In accordance with the General Data Protrection Regulation (GDPR) 2016/679 and the Spanish Act 3/2018, 5 December, of Protection of Personal Data and Guarantee of digital rights, our privacy is updated and we inform you that the main aspects about the processing of personal data and on the free movement of such data.
Contact information about Data Controller
Papeles El Carmen, SAU, is the data controller, with the following contact information:
Papeles el Carmen S.A.U. shall only require personal data neccessary to fulfil the obligations for which they were obtained.
Data categories processed wil be: identifying data, personal conditions, contact information, academic and profesional data, economic and financial data, business information and social conditions.
Special categories of data about political opinions, religious beliefs, racial or ethnic origin, health data or sexual identity shall not be processed.
Purposes of data processing
Papeles El Carmen S.A.U shall process personal data for the purposes related with:
Compliance with a legal obligation to which the controller is subject
Performance and control of the contractual relationship existing with clients, neccessary to comply with contracted services, being the lawfullnes of this data processing the performance of a contract to which the data subject is party and the consent to the processing of his or her personal data given by the data subject for this specific purpose.
Commercial purposes based on a legitimate interests pursued by the data subject that shall allow him or her to receive commercial comunications by any mean, including electronic ones, about similar products or services to those contracted as well as to offer similar prodcuts and servicies, adjusted to the characteristics of the data subject. This shall be without prejudice to the capability of the data subject to manifest his or her opposition to this data processing or to the right to withdraw the consent given, directing a brief to the aforementioned postal address or email address of the data processor.
Except from those cases in which data communications are imposed by law, Papeles El Carmen, SAU shall always obtain the previous and unequivocal consent from the data subject in case personal data is comunicated to third parties dedicated to identical or similar activities and for the same purposes for which data was obtained. In case recipients belongs to the same business group as the data processor, Papeles El Carmen, SAU shall identify the companies which are part from the business group by a link its composition can be consulted in a continuos and updated manner.
When the perfomance of the contracted services requires the access from a third party to the personal data, Papeles el Carmen, SAU, as data controller, shall sign with the corresponding data processor- the service provider- an agreement about the object, duration, nature and purposes of the data processing as well as the data categories, the data subject categories, so that data proccessors must only process the data in accordance with the instructions given by the data controller. This contract shall also include the conditions to allow subcontracting, the party in charge of satisfied legal rights and the other provisions contained in the General Data Protrection Regulation
Deadlines for storage of personal data
Personal data shall only be retained for the period of time contractual relation remains in effect. Once this is concluded, personal data shall be retained no more tan six years or during the current legal periods.
Deadlines for storage of personal data shall be more inferior than the aforementioned period, especifically between six months and two years, regarding data obtanided for purposes related to staff selection processes.
International data transfers outside the european economic área
Personal data shall only be comunicated to states and organizations outside the European Economic Area, as long as the Commission acknowledges them an appropiate level of protection, or that statate or organization offer appropiate guarantees of protection: binding corporate laws that establish similar protection measures as those required by european legislation, EU model clauses. and other similar measures.
Rights of the data subject and channels to exercise them
Data subject can exercise the following rights: access to data object of processing, right to revoke his or her given consent at any time, right to oppose to data processing based on a legitimate interest, right to rectify incorrect or incomplete data, right to requerire the limitation of data processing in cases contemplated in law. When applicable, as established in current legislation, data subject shall be entitled to lodge a complaint with a supervisory authority (Agencia Española de Protección de Datos).
Data subject shall be able to exercise his or her rights directing a request to PAPELES EL CARMEN, SAU to the postal address: carretera de Alzuza, s/nº, CP 31486, Egües (Navarra), or to the email firstname.lastname@example.org.