Privacy policy

DATA CONTROLLER

The Data Controller is PROMOCIONES GAVAIR, S.L., C/ CORREDORA, 43, 03232 ELCHE (ALICANTE).

PRINCIPLES OF PRIVACY

At PROMOCIONES GAVAIR, S.L. we are committed to working with you continuously to guarantee your privacy when processing your personal data, and to offering you the most comprehensive and clear information that we can at all times. We encourage you to read this section carefully before providing us with your personal details.

If you are under the age of fourteen, we ask you not to provide us with your data without your parents’ consent.

In this section, we inform you about how we process the data regarding people that have a relationship with our organisation. Starting with our principles:

We do not request personal information, unless it is necessary in order to provide you with the services you request from us.
We never share personal information with anyone else, except to comply with the law, or if we have your express permission.
We will never use your personal data for purposes other than those stated in this privacy policy.
Your data will always be processed with an appropriate level of protection in line with data protection legislation, and we will not subject it to automated decisions.

This privacy policy has been written taking into account the requirements of current data protection legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 in relation to the protection of natural persons (GDPR). – Organic Law 3/2018, of December 5, on the Protection of Data of a Personal Nature and the guarantee of digital rights (LOPD).
Spanish Royal Decree 1720/2007, of December 21 (RLOPD).

Owing to the modification of processing criteria, in the interests of facilitating its understanding or to adapt it to current legislation, we may modify this privacy policy. We recommend you visit it regularly.

PROCESSING THAT WE CARRY OUT

Processing of Employees

Legal basis: GDPR: 6(1)(b) Processing necessary for the performance of a contract that the individual concerned is party to or for application at the request of the individual concerned prior to entering into a contract.

GDPR: 6(1)(c) Processing necessary for compliance with a legal obligation that the controller is subject to.

Royal Legislative Decree 2/2015, of October 23, approving the Codified Text of the Law on the Statute of Rights for Workers.

Purposes of the Processing:

Management of recruited staff.
Personal record. – Control of working hours.
Training. Pension Plans.
Prevention of Occupational Risks.
Issuance of staff payroll.
Management of trade union activity.

Group: Employees

Data categories:

Name and Surname(s), DNI/CIF/Identification Document, personnel record number, Social Security / Insurance number, address, signature, telephone number.
Special categories of data:health data (sick leave, work-related accidents and degree of incapacity, not including diagnoses), trade union membership, exclusively for the purpose of paying union fees (if applicable), trade union representative (if applicable), own and third party proof of attendance.
Details of personal characteristics: Sex, marital status, nationality, age, date and place of birth and family information. Data relating to family circumstances: Start and leave date, licenses, permits and authorisations.
Academic and professional details: Qualifications, training and professional experience.
Employment details: job post and administrative career. Incompatibilities.
Attendance monitoring data: date/time of entry and departure, reasons for absence.
Economic-financial data: Economic data regarding payroll, credits, loans, guarantees, tax deductions, salary reductions corresponding to the previous job (if applicable), judicial deductions (if applicable), other deductions (if applicable). Bank details.

Recipient categories:

Entity entrusted with the management of occupational risks.
Social Security Fund.
Trade union organisations.
Financial bodies.
State Tax Administration Agency.
Main contractors that we provide services to as subcontractors.

International Transfers: There is no intention to transfer your information internationally.

Deletion Deadline: The information will be kept for the necessary time to fulfil the purpose for which it was collected and to determine possible responsibilities that may arise from this purpose and the processing of the information.

The financial data regarding this processing activity will be kept in line with the provisions of Law 58/2003, of December 17, General Taxation Law.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Contracts

Legal basis: Consent of the person concerned

Purposes of the Processing: To deal with your request, send you information and monitor the request.

Group: Contact persons, clients, suppliers

Data categories: Name and Surname(s), telephone number, email address

Recipient categories: There is no intention to transfer information to third parties.

International Transfers: There is no intention to transfer your information internationally.

Deletion Deadline: Contact details will be kept while required in order to fulfil the purpose for which they were collected or until the data subject withdraws their consent.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing for Dealing with people’s rights (ARCO)

Legal basis: GDPR: 6(1)(c) Processing necessary for compliance with a legal obligation that the controller is subject to.

General data protection regulation.

Purposes of the Processing: Handling requests in the exercising of rights established by the General Data

Protection Regulation: Right of access, rectification, deletion, limitation, portability and opposition to automated decision-making.

Group: Natural persons that request it (employees, clients, suppliers, contact persons)

Data categories: Name and Surname(s), address, signature and telephone number.

Recipient categories: Personal data may be communicated to the Control Authority (Spanish Data Protection Agency) in the context of an investigation into the protection of rights initiated by the individual concerned.

International Transfers: There is no intention to transfer your information internationally.

Deletion Deadline: The data will be kept for a period of five years from the time of the request.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Candidates in selection processes (HR)

Legal basis: 6(1)(a) The individual concerned has given consent to the processing of his or her personal data for one or more specific purposes.

GDPR: 6(1)(b) Processing necessary for the performance of a contract that the individual concerned is party to or for application at the request of the individual concerned prior to entering into a contract.

Purposes of the Processing: Staff recruitment and filling vacant posts.

Group: Candidates that have applied via the procedure for filling vacant posts.

Data categories:

Name and Surname(s), DNI/CIF/Identification Document, personnel record number, address, signature and telephone number.
Details of personal characteristics: Sex, marital status, nationality, age, date and place of birth and family information.
Academic and professional details:
Qualifications, training and professional experience.
Employment details.

Recipient categories: There is no intention to transfer your data to third parties.

International Transfers: There is no intention to transfer your information internationally.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Suppliers

Legal basis: GDPR: 6(1)(b) Processing necessary for the performance of a contract that the individual concerned is party to or for application at the request of the individual concerned prior to entering into a contract.

GDPR: 6(1)(c) Processing necessary for compliance with a legal obligation that the controller is subject to.

Royal Legislative Decree 2/2015, of October 23, approving the Codified Text of the Law on the Statute of Rights for Workers.

Law 58/2003, of 19th December, General Taxation Law.

Purposes of the Processing:

Purchase of products and/or services that we require to carry out our activity.
Control of subcontractors if applicable.

Group:

Suppliers.
People who work for our suppliers.

Data categories:

Name and Surname(s), DNI/NIF/Identification document, address, signature and telephone number.
Employment details: job post. Training in workplace health and safety.
Economic / financial and insurance details: Bank details.

Recipient categories:

Financial bodies. (Payment of invoices)
State Tax Administration Agency.

International Transfers: There is no intention to transfer your information internationally.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Customers.

Legal basis: GDPR: 6(1)(a) The individual concerned has given consent to the processing of his or her personal data for one or more specific purposes.

GDPR: 6(1)(b) Processing necessary for the performance of a contract that the individual concerned is party to or for application at the request of the individual concerned prior to entering into a contract.
GDPR: 6(1)(c) Processing necessary for compliance with a legal obligation that the controller is subject to.

GDPR: 6(1)(f) Processing is necessary in order to satisfy the legitimate interests pursued by the data controller.

Royal Legislative Decree 2/2015, of October 23, approving the Codified Text of the Law on the Statute of Rights for Workers.

Law 58/2003, of 19 December, General Taxation Law.

Purposes of the Processing: Promotion and operation of residential services and management of sports facilities.

Group: Customers

Data categories:

Name and Surname(s), DNI/NIF/Identification document, address, signature and telephone number.
Economic / financial and insurance details: Bank details

Recipient categories:

Financial bodies.
State Tax Administration Agency.

International Transfers: There is no intention to transfer your information internationally.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Video surveillance

Legal basis: GDPR: 6(1)(c) The Processing is necessary in order to satisfy the legitimate interests pursued by the data controller or by a third party.

Organic Law 2/1986, of March 13, on Law Enforcement Authorities.

Purposes of the Processing: To guarantee the security of people, goods and premises and employment control.

Group: Workers, customers and suppliers, users.

Data categories: Image

Recipient categories: Recordings may be sent to Law Enforcement Authorities, and to the Courts, in the event they require it, or if they serve as evidence of crimes or offences being perpetrated.

International Transfers: There is no intention to transfer your information internationally.

Deletion Deadline: No longer than one month, unless sent to Law Enforcement Authorities and/or Courts.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing for the Notification of Security Breaches

Legal basis: GDPR: 6(1)(c) Processing necessary for compliance with a legal obligation that the controller is subject to.

General data protection regulation. Articles 33 and 34

Purposes of the Processing: Management and assessment of security breaches that may arise in our organisation.

Group: Variable: Employees, Customers, Suppliers, Contact Persons (will depend on the security breach)

Data categories: Variable. (It will depend on the security breach)

Recipient categories:

Spanish Data Protection Agency.
Law Enforcement Agents.

International Transfers: There is no intention to transfer your information internationally.

Security Measures: In line with the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

YOUR RIGHTS

You have the right to ask us for a copy of your personal data, to rectify inaccurate or incomplete data, or delete it if applicable, when the data is no longer required for the purposes for which it was collected.

You also have the right to limit the processing of your personal data and to obtain your personal data in a structured and readable format.

You can object to the processing of your personal data in some circumstances (in particular, when we are not required to process it in order to comply with a contractual or other legal requirement, or when the purpose of processing is direct marketing).

Where you have given us your consent, you may withdraw it at any time. At that moment, we will stop processing your data or, if applicable, we will stop doing so for that specific purpose. If you decide to withdraw your consent, this will not affect any processing that has been carried out while your consent was in place.

These rights may be limited; for example, if we need to disclose data about another person in order to fulfil your request, or if you ask us to delete a record that we are obliged to keep due to a legal obligation or a legitimate interest, such as to defend ourselves against any claims. There are even cases where the right to freedom of expression and information must prevail.

You can contact us through any of the means stated in the Data Controller section of this privacy policy, providing a copy of a document that proves your identity (usually DNI).

Another of your rights is to not be the subject of a decision based solely on automated processing, including the creation of profiles which produce legal implications or affect you.

In the event of any breach of your rights, such as, for example, that we have not dealt with your request, you have the right to file a complaint with the Supervisory Authority in relation to data protection. This may be the authority in your own country (if you reside outside of Spain) or the Spanish Data Protection Agency (if you live in Spain).

ADDITIONAL INFORMATION

Links to third party websites.
Our website may sometimes contain links to other websites. It is your responsibility to make sure you read the data protection policy and legal conditions that apply to each site.

Third party data.
If you provide us with data regarding a third party, you assume the responsibility for notifying them in advance in accordance with the provisions of Article 14 of the GDPR.