I. PRIVACY AND DATA PROTECTION POLICY
In observation of that established in the current legislation, Editec Edicions (hereinafter, also the Website) undertakes to adopt the necessary technical and organizational measures, according to the level of security suitable for the risk to the data gathered.
- Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (RGPD).
- Organic Law 3/2018, of 5 December, on Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
- Royal Decree 1720/2007, of 21 December, which approves the Regulation of implementing Organic Law 15/1999, of 13 December, on the Protection of Personal Data (RDLOPD).
- Law 34/2002, of 11 July, on Information Society Services and E-commerce (LSSI-CE).
Identity of the personal data processing manager
The entity responsible for processing the personal data registered in Editec Edicions is: Tec Academic Multimedia SL, with NIF B61536686 and entered in the Barcelona Commercial Register in book 30.340, sheet 128, page B-173.150. Its representative is Elisabet Nualart Feliu (hereinafter, the Processing Manager) and her contact details are as follows:
Business address: Av. Diagonal 421, 6-2, 08008 Barcelona
Telephone number: 931 878 599
Email address: email@example.com
Personal Data Register
In compliance with that established in the RGPD and the LOPD-GDD, we inform you that the personal data gathered by Editec Edicions via the forms provided on its pages will be incorporated and processed in our file for the purpose of being able to facilitate, speed up and fulfil the commitments established between Editec Edicions and the User or the maintenance of the relationship established on the forms that the User fills in, or to attend to a request or consultation by this User. Moreover, in accordance with that envisaged in the RGPD and the LOPD-GDD, unless the exception envisaged in article 30.5 of the RGPD is applicable, a register of processing activities is kept that specifies, according to their purposes, the processing activities carried out and all other circumstances established in the RGPD.
Principles applicable in personal data processing
The processing of the User’s personal data will be subject to the following principles listed in article 5 of the RGPD and in article 4 et seq of Organic law 3/2018, of 5 December, on Protection of Personal Data and Guarantee of Digital Rights:
- Principle of legality, loyalty and transparency: the User’s consent will at all times be required, after being informed, completely transparently, of the purposes for which the personal data are gathered.
- Principle of purpose limitation: the personal data will be gathered for specific, explicit and legitimate purposes.
- Principle of data minimization: the personal data gathered will be only those strictly necessary in relation to the purposes for which they are processed.
- Principle of accuracy: the personal data must be accurate and always up to date.
- Principle of proactive responsibility: the Processing Manager will be responsible for ensuring that the above principles are complied with.
- Principle of storage limitation: the personal data shall only be stored in order to allow for the identification of the User for the period of time necessary for the purposes of their processing.
- Principle of integrity and confidentiality: the personal data will be processed in such a way that their security and confidentiality is guaranteed.
Categories of personal data
The categories of data that are processed at Editec Edicions are for identification purposes only. Under no circumstances are they special categories of personal data in the sense of article 9 of the RGPD.
Legal basis for processing personal data
The legal basis for processing personal data is consent. Editec Edicions undertakes to gather the User’s express and verifiable consent for the processing of his/her personal data for one or more specific purposes.
The User will have the right to withdraw his/her consent at any time. It will be as easy to withdraw consent as to grant it. As a general rule, withdrawal of consent will not determine use of the Website.
On the occasions when the User has to, or may provide his/her data on forms to make consultations, request information, or for reasons related to the content of the Website, he/she will be informed if completion of any of the forms is obligatory due to them being essential for the correct functioning of the operation.
Purposes of the processing of personal data
Personal data are gathered and managed by Editec Edicions for the purpose of being able to facilitate, speed up and fulfil the undertakings established between the Website and the User or the maintenance of the relationship established on the forms that the User fills in, or to attend to a request or consultation.
Likewise, the data may be used for a commercial purpose of operational and statistical personalization, and activities relevant to the corporate purpose of Editec Edicions, and for extraction and storage of data and marketing studies to adapt the Content offered to the User, and to improve the quality, workings, and navigation on the Website.
When the personal data are obtained, the User will be duly informed about the specific purpose or purposes of the processing of the personal data; that is, the use or uses that will be made of the information compiled.
Retention periods of personal data
The personal data will only be retained for the minimum amount of time necessary for the purposes of their processing and, in any case, for following period only: 18 months, or until the User asks for them to be deleted.
When the personal data are obtained, the User will be duly informed about the period during which the personal data will be stored or, when that is not possible, about the criteria used to determine this period.
Recipients of the personal data
The User’s personal data will not be shared with third parties.
In any case, when the personal data are obtained, the User will be duly informed about the recipients or the categories of recipients of the personal data.
Personal data of minors
In observation of that established in articles 8 of the RGPD and 7 of Organic Law 3/2018, of 5 December, on Protection of Personal Data and Guarantee of Digital Rights, only persons over the age of 14 may give their consent for the legal processing of their personal data by Editec Edicions. In the case of a minor under the age of 14, the consent of his/her parents or guardians will be necessary to process them, and this processing will only be regarded as legal if the said parents or guardians have authorized it.
Secrecy and security of personal data
Editec Edicions undertakes to adopt the necessary technical and organizational measures, according to the level of security suitable for the risk to the data gathered, in order to guarantee the security of the personal data, and to prevent the destruction, loss, or accidental or illegal alteration of personal data transmitted, stored or otherwise processed, or the unauthorized communication of or access to these data.
Notwithstanding that, since Editec Edicions is unable to guarantee the impregnability of internet or the total absence of hackers or others who may fraudulently access the personal data, the Processing Manager undertakes to notify the User forthwith when a security breach of the personal data takes place that probably entails a high risk for the rights and freedoms of natural persons. According to that laid down in article 4 of the RGPD, a security breach of personal data is taken to mean any security breach that may give rise to the destruction, loss or accidental or illegal alteration of personal data transmitted, stored or otherwise processed, or unauthorized communication of or access to these data.
The personal data will be treated as confidential by the Processing Manager, who undertakes to inform users, and to guarantee this by means of a legal or contractual obligation, that this confidentiality shall be observed by employees, associates and any person to whom the information is made accessible.
Rights derived from personal data processing
With regard to Editec Edicions, the User has the following rights, acknowledged in the RGPD and the Organic Law 3/2018, of 5 December, of Protection of Personal Data and Guarantee of Digital Rights, and he/she may therefore exercise them against the Processing Manager:
- Right of access: The User’s right to obtain confirmation of whether Editec Edicions is or is not processing his/her personal data and, if it is, to obtain information about his/her specific personal data, and the processing that has been made or may be made by Editec Edicions, and also about the information available about the origins of these personal data and the recipients of the communications that have been made or may be made of them.
- Right to rectification: The User’s right to have their personal data changed if they are inaccurate or, bearing in mind the purposes of the processing, incomplete.
- Right to erasure (“the right to be forgotten”): The User’s right, provided that the law in force does not say otherwise, to obtain the erasure of their personal data when they are no longer necessary for the purposes for which they were gathered or processed; when the User has withdrawn his/her consent and the data processing has no other legal basis; when the User objects to the processing and there is no other legitimate reason to continue it; when the personal data have been processed illegally; when the personal data must be erased in compliance with a legal obligation; or when the personal data have been obtained as a result of a direct offer of services of the information society to a minor under the age of 14. Besides erasing the data, the Processing Manager, bearing in mind the available technology and the cost of its application, must take reasonable steps to inform the people who are processing the personal data of the interested party’s request for the erasure of any link to these personal data.
- Right to restrict processing: The User’s right to restrict the processing of their personal data. The User is entitled to obtain the restriction of processing when they challenge the accuracy of their personal data; when the processing is illegal; when the Processing Manager no longer needs the personal data, but the User needs it to make complaints; and when the User has objected to this processing.
- Right to data portability: In the event that the processing is done by automated means, the User will have the right to receive from the Processing Manager their personal data in a structured, commonly used and machine readable format, and to transmit them to another processing manager. Provided it is technically possible, the Processing Manager will transmit the data to this other manager directly.
- Right to object: The User’s right to prevent Editec Edicions from processing his/her personal data or to make it cease processing the data.
- The right not to be subject to a decision based solely on automated processing, including profiling: The User’s right not to be subject to an individualized decision based solely on the automated processing of personal data, including profiling, existing unless the current law states otherwise.
Therefore, the User will be able to exercise his/her rights through a written communication addressed to the Processing Manager with the reference “RGPD-www.editec-ediciones.com”, stating:
- The User’s name and surname(s) and a copy of his/her identity document. In cases in which representation is accepted, the person representing the User will also have to identify him or herself in the same way, as well as providing their representation credentials. The photocopy of the identity document may be substituted by any other legally valid means that confirms identity.
- The document with the specific reasons for the request or the information to which access is desired.
- The home address for the purpose of sending notifications.
- The date and the signature of the person making the request.
- Any document that accredits the request formulated.
This request and any documents enclosed may be sent to following postal and/or email address:
Postal address: Av. Diagonal 421, 6-2, 08008 Barcelona
Email address: firstname.lastname@example.org
Links to third-party websites
The Website may include hyperlinks or links to allow access to third-party webpages other than Editec Edicions and which therefore are not operated by Editec Edicions. The owners of these websites will have their own data protection policies and in all cases they will be responsible for their own files and their own privacy practices.
Complaints to the governing body
In the event that the User considers that there is a problem or an infringement of the current law in the way their personal data are being processed, they will be entitled to effective legal protection and to submit a complaint to a governing body, in particular, in the country where they usually reside, their place of work or the place where the alleged infringement took place. In the case of Spain, the governing body is the Spanish Data Protection Agency (http://www.agpd.es).