PRIVACY POLICY

COMERCIAL COPAIN SA shall ensure that the personal data of the data subject are processed in accordance with the principles relating to processing:

  • Processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency").
  • Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes ("purpose limitation").
  • Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimization").
  • Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified ("accuracy").
  • Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ("storage limitation").
  • Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures ("integrity and confidentiality").

Thus, COMERCIAL COPAIN SA shall be responsible for ensuring compliance with the above and shall be able to demonstrate such compliance subsequently ("accountability").

Likewise, the processing carried out by the entity shall only be lawful if at least one of the following conditions is met ("lawfulness of processing"):

  • the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
  • processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  • processing is necessary for compliance with a legal obligation to which the controller is subject;
  • processing is necessary in order to protect the vital interests of the data subject or of another natural person;
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Such legitimate interest shall not apply to processing carried out by public authorities in the performance of their tasks. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Before giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

Likewise, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data directed to uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall only be processed under the conditions laid down in Article 9 of the GDPR.

Processing of personal data relating to criminal convictions and offences or related security measures shall only be carried out under the supervision of the public authorities or when authorized by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.

COMERCIAL COPAIN SA shall include in the forms used for the collection of personal data, the information necessary to comply with the duty to inform as set out in Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR).

In this regard, and in order to comply with the applicable and current regulations on data protection, when COMERCIAL COPAIN SA obtains personal data directly from a data subject, it shall:

  • 1- Provide the identity and contact details of the Data Controller and, where applicable, of its representative, the contact details of the Data Protection Officer, where applicable, and the purposes of the processing to which the personal data are intended, as well as the legal basis for the processing.
  • 2- Specify the legitimate interests pursued by the controller or by a third party when the processing is necessary for the purposes of those interests. Provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
  • 3- Provide the recipients or categories of recipients of the personal data and, where applicable, the intention of the controller to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission.
  • 4- Indicate the period for which the personal data will be stored or the criteria used to determine that period.
  • 5- Inform about the existence of the right to request the Data Controller access to personal data concerning the data subject, their rectification or erasure ("right to be forgotten"), the restriction of processing or the right to object to processing, as well as the right to data portability.
  • 6- Inform about the possibility of withdrawing consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. As well as, inform the data subject about the possibility of lodging a complaint with a Supervisory Authority.
  • 7- Specify whether the provision of personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract and whether the data subject is obliged to provide the personal data and inform about the possible consequences of not providing such data.
  • 8- Inform about the existence of automated decisions, including profiling, and, at least in such cases, provide information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

If COMERCIAL COPAIN SA does not obtain personal data from the data subject, it shall provide the information described in the preceding section. As well as the categories of personal data processed, the source from which they originate, and, if applicable, whether they come from publicly accessible sources.

If COMERCIAL COPAIN SA obtains personal data directly from the data subject, the information must be made available to them at the time the data is requested, prior to collection or registration. In cases where the data is not obtained directly from the data subject, but through a legitimate transfer or from publicly accessible sources, COMERCIAL COPAIN SA shall inform the data subjects within a reasonable period, but in any case, no later than one month after the personal data were obtained, in the first communication with the data subject or before the data, if applicable, are communicated to other recipients.

When COMERCIAL COPAIN SA plans to further process personal data for a purpose other than that for which it was obtained, it shall provide the data subject, prior to such further processing, with information about that other purpose and any other relevant information.