1. Identification of the person responsible for the processing of personal data
| Responsible for the treatment | Cádiz Free Trade Zone Consortium |
|---|---|
|
Registered office |
C/Ronda de Vigilancia s/n. Headquarters Building
11011, Cadiz
|
|
NIF |
Q-1176004H |
|
Telephone |
956 290606 |
|
DPD (external) |
Professional Group Conversia, S.L.U c/Albasanz 16-2 Plant B -Oficina B. Ed. Antalia 28037, Madrid NIF B-17962655 Tel. 872987665 Email: info@conversia.es Email for the purposes of notification of breaches and exercise of rights: dpd@zonafrancacadiz.com |
The Cádiz Free Zone Consortium, hereinafter CZFC, by virtue of the provisions of the current REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data and by which Directive 95/46/EC (General Regulation) is repealed of data protection -RGPD-) and in Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), informs users of its corporate websites that their personal data will be incorporated into the CZFC information system and that said data will be subject to the following processing activities:
2. Processing activities through the website
ACTIVITY: ATR-027-ORGANIZATION OF CONFERENCES, PROTOCOLAR ACTS AND EVENTS
RESPONSIBLE ENTITY: Cádiz Free Trade Zone Consortium
PURPOSES OF TREATMENT:
- Organization of conferences, fairs, trade missions, business meetings and institutional events related to the entity's activity.
- Access control.
- Sending institutional or commercial communications or satisfaction surveys.
- Management of purchase or reservation of invitations to events.
LEGAL BASIS:
- GDPR: 6.1.a) The interested party gave their consent to the processing of their personal data for one or more specific purposes, such as sending advertising or newsletters.
- GDPR: 6.1.f) the processing is necessary for the satisfaction of legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the interested party that require the protection of personal data, in particular when the interested party is a child.
- GDPR: 6.1.c) Compliance with a legal obligation for billing and taxation, in the case of purchasing invitations or subscriptions to events.
CATEGORY OF INTERESTED PARTIES: Participants and attendees.
DATA CATEGORY:
- 011-Gen/Basic identifying data: name and surname, number. NIF/NIE, postal address, email, telephone number, number. vehicle registration,
- 015-Gen/Economic/financial: banking details, income, income, investments, credits, loans, guarantees, tax deductions, assets, real rights, inheritance rights or any other information that reveals economic and patrimonial situation
- 016-Gen-Non-biometric image/voice
CATEGORY OF RECIPIENTS: Banking entities (in case of payments) and Public Administrations (AEAT).
INTERNATIONAL TRANSFERS:
There are no transfers of your data to third countries outside the European Economic Area. However, in the case of using technology providers whose servers are located outside said territory, the Consortium guarantees that said transfers will be carried out under the Data Privacy Framework, standard contractual clauses approved by the European Commission or under the exceptions provided for in Art. 49 of the GDPR, always guaranteeing a level of protection equivalent to the European one.
DELETION PERIOD:
They will be kept for the time necessary to fulfill the purpose for which they were collected and, in any case, as long as the consent given is not revoked.
Data for promotional purposes will be retained until consent is revoked.
SECURITY MEASURES:
Security measures of Annex II of Royal Decree 311/2022, of May 3, which regulates the National Security Scheme in its medium category, as well as the UNE-EN ISO/IEC 27001 and UNE-EN ISO/IEC 27701 standards.
TREATMENT RESPONSIBILITIES: If applicable, ticketing service providers.
3. Information on the exercise of the rights of interested parties
Users who own personal data processed through the websites owned by the CZFC may exercise the rights referred to in Chapter III of the RGPD, as well as in Chapter II of Title III of the LOPDGDD in the following terms:
| Rights of the interested party | Art. RGPD | Succinct Definition | Exceptions / Key Notes |
|---|---|---|---|
|
Access |
Art. 15 |
Obtain confirmation from the controller as to whether or not your personal data is being processed and, if so, obtain a copy of the same and information on the processing (purposes, categories of data, recipients, retention period, existence of rights, etc.). |
It must not adversely affect the rights and freedoms of others. There may be costs if additional copies are requested. |
|
Rectification |
Art. 16 |
Obtain without undue delay the rectification of inaccurate personal data that concerns you or the completion of incomplete ones. |
The interested party must prove the inaccuracy or the need to complete the data. |
|
Suppression (Forgetting) |
Art. 17 |
Obtain the deletion of your personal data when, among other reasons, it is no longer necessary for the purposes for which it was collected, consent is withdrawn or the processing is unlawful. |
It does not apply when processing is necessary for compliance with a legal obligation, exercise of public functions, archiving purposes in the public interest, or the formulation, exercise or defense of claims. |
|
Limitation of Treatment |
Art. 18 |
Obtain the limitation of the processing of your data when the accuracy of the data is disputed (while it is verified), the processing is unlawful, the data controller no longer needs the data but the interested party needs it to exercise or defend claims, or has opposed the processing (while it is verified whether the legitimate reasons of the controller prevail). |
The data may only be processed for its conservation or with the consent of the interested party, or for the formulation, exercise or defense of claims. |
|
Data Portability |
Art. 20 |
Receive the personal data that concerns you, which you have provided to a person responsible, in a structured format, commonly used and machine readable, and to transmit it to another person responsible without impediment |
Only applicable to treatments based on consent or a contract, and carried out by automated means. |
|
Opposition |
Art. 21 |
Object at any time, for reasons related to your particular situation, to personal data that concerns you being processed. In particular, if the processing is based on legitimate interest or public interest mission, or for direct marketing purposes. |
The controller may continue processing the data if it proves legitimate reasons that prevail over the interests, rights and freedoms of the interested party, or for the formulation, exercise or defense of claims. The opposition to direct marketing is absolute. |
|
Not be subject to automated individual decisions, including profiling |
Art. 22 |
Not be subject to a decision based solely on the automated processing of your data, including profiling, that produces legal effects on you or significantly affects you in a similar way. |
It does not apply if the decision is necessary for the conclusion or performance of a contract, is authorized by law or is based on the explicit consent of the interested party. Appropriate measures must always be established to safeguard the rights and freedoms of the interested party. |
4. Form and requirements for exercising the rights of interested parties*
* The provisions of article 14 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, on the right and obligation to relate electronically with Public Administrations, will apply.Those interested parties who wish to exercise the rights described above may do so by sending a letter to the postal address Headquarters Building, Surveillance Round, s/n 11011 Cádiz or to the email address dpd@zonafrancacadiz.com in the following terms:
- The applicant must identify themselves reliably, and in the event that there are doubts about their identity, the CZFC reserves the right to request that they prove it through the legally and regulatory means authorized. In any case, the document must include the name, surname and DNI/NIE/passport number of the applicant;
- The applicant must clearly identify the right(s) they wish to exercise;
- In the event of exercising the rights of rectification, deletion, limitation, portability or opposition, the affected personal data must be indicated;
- When the processing has a purpose other than direct marketing, the well-founded and legitimate reasons for the right of opposition must be indicated;
- The applicant must indicate a means of contact for the purposes of notification and communications, either the postal address or the email address;
- The request letter must be accompanied by documentation proving the inaccuracy or insufficiency of the data for rectification; the withdrawal of consent or the illegality, if applicable, for the deletion;
- In the event of the death of the data owner, the heirs or relatives must provide the death certificate and accreditation of the link that grants them the right;
- Date and signature of the application document by the interested party or his representative; the electronic signature being preferable;