Introduction

This Privacy Policy has been created pursuant to the provisions of Regulation 2016/679 of the European Parliament and Council of April 27, 2016 on the protection of natural people with regard to the processing of personal data and the free movement of such data, hereinafter the GDPR.

This Privacy Policy is intended to inform the owners of personal data, from whom information is being collected, about specific aspects relating to the processing of their data, including processing purposes, contact information for exercising data rights, the periods during which data is saved and security measures.

Data controller

Gestora de Subproductos de Galicia, S.L. is the data controller in terms of data protection and in regards to the files/processes it manages:

The following are the identification data of the owner of this website:

Headquarters

Mailing address: Areosa s/n – Queixas – Cerceda – 15186 – La Coruña

Email: gesuga@gesuga.com

Phone: 981688181

Data processing

The personal data requested, if any, will consist only of those strictly necessary to identify and respond to the request made by the data owner, hereinafter the interested party. Said information will be processed in a fair, legal and transparent way. On the other hand, personal data will be collected for explicit and legitimate determined purposes, and will not be processed in a manner incompatible with said purposes.

The data collected from each interested party will be adequate, relevant and not excessive in relation to the corresponding purposes for each case, and will be updated whenever necessary.

The owner of the data will be informed, prior to the collection of their data, of the general purposes regulated in this policy so that they can provide express, precise and unambiguous consent for the processing of their data, in accordance with the following aspects.

In general, Gestora de Subproductos de Galicia, S.L. processes the following information with the following specific characteristics:

Processing purposes

The explicit purposes for which the data are processed are included in the informative clauses included in each of the data collection channels (website forms, paper forms, expressions, and posters and informative notes).

However, the personal data of the interested party will be processed for the exclusive purpose of providing an effective response and addressing user requests, specified together with the option, service, form or data collection system that the owner uses.

Legal grounds

As a general rule, prior to the processing of personal data, Gestora de Subproductos de Galicia, S.L. obtains express and unequivocal consent from the owner of the data through the incorporation of informed consent clauses in its different data collection systems.

However, in the event that the consent of the interested party is not required, the legal grounds that Gestora de Subproductos de Galicia, S.L.  has for processing the data is the existence of a specific law or regulation that authorizes or requires the processing of the interested party’s data.

Recipients

As a general rule, Gestora de Subproductos de Galicia, S.L. does not communicate or transfer data to third parties, except when legally required; however, in the event that the communication or transfer of data is required, the interested party will be informed through the informed consent clauses contained in its different personal data collecting systems.

Origin

As a general rule, personal data is always collected directly from the interested party. However, under certain exceptions the data can be collected through third parties, entities or services that are not the interested party. To that end, this purpose will be communicated to the interested party through the informed consent clauses contained in the different personal data collecting systems and within a reasonable time period after the data have been obtained, within a month at the latest.

Storage times

The information collected from the interested party will be kept no longer than is necessary to fulfill the purpose for which the personal data were collected, and the data will be canceled once the purpose has been fulfilled. This cancelation means that the data will be blocked and will only be available to public administrations, judges and courts, for the purpose of determining any liability arising from processing, and only for the duration of such liability; the data will be destroyed once the aforementioned period has elapsed.

For informative purposes, the following are the legal terms for data storage in relation to different subjects:

DOCUMENT TERM LEGAL REF. 
Work or social security documents 4 years Article 21 of Royal Legislative Decree 5/2000 of August 4 approving the revised text of the Labor Infringements and Penalties Law
Accounting and fiscal documents for commercial purposes 6 years Article 30 of the Business Code
Accounting and fiscal documents for tax purposes 4 years Articles 66 of 70 of the General Tax Law
Control of building access 1 month Directive 1/1996 of the AEPD (Spanish Data Protection Agency)
Video surveillance 1 month Directive 1/2006 of the AEPD  (Spanish Data Protection Agency)

Organic Law 4/1997

Browsing data

In relation to the browsing data that can be processed through the website, should data be collected that is subject to regulations, we recommend consulting the Cookies Policy published on our website.

Rights of the interested parties

The regulations on data protection grant a series of rights to the interested parties, data owners, users of the website and users of the Gestora de Subproductos de Galicia, S.L. social media profiles.

The rights of the interested persons are the following:

  • Right of access: right to obtain information about whether their own data are being processed, the processing purpose, the categories of data in question, the recipients or categories of recipients, the term of conservation and the origin of said data
  • Right to rectification: right to correct inaccurate or incomplete personal data.
  • Right to suppress: right to delete data in the following cases:
    • When the data is no longer necessary for the purpose for which they were collected
    • When the owner of the same withdraws the consent
    • When the interested party opposes the treatment
    • When they must be abolished in compliance with a legal obligation
    • When the data has been obtained by virtue of an information society service based on the provisions of Art. 8(1) of the European Regulation on Data Protection
  • Right of opposition: right to object to a specific process based on the consent of the interested party.
  • Right of limitation: right to limit data processing in cases where:
    • The interested party challenges the accuracy of the personal data, during a period that allows the company to verify the accuracy of the same.
    • The processing is illegal and the interested party opposes the deletion of the data.
    • The company no longer needs the data for the purposes for which they were collected, but the interested party needs them to develop, exercise or defend claims.
    • The interested party has opposed the processing while verifying if the company’s legal grounds prevail over those of the interested party.

Interested parties may exercise the above rights by written communication to Gestora de Subproductos de Galicia, S.L., sent to the following address: gesuga@gesuga.com, indicating the right you wish to exercise in the subject line.

To that end, Gestora de Subproductos de Galicia, S.L. will respond to your request as soon as possible and in compliance with the time limits set out in the data protection regulations.

On the other hand, it is important to bear in mind that the interested party or data owner may submit a claim to the competent supervisory authority at any time.

Security

The security measures adopted by Gestora de Subproductos de Galicia, S.L. are those required to comply with the provisions of Article 32 of the GDPR. To that end, Gestora de Subproductos de Galicia, S.L., taking into account the state-of-the-art methods, the costs of application and the nature, scope, context and purposes of the data processing, as well as the risks of probability and severity factors in terms of the rights and freedoms of natural persons, has established the appropriate technical and organizational measures to guarantee the level of security proportional to the existing risk.

In any event, Gestora de Subproductos de Galicia, S.L. has the mechanisms in place to:

  1. Guarantee the confidentiality, integrity, availability and continuous resilience of the processing systems and services.
  2. Quickly restore the availability and access to personal data, in the event of a physical or technical incident.
  3. Verify, evaluate and assess, on a regular basis, the effectiveness of the technical and organizational measures implemented to guarantee processing safety.
  4. Pseudonymize and encrypt personal data, if applicable.

Processing activities

File or processing Purpose Legal grounds Storage Transfer or communication
Customers and suppliers Administrative management

Management of the contracted service

Consent of the interested party and execution of a contract Duration of the service.

Legally established deadlines (see above)

Public administrations and banks
Employees Job management and human resources Consent of the interested party and execution of a contract Duration of the contract.

Legally established deadlines (see above)

Public administrations and banks
CVs Recruiting Consent of the interested party As long as it may be applicable for a position
Not expected
Website users Address requests for information and manage the blog Consent of the interested party
As long as no request for the cancelation of the data is made
Not expected, except for the blog, which will publish the blog information.