Privacy policy

Introduction

This Privacy Policy has been developed taking into account the provisions of the Organic Law on Personal Data Protection in force, as well as Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the movement of such data, hereinafter the GDPR.

The purpose of this Privacy Policy is to inform the owners of the personal data, in respect of which information is being collected, of the specific aspects relating to the processing of their data, among other things, the purposes of the processing, the contact details for exercising the rights available to them, the retention periods of the information and the security measures, among other things.

Data Controller

In terms of data protection, Ecomanagement Technology, S.L. must be considered the Data Controller, in relation to the files/processing collected through this website or through any other means such as telephone, email, in person, on paper through forms, through legal documents, etc.

The identifying details of the owner of this website are indicated below:

Data Controller: Ecomanagement Technology, S.L.
Postal address: Polígono de Pocomaco, 3ª Avenida, nº 32 ·15190 · A Coruña.
Email address: lopd@ecomt.net

Data processing

The personal data requested, where applicable, will consist only of those strictly essential to identify and address the request made by their owner, hereinafter the data subject. Said information will be processed in a fair, lawful and transparent manner in relation to the data subject. Furthermore, personal data will be collected for specified, explicit and legitimate purposes, and will not be further processed in a manner incompatible with those purposes.

The data collected from each data subject will be adequate, relevant and not excessive in relation to the corresponding purposes for each case, and will be updated whenever necessary.

The owner of the data will be informed, prior to the collection of their data, of the general points regulated in this policy so that they can give express, precise and unequivocal consent for the processing of their data, in accordance with the following aspects.

Purposes of the processing.

The explicit purposes for which each of the processing operations is carried out are set out in the informative clauses incorporated in each of the data collection channels (web forms, paper forms, announcements or signs and informative notices).

Nevertheless, the data subject’s personal data will be processed with the sole purpose of providing them with an effective response and addressing the requests made by the user, specified together with the option, service, form or data collection system that the owner uses.

Legal basis

As a general rule, prior to the processing of personal data, Ecomanagement Technology, S.L. obtains express and unequivocal consent from the owner of the data, by incorporating informed consent clauses in the different information collection systems.

However, in the event that the data subject’s consent is not required, the legitimizing basis for the processing on which Ecomanagement Technology, S.L. relies is the existence of a specific law or regulation that authorizes or requires the processing of the data subject’s data.

Recipients

As a general rule, Ecomanagement Technology, S.L. does not transfer or communicate the data to third-party entities, except those legally required; however, in the event that it were necessary, such transfers or communications of data are reported to the data subject through the informed consent clauses contained in the different channels for collecting personal data.

Source

As a general rule, personal data is always collected directly from the data subject; however, in certain exceptions, the data may be collected through third parties, entities or services other than the data subject. In this regard, this point will be conveyed to the data subject through the informed consent clauses contained in the different information collection channels and within a reasonable period, once the data is obtained, and at the latest within one month.

Retention periods

The information collected from the data subject will be retained for as long as it is necessary to fulfill the purpose for which the personal data was collected, so that, once the purpose has been fulfilled, the data will be cancelled. Said cancellation will result in the blocking of the data, keeping it only available to the Public Administrations, Judges and Courts, to address any liabilities arising from the processing, during the limitation period thereof; once said period has elapsed, the information will be destroyed.

For informational purposes, the legal retention periods of the information in relation to different matters are set out below:

DOCUMENT	PERIOD	LEGAL REF.
Employment documentation or documentation related to social security	4 years	Article 21 of Royal Legislative Decree 5/2000, of 4 August, approving the consolidated text of the Law on Infringements and Sanctions in the Social Order
Accounting and tax documentation for commercial purposes	6 years	Art. 30 of the Commercial Code
Accounting and tax documentation for tax purposes	4 years	Articles 66 to 70 of the General Tax Law
Building access control	1 month	Instruction 1/1996 of the AEPD
Video surveillance	1 month	Instruction 1/2006 of the AEPD – Organic Law 4/1997

Browsing data

In relation to the browsing data that may be processed through the website, in the event that data subject to the regulations is collected, it is recommended to consult the Cookies Policy published on our website.

Rights of the data subjects.

The data protection regulations grant a series of rights to the data subjects or owners of the data, users of the website or users of the social media profiles of Ecomanagement Technology, S.L..

These rights available to the interested persons are the following:

Right of access: the right to obtain information about whether one’s own data is being processed, the purpose of the processing being carried out, the categories of data processed, the recipients or categories of recipients, the retention period and the origin of said data.
Right of rectification: the right to obtain the rectification of inaccurate or incomplete personal data.
Right of erasure: the right to obtain the erasure of the data in the following cases:
- When the data is no longer necessary for the purpose for which it was collected
- When the owner withdraws consent
- When the data subject objects to the processing
- When it must be erased in compliance with a legal obligation
- When the data has been obtained by virtue of an information society service based on the provisions of art. 8 section 1 of the European Regulation on Data Protection.
Right to object: the right to object to a certain processing based on the data subject’s consent.
Right of restriction: the right to obtain the restriction of the processing of the data when any of the following cases occur:
- When the data subject contests the accuracy of the personal data, for a period that allows the company to verify its accuracy.
- When the processing is unlawful and the data subject objects to the erasure of the data.
- When the company no longer needs the data for the purposes for which it was collected, but the data subject needs it for the formulation, exercise or defense of claims.
- When the data subject has objected to the processing while it is verified whether the company’s legitimate grounds prevail over those of the data subject.

The data subjects may exercise the indicated rights by contacting Ecomanagement Technology, S.L., in writing, sent to the following address: lopd@ecomt.net indicating in the Subject line the right they wish to exercise.

In this regard, Ecomanagement Technology, S.L. will address your request as soon as possible and taking into account the periods provided for in the data protection regulations.

On the other hand, it should be borne in mind that the data subject or owner of the data may at any time file a complaint with the competent supervisory authority.

Security

The security measures adopted by Ecomanagement Technology, S.L. are those required, in accordance with the provisions of article 32 of the GDPR. In this regard, Ecomanagement Technology, S.L., taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of variable probability and severity for the rights and freedoms of natural persons, has established the appropriate technical and organizational measures to guarantee the level of security appropriate to the existing risk.

In any case, Ecomanagement Technology, S.L. has implemented sufficient mechanisms to:

Guarantee the permanent confidentiality, integrity, availability and resilience of the processing systems and services.
Restore the availability of and access to personal data quickly, in the event of a physical or technical incident.
Regularly verify, evaluate and assess the effectiveness of the technical and organizational measures implemented to guarantee the security of the processing.
Pseudonymize and encrypt personal data, where applicable.