PRIVACY POLICY

JM PELEGRI SL shall ensure that the personal data of the data subject collected on the website are processed in accordance with the principles relating to processing:

•  Processed lawfully, fairly and transparently with respect to the data subject (“lawfulness, fairness and transparency”).

• Collected for specific, explicit and legitimate purposes, and may not be processed in a way incompatible with those purposes (“purpose limitation”).

• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”).

•  Accurate and, if necessary, updated by taking reasonable technical and organizational measures to delete or rectify them where they are inaccurate in relation to the purposes for which they are processed (“accuracy”).

•  Maintained in such a way as to allow identification for no longer than is necessary for the purposes of the processing (“storage limitation”).

•   Treated in such a way as to ensure adequate security through the application of appropriate technical or organizational measures (“integrity and confidentiality”).

• Thus, JM PELEGRI SL shall be responsible for compliance with the above provisions and shall be able to prove this subsequently (“proactive liability”).

Similarly, the processing carried out by the institution is lawful only if it meets at least one of the following conditions (“lawfulness of the processing”):

•  the data subject has consented to the processing of his or her personal data for one or more specific purposes;

•    processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures at the request of the data subject;

•      the processing is necessary for compliance with a legal obligation applicable to the controller;

•      processing is necessary for the protection of the vital interests of the data subject or of another natural person;

•    processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

• processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party, provided that those interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. That legitimate basis shall not apply to processing carried out by public authorities in the performance of their duties. Where the processing is based on the consent of the data subject, the controller must be able to prove that the data subject has consented to the processing of his or her personal data.

If the data subject’s consent is given in the context of a written declaration which also relates to other matters, the request for consent shall be presented in such a way as to be clearly distinguishable from other matters, in an intelligible and easily accessible manner and using clear and simple language.

The data subject shall have the right to withdraw his or her consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal. Before consent is given, the data subject shall be informed thereof. It will be as easy to withdraw consent as it is to give it.

JM PELEGRI SL must include in the forms used for the collection of personal data, the information required to comply with the duty of reporting set out in Articles 13 and 14 of the General Data Protection Regulation (hereinafter referred to as GDPR).

In this regard, and in order to comply with applicable and current data protection regulations, when JM PELEGRI SL obtains personal data directly from a data subject, it will have to:

1. Provide the identity and contact details of the Data Controller and, where applicable, its representative, the contact details of the Data Protection Officer, where applicable, and the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing.

2. Specify the legitimate interests of the controller or of a third party where processing is necessary for the satisfaction of those interests. Provided that they are not overridden by the interests or fundamental rights and freedoms of the person concerned.

3. Provide the recipients or categories of recipients of the personal data and, where applicable, the intention of the controller to transfer the personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission.

4. Indicate the period for which the personal data will be retained or the criteria used to determine the retention period.

5. Inform of the existence of the right to request from the Data Controller access to the personal data concerning the data subject, its rectification or deletion (“right to be forgotten”), the limitation of their processing or the right to object to the processing, as well as the portability of their data.

6. Provide information on the possibility of withdrawing consent at any time, without this affecting the lawfulness of processing based on consent prior to its withdrawal. As well as informing them of the possibility of lodging a complaint with a supervisory authority.

7. Specify whether the provision of personal data is a legal or contractual requirement, or a requirement necessary for entering into a contract, and whether the data subject is obliged to provide the personal data and provide information on the possible consequences of not providing such data.

8. To report on the existence of automated decisions, including profiling, and, at least in such cases, to report on the logic applied, as well as the significance and expected consequences of such processing for the data subject.

When JM PELEGRI SL does not obtain the personal data of the data subject, it will have to provide the information described in the previous paragraph. As well as the categories of personal data being processed, the source from which they originate and, where appropriate, whether they originate from publicly available sources.

JM PELEGRI SL must include in the forms or documents used for the collection of personal data, including those established on the website owned by JM PELEGRI SL, the information to comply with the duty to inform contained in Articles 13 and 14 of the General Data Protection Regulation (hereinafter referred to as GDPR), and, if necessary, record the consent granted by the data subject.

In order to reconcile the increased information requirement to be provided to the data subject whose personal data are to be processed, provision is made for the possibility of presenting the information using a tiered or tiered information model, which should be consistent with the requirement that the information be provided in clear, simple and concise, transparent, intelligible and easily accessible language.

Article 11 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), regulates the basic information that is required in a first layer.

The information by layers consists of:

•  Presentation of basic information (1st layer): This is the presentation of basic information at a first level, in summary form, at the same time and in the same medium as the data are collected.

•   Reference to Additional Information (2nd layer): This consists of a detailed and complete presentation of information in an appropriate, structured, concise and accurate medium. The way in which this additional information is presented depends on the characteristics of the medium used for reporting and may be presented in paper or electronic format.

PRIVACY POLICY OF www.jmpelegri.es

Data of the owner of the website:

Data protection

In accordance with current and applicable regulations on the protection of personal data, we inform you that your data will be incorporated into the processing system owned by JM PELEGRI SL with NIF B17098948 and registered office located in CL SARDEÑA N 17 BAJOS,17007 GIRONA(GIRONA). Here are the highlights of the treatments performed:

JM PELEGRI SL informs the Users that they may exercise their rights of access, rectification, limitation, deletion, portability, opposition to the processing of their personal data and the right not to be subject to automated decisions, including profiling, before the Data Controller, as well as to withdraw the consent given.

• Right of Access: This is the right of the user to obtain confirmation as to whether their data is being processed and, if so, the specific personal data processed and the legal information of the processing (purposes, legitimizing basis, retention periods, assignments, origin of the data, etc.).

• Right to Rectification: This is the right of the data subject to change if the data is inaccurate or incomplete. With regard to the website, it may only be satisfied in relation to that information that is under the control of the website, for example, the deletion of comments posted on the website itself, images or web contents containing personal data of the user.

• Right to Restriction of Processing: This is the right to restrict the purposes of processing originally envisaged by the controller in certain circumstances.

• Right to erasure: This is the right to erase the user’s personal data, with the exception of the provisions of the GDPR itself (freedom of expression and information, retention obligations, formulation, exercise or defence of complaints, etc.).

• Right to Portability: The right to receive the personal data that the user has provided, in a structured, commonly used and machine-readable format, and to transmit them to another controller when the processing is based on consent or in the performance of a contract and is carried out by automated means.

• Right of Objection: This is the right of the user not to carry out the processing of their personal data or to stop the processing of them by the website when the processing is based on legitimate interest or the public interest or when it is a question of direct marketing processing.

• Right not to be subject to automated decisions, including profiling: Where processing is not necessary for the conclusion or performance of a contract, is not authorised by European Union or Member State law or is based on consent, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you in a similar way.

• Right to withdraw consent: For any processing based on your consent, you have the right to withdraw it, at any time and free of charge.

To exercise any of the data protection rights described above, you must follow the following instructions:

 • Submission of a letter to the address CL SARDEÑA N 17 BAJOS, 17007 GIRONA (GIRONA) (to the attention of JM PELEGRI SL) or by e-mail to pelegri@copdec.es

• The letter sent by the holder of the personal data (data subject) requesting the exercise of rights must take into account the following:

o You must authentically identify yourself and, if there is any doubt about the identity of the applicant, you will be asked to rectify the request (e.g. by requesting more information, such as the ID number, the ID document, the email you provided, etc.)

o The request may be made by the representative, legal or voluntary, when the latter is duly identified and authorised by the data subject (by means of an express authorisation by the data subject to exercise the very personal rights regulated by the regulations on the protection of personal data).

o Petition specifying the request (Right(s) to be exercised). If you do not refer to a specific processing, you will be provided with an answer regarding all processing that affects your personal data. If you request information about a particular treatment, only the information about it. If you request it by phone, you will be instructed to do so in writing and will be told how to do so and the address to which you should send it. You will never be given information over the phone.

o Postal or electronic address for notification purposes.

o Evidence of the request made, in the event that are necessary

o The applicant must use any means capable of attesting to the sending and receipt of the application.

Finally, we inform you that you have the right to lodge a complaint with the Spanish Data Protection Agency in the event that you become aware of or consider that an event may imply a breach of applicable data protection regulations.

JM PELEGRI SL undertakes to adopt the necessary technical and organizational measures, according to the level of risks associated with the treatments carried out by them and indicated in the section of the terms and conditions of use, in order to guarantee their integrity, confidentiality and availability.