Politics of Protection of Data

ABOUT PRIVACY AT PEPA BANDERA©

In accordance with the provisions of the RGPD (EU) 2016/679 and Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights, we inform you that the data you provide us will be processed by MARÍA JOSÉ GRANDE BRIHUEGA (hereinafter with the commercial name of GRUPO PEPA BANDERA or PEPA BANDERA and/or PEPA PRIVÈ), as Data Controller and integrated into its Records of Treatment Activities, with the purpose of responding to your request, query, and/or providing you with our services.

PEPA BANDERA GROUP has a very defined policy when it comes to preserving information security, privacy and data protection. This applies to all devices that in some way may prove to be a crack in your information system, to the human resources that manage the information, to the information itself, to its transmission and to the destruction of both devices and such information.

For this, PEPA BANDERA It has developed, among other measures, regular controls on external and internal personnel who manage the applications, confidentiality agreements, treatment commission contracts, etc. and we offer you our information for greater transparency and peace of mind.

As a user of the website, you are informed that with the acceptance of this Privacy Policy, AND the consent you give, We will have a basis of legitimacy so that the personal data you provide through our if you are processed by us to respond to your request or provide you with our navigation services.

The data requested in the forms on the website are generally essential to provide you with the service and, therefore, mandatory (unless otherwise specified in the required field) to fulfill the established purposes. In any case, we remind you that, at your own risk, you must provide us with complete and truthful information.

COMMITMENTS OF THE USER.

As a user, you undertake that the information you provide us at all times will be truthful and that the data you communicate to us is accurate, updated and complete, exonerating us from any problem arising from incorrectly or incorrectly transferred data.

By communicating your data to us, you guarantee that you are over 18 years old and if this does not correspond to reality, your legal guardians will be informed and must assume the responsibilities derived from the fact that any of these conditions have not occurred, including the damages that may arise.

WHAT DATA WE COLLECT.

In general, the data we process usually comes from the user, but in the event that for any circumstance, you provide us with data from third parties, although we are exempt from any responsibility in these cases, by communicating them to us, you state that you have the consent of said interested person. , as well as that it is aware of this data processing policy.

The data that we will process may be received, therefore, directly from you as a user, from your legal representative, third parties or administrations or public bodies.

To provide our services we will need to collect and, where appropriate, we may process the following categories of personal data:

• Identification data: name, surname and sometimes, ID.
• Contact information: postal address, email and telephone number.

Remember that we will never ask you for banking or financial information.




LEGITIMATION FOR THE PROCESSING OF PERSONAL DATA.

We inform you about our legitimizing basis for processing the personal data that you provide us, which is the

express consent

, without loss of legitimacy due to legitimate interest to respond to your queries or requests.

At the moment before contacting us and providing us with the data, you have the possibility of granting us this consent. It is necessary for us to manage, where appropriate, your registration as a client, respond to requests, requests, queries, doubts, etc. It is also necessary for us to be able to send you commercial communications and news of interest to you.




If you are a job seeker, you must contact us by phone and we will inform you how to send us your information.




The consent you give us may be withdrawn at any time by email at:

info@pepabandera.es

.

If you proceed to withdraw your consent, this will not affect the legality of the treatments previously carried out.

PURPOSE OF THE PROCESSING OF THE PERSONAL DATA COLLECTED.

The personal data provided through this website, and which PEPA BANDERA has the authority to process, will be collected for the following purposes:

• Manage, process and monitor contracted services.
• Respond to doubts, requests, information, queries, etc.
• Know your interest in our services.
• Request your opinion about our services, with improvement objectives.
• Adapt our offer to your needs or preferences.
• Comply with our tax, administrative, accounting obligations, etc.
• Comply with our obligation to provide information to public bodies.
• Send you news, suggestions, advertising or information about products or services if you authorize us to do so.
• Carry out marketing, public relations, surveys and advertising actions.
• Resolve conflicts or problems, including taking legal action.
• Avoid prohibited or illegal activities.
• Carry out anonymous calculations on access, use and activity habits of users.

Specifically, we inform you that we will not perform profile analysis, nor will we make decisions based exclusively on automated solutions that may affect legal situations. If this changes, or if we require any additional information, we will inform you in a timely manner, explain the need for it, and obtain your consent.

In principle, we will not collect especially sensitive or high-risk data, unless exceptionally you communicate it to us due to a specific need.

COMMUNICATION OF THE DATA YOU PROVIDE US.

The personal data that you provide us could be communicated to:

• Group companies under the PEPA BANDERA brand for any of the services they may provide.
• Treatment managers, as the case may be, to cover the services entrusted to us, such as card payment systems, advice, consulting, communication management, personnel selection companies and similar. One of our managers is IONOS CLOUD SLU, which facilitates the hosting and functionalities of the website.
• Banking entities and intermediaries to make entries or exits of collections and payments or returns.
• Public Administrations in the cases provided by law.
• State Security Forces and Bodies.

The personal data of the user may be used for legal purposes by the Data Controller, in the Courts or in the stages that lead to possible legal actions derived from the improper use of this website or the related services, so with This document, you become aware that the Data Controller may be forced to disclose personal data at the request of public authorities.




WHERE WE STORE PERSONAL DATA. INTERNATIONAL DATA TRANSFERS.

The Data is processed in the operational offices of the person Responsible for the Treatment and in any other place of electronic storage of information, where the parties involved in the processing are located.

These data will be archived and stored in their computer systems in the case of automated processing, and in the case of physical format, at the registered office of the Data Controller, always within the European Union.

Depending on your location as a user, data transfers may involve transfer to a country other than your own. For more information on the place of processing of said transferred data, users can consult the section containing details on the processing of Personal Data.

In principle, PEPA BANDERA does not foresee international data transfers, that is, outside the European Union, but if this occurs, people will be informed of the legal basis for data transfers to a country outside of the European Union. the European Union or any international organization governed by public international law or created by two or more countries, and on the security measures adopted by the Data Controller to safeguard your data.

If any of these transfers occur, the Data Controller will duly inform and adopt all the necessary guarantees, carry out all legal procedures, and adopt the clauses specifically provided for this.

RIGHTS REGARDING DATA PROTECTION AND HOW TO EXERCISE THEM.

As a user of our website, you have the right to exercise any of the following rights:




I. Right of Access

This right allows you to know the personal data of your ownership that we have in our database, along with the purpose for which they have been collected, the identity of the people or entities recipients of the data, the expected conservation periods or the criteria used to determine it, and based on this, the existence of the right to request their rectification or deletion.

II. Right of Rectification

You may, without undue delay, rectify any personal data that is inaccurate or that is completed in your case, even by means of an additional declaration.




III. Right of Cancellation/Deletion

You can exercise this right if you consider that there is no legal basis for the processing, that the data are not necessary in relation to the purposes for which they were collected, or you withdraw the consent initially given, and there is no other legal basis that legitimizes our treatment or it is unlawful.




IV. Right to Oppose

You can object to the processing of your personal data in certain cases such as:




• That the processing is based on a mission of public interest or on the legitimate interests of the controller or a third party.
• When the processing has the purpose of direct marketing, also including profiling.
• If your personal data is processed for direct marketing purposes, you can object to such processing at any time without providing any justification. To find out if the Data Controller is processing personal data for direct marketing purposes, you can consult with it.

V. Right of Portability

In accordance with this right, you will be able to receive the personal data provided, in a structured, commonly used, machine-readable and interoperable format, and the right to transmit it to another controller.




SAW. Right to Limit Treatment

You can exercise the limitation of data processing, provided that any of the following conditions apply:

• You dispute the accuracy of the personal data.
• That the treatment is unlawful and you oppose the deletion of personal data and request instead the limitation of its use.
• PEPA BANDERA no longer needs the personal data for the purposes of the processing, but does need it for the formulation, exercise or defense of claims.
• You object to the processing, while it is verified whether PEPA BANDERA's legitimate reasons should prevail over any you may have.

You can exercise your rights free of charge by sending a letter to info@pepabandera.es , indicating the reference “Data Protection-Exercise Rights”, attaching a photocopy of your DNI (or identification document from your country of origin). Likewise, you can go to the Spanish Data Protection Agency for disagreement with the treatment, on its website: www.aepd.es

HOW LONG WILL WE KEEP THE DATA YOU COMMUNICATE TO US

In principle, unless there is a legal provision that imposes different deadlines, we will keep the information for as long as necessary to offer you the information you request from us or as long as our relationship is maintained.

The Data Controller may retain personal data for a longer period provided that you have given us your consent to do so, as long as you do not withdraw it.

If you give us consent to send you commercial publications, we may retain and use your data for as long as you wish us to send you said information.

We also inform you that we will keep it for the entire time required by regulatory imposition and the statute of limitations of responsibilities to legally comply with our administrative, fiscal, labor, accounting, etc. obligations.




If you wish to revoke the consent you provide, you can exercise your right to deletion as permitted by current regulations and essential information will be blocked.

CONFIDENTIALITY OF INFORMATION

At PEPA BANDERA we especially value the privacy of all the people who are part of our clientele, those who collaborate with us and/or those who are linked to our environment in some way.

Therefore, we take the privacy of the information you provide us or that we may collect very seriously. Without a doubt, we will treat the data provided by you in an absolutely confidential manner and in accordance with the orderly and good faith compliance with our duty of secrecy.

We assure you that within our proactive responsibility we have adopted all the necessary technical and organizational measures, seeking balanced protection within the state of the art and our possibilities in compliance with our duties, establishing protocols from the design and by default that prevent alteration, loss, processing or unauthorized access to information.

SECURITY GAP

Although we take all measures at our disposal, we cannot absolutely eliminate all risk and probability that a breach or incident may occur, so in the unlikely event that it does occur, we will act in accordance with the following guidelines:

• We will manage technically to prevent its effects from spreading.
• We will try to solve the problem as soon as possible.
• We will communicate the facts, if necessary, to the Spanish Data Protection Agency within a maximum period of 72 hours.
• We will notify you in case you may suffer any minimal damage or your rights are at risk. Said communication could be made publicly and manifestly through a notice on the web, notice through social networks or to your email.
• We will monitor and implement new means so that it does not occur again or the probability is minimized.

UPDATE: January 2023