of ESPACIO MERIDIONAL S.L.,

The rights available to data subjects are as follows:

Right of access: The right to obtain information on whether your data is being processed, the purpose of the processing, the categories of data processed, the recipients or categories of recipients, the retention period, and the source of the data.
Right to rectification: The right to obtain the rectification of inaccurate or incomplete personal data.
Right to erasure: The right to obtain the erasure of data in the following cases:
When the data is no longer necessary for the purpose for which it was collected.
When the data subject withdraws consent.
When the data subject objects to the processing of their data.
When the data must be erased to comply with a legal obligation.
When the data has been obtained in connection with an information society service, pursuant to Article 8(1) of the European Regulation on Data Protection.
Right to object: The right to object to certain processing based on the data subject’s consent.
Right to restriction: The right to obtain restriction of processing when any of the following applies:
When the data subject contests the accuracy of the personal data for a period enabling the company to verify its accuracy.
When the processing is lawful and the data subject opposes the erasure of the data.
When the company no longer needs the data for the purposes for which it was collected, but the data subject needs it for the establishment, exercise or defence of legal claims.
When the data subject has objected to processing while it is being verified whether the company’s legitimate grounds override those of the data subject.
Right to data portability: The right to receive the data in a structured, commonly used and machine-readable format and to transmit it to another controller when:
The processing is based on consent.
The processing is carried out by automated means
Right to lodge a complaint with the competent supervisory authority.
Data subjects may exercise the rights indicated by writing to ESPACIO MERIDIONAL S.L. at the following address: Calle Milanesado 21, 2nd Floor, 08017 Barcelona (Barcelona), stating in the subject line the right they wish to exercise.

In this regard, ESPACIO MERIDIONAL S.L. will handle your request as quickly as possible, taking into account the time limits set out in data protection regulations.

Security

The security measures adopted by ESPACIO MERIDIONAL S.L. are those that are required, in accordance with the provisions of article 32 of the GDPR. In this regard, ESPACIO MERIDIONAL S.L., taking into account the state of the art, the costs of the application and the nature, scope, context and purpose of the processing, as well as the risks of variable probability and severity due to the rights and freedoms of natural persons, has established the appropriate technical organisational measures to ensure the level of security appropriate to the existing risk.

In any case, ESPACIO MERIDIONAL S.L., has implemented sufficient mechanisms for:

Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
Restore the availability of and access to personal data quickly in the event of a physical or technical incident.
Regularly test, assess and evaluate the effectiveness of the technical and organisational measures implemented to ensure the security of processing.
Pseudonymise and encrypt personal data, where necessary.