I. PRIVACY POLICY AND PROTECTION OF PERSONAL DATA
www.cecarn.com
1. PERSONAL DATA PROTECTION POLICY
CECARN SA is an Organization that collects personal data through the different means at its disposal, which gives it significant responsibility in the design and organization of procedures, so that they are aligned with legal compliance in Data Protection. Therefore, CECARN SA will adopt all necessary security measures to ensure the protection of the data collected.
In the exercise of these responsibilities, and in order to establish the general principles that must govern the processing of personal data in the Organization, CECARN SA approves this Personal Data Protection Policy, which it notifies and makes available to all its interest groups, also respecting the following rules:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
- Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
- Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE).
2. SCOPE OF APPLICATION
This Personal Data Protection Policy will apply to CECARN SA, its administrative, management and staff bodies, as well as to all persons who have a relationship with CECARN SA, expressly including service providers with access to data (“Data Processors”).
The person responsible for the processing of personal data collected by CECARN SA is: CECARN SA, with NIF/CIF: A59103432 and registered in: COMMERCIAL REGISTRY OF with the following registration details: VOLUME 24294, FOLIO 52, SECTION 8, SHEET B70092, whose representative is: Mr. Pere Rosell (hereinafter, Data Controller). Their contact details are as follows:
Address: PI VILANOVETA C/ RABASSAIRES, 18
Contact phone number: 938933454
Contact email: pere@cecarn.com
3. INFORMATION ABOUT THE CONTROLLER AND PROCESSING OF PERSONAL DATA AT CECARN SA
| ADDITIONAL INFORMATION ON DATA PROTECTION | |||
| Who is responsible for the processing of your data? | |||
| Identity: | CECARN SA – A59103432 | ||
| Postal Address: | PI VILANOVETA C/ RABASSAIRES, 18, 08812 SANT PERE DE RIBES BARCELONA | ||
| Phone: | 938933454 | ||
| Email: | pere@cecarn.com | ||
| For what purpose do we process your personal data? | |||
| At CECARN SA we use the information provided by our stakeholders for the following treatments: | |||
| Data processing | Purpose of the treatment | Data retention period | |
| WEB FORM | CUSTOMER, ACCOUNTING, TAX AND ADMINISTRATIVE MANAGEMENT No automated decisions will be made based on this profile. | The personal data processed will be kept in any case as long as they are necessary for the purpose of the processing, and will be deleted at the request of the interested party, or once the processing has been completed, without prejudice to their conservation for the periods established in the applicable regulations to address possible liabilities. | |
| What is the legitimacy for their processing? | |||
| The legal bases for the processing of personal data at CECARN SA are as follows: | |||
| Data processing | Legitimation of treatment | ||
| WEB FORM | Consent of the interested party, which may be withdrawn at any time, without affecting the legality of the processing based on the consent prior to its withdrawal. | ||
| To which recipients will your data be communicated? | |||
| The performance of these treatments may involve the connection of your data with treatments carried out by third parties. We inform you below of the provisions regarding the transfer of your data. | |||
| Data processing | Forecast of transfers | International transfers | |
| WEB FORM | Your data will not be communicated to third parties, except under legal obligation. | No data will be transferred outside the EU. | |
| What are your rights when you provide us with your data? | |||
| Any person has the right to obtain confirmation as to whether CECARN SA is processing personal data concerning him or her or not. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested persons may request that the processing of their data be limited, in which case we will only retain it for the exercise or defence of claims. In certain circumstances, and for reasons related to their particular situation, interested persons may object to the processing of their data. CECARN SA will stop processing the data, except for legitimate and compelling reasons, or in the exercise or defence of possible claims. Likewise, in certain circumstances and when technically possible, interested persons have the right to have their personal data transmitted directly to another controller, upon request. To exercise these rights, you must contact us by writing to: CECARN SA, PI VILANOVETA C/ RABASSAIRES, 18 08812 SANT PERE DE RIBES BARCELONA, or by e-mail to pere@cecarn.com accompanied by a copy of your ID. Likewise, you can contact the Spanish Data Protection Agency to file a complaint, especially if you have not obtained satisfaction in the exercise of your rights on our part. | |||
| ADDITIONAL INFORMATION ON DATA PROTECTION | |||
| Who is responsible for the processing of your data? | |||
| Identity: | CECARN SA – A59103432 | ||
| Postal Address: | PI VILANOVETA C/ RABASSAIRES, 18, 08812 SANT PERE DE RIBES BARCELONA | ||
| Phone: | 938933454 | ||
| Email: | pere@cecarn.com | ||
| For what purpose do we process your personal data? | |||
| At CECARN SA we use the information provided by our stakeholders for the following treatments: | |||
| Data processing | Purpose of the treatment | Data retention period | |
| ONLINE CUSTOMERS | CUSTOMER, ACCOUNTING, TAX AND ADMINISTRATIVE MANAGEMENT No automated decisions will be made based on this profile. ELECTRONIC COMMERCE No automated decisions will be made based on this profile. | The personal data processed will be kept in any case as long as they are necessary for the purpose of the processing, and will be deleted at the request of the interested party, or once the processing has ended, without prejudice to their conservation for the periods established in Tax Legislation to address possible liabilities. | |
| What is the legitimacy for their processing? | |||
| The legal bases for the processing of personal data at CECARN SA are as follows: | |||
| Data processing | Legitimation of treatment | ||
| ONLINE CUSTOMERS | Execution of the Contract: PURCHASE AND SALE AND/OR PROVISION OF SERVICES. If you do not provide your data, the agreed service cannot be provided. | ||
| To which recipients will your data be communicated? | |||
| The performance of these treatments may involve the connection of your data with treatments carried out by third parties. We inform you below of the provisions regarding the transfer of your data. | |||
| Data processing | Forecast of transfers | International transfers | |
| ONLINE CUSTOMERS | The data will be communicated to: PUBLIC ADMINISTRATION WITH COMPETENCE IN THE MATTER BANKING OR FINANCIAL ENTITIES | No data will be transferred outside the EU. | |
| What are your rights when you provide us with your data? | |||
| Any person has the right to obtain confirmation as to whether CECARN SA is processing personal data concerning him or her or not. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested persons may request that the processing of their data be limited, in which case we will only retain it for the exercise or defence of claims. In certain circumstances, and for reasons related to their particular situation, interested persons may object to the processing of their data. CECARN SA will stop processing the data, except for legitimate and compelling reasons, or in the exercise or defence of possible claims. Likewise, in certain circumstances and when technically possible, interested persons have the right to have their personal data transmitted directly to another controller, upon request. To exercise these rights, you must contact us by writing to: CECARN SA, PI VILANOVETA C/ RABASSAIRES, 18 08812 SANT PERE DE RIBES BARCELONA, or by e-mail to pere@cecarn.com accompanied by a copy of your ID. Likewise, you can contact the Spanish Data Protection Agency to file a complaint, especially if you have not obtained satisfaction in the exercise of your rights on our part. | |||
| ADDITIONAL INFORMATION ON DATA PROTECTION | |||
| Who is responsible for the processing of your data? | |||
| Identity: | CECARN SA – A59103432 | ||
| Postal Address: | PI VILANOVETA C/ RABASSAIRES, 18, 08812 SANT PERE DE RIBES BARCELONA | ||
| Phone: | 938933454 | ||
| Email: | pere@cecarn.com | ||
| For what purpose do we process your personal data? | |||
| At CECARN SA we use the information provided by our stakeholders for the following treatments: | |||
| Data processing | Purpose of the treatment | Data retention period | |
| BILLING AND ACCOUNTING | CUSTOMER, ACCOUNTING, TAX AND ADMINISTRATIVE MANAGEMENT No automated decisions will be made based on this profile. | The personal data processed will be kept in any case as long as they are necessary for the purpose of the processing, and will be deleted at the request of the interested party, or once the processing has ended, without prejudice to their conservation for the periods established in Tax Legislation to address possible liabilities. | |
| What is the legitimacy for their processing? | |||
| The legal bases for the processing of personal data at CECARN SA are as follows: | |||
| Data processing | Legitimation of treatment | ||
| BILLING AND ACCOUNTING | Execution of the Contract: PURCHASE AND SALE AND/OR PROVISION OF SERVICES. If you do not provide your data, the agreed service cannot be provided. | ||
| To which recipients will your data be communicated? | |||
| The performance of these treatments may involve the connection of your data with treatments carried out by third parties. We inform you below of the provisions regarding the transfer of your data. | |||
| Data processing | Forecast of transfers | International transfers | |
| BILLING AND ACCOUNTING | The data will be communicated to: PUBLIC ADMINISTRATION WITH COMPETENCE IN THE MATTER BANKING OR FINANCIAL ENTITIES | No data will be transferred outside the EU. | |
| What are your rights when you provide us with your data? | |||
| Any person has the right to obtain confirmation as to whether CECARN SA is processing personal data concerning him or her or not. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested persons may request that the processing of their data be limited, in which case we will only retain it for the exercise or defence of claims. In certain circumstances, and for reasons related to their particular situation, interested persons may object to the processing of their data. CECARN SA will stop processing the data, except for legitimate and compelling reasons, or in the exercise or defence of possible claims. Likewise, in certain circumstances and when technically possible, interested persons have the right to have their personal data transmitted directly to another controller, upon request. To exercise these rights, you must contact us by writing to: CECARN SA, PI VILANOVETA C/ RABASSAIRES, 18 08812 SANT PERE DE RIBES BARCELONA, or by e-mail to pere@cecarn.com accompanied by a copy of your ID. Likewise, you can contact the Spanish Data Protection Agency to file a complaint, especially if you have not obtained satisfaction in the exercise of your rights on our part. | |||
| ADDITIONAL INFORMATION ON DATA PROTECTION | |||
| Who is responsible for the processing of your data? | |||
| Identity: | CECARN SA – A59103432 | ||
| Postal Address: | PI VILANOVETA C/ RABASSAIRES, 18, 08812 SANT PERE DE RIBES BARCELONA | ||
| Phone: | 938933454 | ||
| Email: | pere@cecarn.com | ||
| For what purpose do we process your personal data? | |||
| At CECARN SA we use the information provided by our stakeholders for the following treatments: | |||
| Data processing | Purpose of the treatment | Data retention period | |
| WORKERS | PAYROLL MANAGEMENT No automated decisions will be made based on this profile. HUMAN RESOURCES No automated decisions will be made based on this profile. PREVENTION OF OCCUPATIONAL RISKS No automated decisions will be made based on this profile. | The personal data processed will be kept in any case as long as they are necessary for the purpose of the processing, and will be deleted at the request of the interested party, or once the processing has ended, without prejudice to their conservation for the periods established in Labor Legislation to address possible liabilities. | |
| What is the legitimacy for their processing? | |||
| The legal bases for the processing of personal data at CECARN SA are as follows: | |||
| Data processing | Legitimation of treatment | ||
| WORKERS | Execution of the Contract: EMPLOYMENT. Failure to provide your details will result in the agreed service not being provided. | ||
| To which recipients will your data be communicated? | |||
| The performance of these treatments may involve the connection of your data with treatments carried out by third parties. We inform you below of the provisions regarding the transfer of your data. | |||
| Data processing | Forecast of transfers | International transfers | |
| WORKERS | The data will be communicated to: PUBLIC ADMINISTRATION WITH COMPETENCE IN THE MATTER BANKING OR FINANCIAL ENTITIES | No data will be transferred outside the EU. | |
| What are your rights when you provide us with your data? | |||
| Any person has the right to obtain confirmation as to whether CECARN SA is processing personal data concerning him or her or not. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested persons may request that the processing of their data be limited, in which case we will only retain it for the exercise or defence of claims. In certain circumstances, and for reasons related to their particular situation, interested persons may object to the processing of their data. CECARN SA will stop processing the data, except for legitimate and compelling reasons, or in the exercise or defence of possible claims. Likewise, in certain circumstances and when technically possible, interested persons have the right to have their personal data transmitted directly to another controller, upon request. To exercise these rights, you must contact us by writing to: CECARN SA, PI VILANOVETA C/ RABASSAIRES, 18 08812 SANT PERE DE RIBES BARCELONA, or by e-mail to pere@cecarn.com accompanied by a copy of your ID. Likewise, you can contact the Spanish Data Protection Agency to file a complaint, especially if you have not obtained satisfaction in the exercise of your rights on our part. | |||
| ADDITIONAL INFORMATION ON DATA PROTECTION | |||
| Who is responsible for the processing of your data? | |||
| Identity: | CECARN SA – A59103432 | ||
| Postal Address: | PI VILANOVETA C/ RABASSAIRES, 18, 08812 SANT PERE DE RIBES BARCELONA | ||
| Phone: | 938933454 | ||
| Email: | pere@cecarn.com | ||
| For what purpose do we process your personal data? | |||
| At CECARN SA we use the information provided by our stakeholders for the following treatments: | |||
| Data processing | Purpose of the treatment | Data retention period | |
| RECORD OF WORKING DAY | HUMAN RESOURCES No automated decisions will be made based on this profile. | The personal data processed will be kept in any case as long as they are necessary for the purpose of the processing, and will be deleted at the request of the interested party, or once the processing has ended, without prejudice to their conservation for the periods established in Labor Legislation to address possible liabilities. | |
| What is the legitimacy for their processing? | |||
| The legal bases for the processing of personal data at CECARN SA are as follows: | |||
| Data processing | Legitimation of treatment | ||
| RECORD OF WORKING DAY | Legal Obligation: Labor Legislation. Failure to provide your data will result in the agreed service not being provided. | ||
| To which recipients will your data be communicated? | |||
| The performance of these treatments may involve the connection of your data with treatments carried out by third parties. We inform you below of the provisions regarding the transfer of your data. | |||
| Data processing | Forecast of transfers | International transfers | |
| RECORD OF WORKING DAY | The data will be communicated to: PUBLIC ADMINISTRATION WITH COMPETENCE IN THE MATTER | No data will be transferred outside the EU. | |
| What are your rights when you provide us with your data? | |||
| Any person has the right to obtain confirmation as to whether CECARN SA is processing personal data concerning him or her or not. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested persons may request that the processing of their data be limited, in which case we will only retain it for the exercise or defence of claims. In certain circumstances, and for reasons related to their particular situation, interested persons may object to the processing of their data. CECARN SA will stop processing the data, except for legitimate and compelling reasons, or in the exercise or defence of possible claims. Likewise, in certain circumstances and when technically possible, interested persons have the right to have their personal data transmitted directly to another controller, upon request. To exercise these rights, you must contact us by writing to: CECARN SA, PI VILANOVETA C/ RABASSAIRES, 18 08812 SANT PERE DE RIBES BARCELONA, or by e-mail to pere@cecarn.com accompanied by a copy of your ID. Likewise, you can contact the Spanish Data Protection Agency to file a complaint, especially if you have not obtained satisfaction in the exercise of your rights on our part. | |||
| ADDITIONAL INFORMATION ON DATA PROTECTION | |||
| Who is responsible for the processing of your data? | |||
| Identity: | CECARN SA – A59103432 | ||
| Postal Address: | PI VILANOVETA C/ RABASSAIRES, 18, 08812 SANT PERE DE RIBES BARCELONA | ||
| Phone: | 938933454 | ||
| Email: | pere@cecarn.com | ||
| For what purpose do we process your personal data? | |||
| At CECARN SA we use the information provided by our stakeholders for the following treatments: | |||
| Data processing | Purpose of the treatment | Data retention period | |
| CURRICULUMS | HUMAN RESOURCES No automated decisions will be made based on this profile. | The personal data processed will be kept in any case as long as they are necessary for the purpose of the processing, and will be deleted at the request of the interested party, or once the processing has been completed, without prejudice to their conservation for the periods established in the applicable regulations to address possible liabilities. | |
| What is the legitimacy for their processing? | |||
| The legal bases for the processing of personal data at CECARN SA are as follows: | |||
| Data processing | Legitimation of treatment | ||
| CURRICULUMS | Consent of the interested party, which may be withdrawn at any time, without affecting the legality of the processing based on the consent prior to its withdrawal. | ||
| To which recipients will your data be communicated? | |||
| The performance of these treatments may involve the connection of your data with treatments carried out by third parties. We inform you below of the provisions regarding the transfer of your data. | |||
| Data processing | Forecast of transfers | International transfers | |
| CURRICULUMS | Your data will not be communicated to third parties, except under legal obligation. | No data will be transferred outside the EU. | |
| What are your rights when you provide us with your data? | |||
| Any person has the right to obtain confirmation as to whether CECARN SA is processing personal data concerning him or her or not. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested persons may request that the processing of their data be limited, in which case we will only retain it for the exercise or defence of claims. In certain circumstances, and for reasons related to their particular situation, interested persons may object to the processing of their data. CECARN SA will stop processing the data, except for legitimate and compelling reasons, or in the exercise or defence of possible claims. Likewise, in certain circumstances and when technically possible, interested persons have the right to have their personal data transmitted directly to another controller, upon request. To exercise these rights, you must contact us by writing to: CECARN SA, PI VILANOVETA C/ RABASSAIRES, 18 08812 SANT PERE DE RIBES BARCELONA, or by e-mail to pere@cecarn.com accompanied by a copy of your ID. Likewise, you can contact the Spanish Data Protection Agency to file a complaint, especially if you have not obtained satisfaction in the exercise of your rights on our part. | |||
| ADDITIONAL INFORMATION ON DATA PROTECTION | |||
| Who is responsible for the processing of your data? | |||
| Identity: | CECARN SA – A59103432 | ||
| Postal Address: | PI VILANOVETA C/ RABASSAIRES, 18, 08812 SANT PERE DE RIBES BARCELONA | ||
| Phone: | 938933454 | ||
| Email: | pere@cecarn.com | ||
| For what purpose do we process your personal data? | |||
| At CECARN SA we use the information provided by our stakeholders for the following treatments: | |||
| Data processing | Purpose of the treatment | Data retention period | |
| VIDEO SURVEILLANCE | VIDEO SURVEILLANCE No automated decisions will be made based on this profile. | The personal data processed will be kept in any case as long as they are necessary for the purpose of the processing, and will be deleted at the request of the interested party, or once the processing has ended, without prejudice to their conservation for the periods established in the Private Security Regulations to address possible liabilities. | |
| What is the legitimacy for their processing? | |||
| The legal bases for the processing of personal data at CECARN SA are as follows: | |||
| Data processing | Legitimation of treatment | ||
| VIDEO SURVEILLANCE | Public Interest: VIDEO SURVEILLANCE. | ||
| To which recipients will your data be communicated? | |||
| The performance of these treatments may involve the connection of your data with treatments carried out by third parties. We inform you below of the provisions regarding the transfer of your data. | |||
| Data processing | Forecast of transfers | International transfers | |
| VIDEO SURVEILLANCE | The data will be communicated to: PUBLIC ADMINISTRATION WITH COMPETENCE IN THE MATTER | No data will be transferred outside the EU. | |
| What are your rights when you provide us with your data? | |||
| Any person has the right to obtain confirmation as to whether CECARN SA is processing personal data concerning him or her or not. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, interested persons may request that the processing of their data be limited, in which case we will only retain it for the exercise or defence of claims. In certain circumstances, and for reasons related to their particular situation, interested persons may object to the processing of their data. CECARN SA will stop processing the data, except for legitimate and compelling reasons, or in the exercise or defence of possible claims. Likewise, in certain circumstances and when technically possible, interested persons have the right to have their personal data transmitted directly to another controller, upon request. To exercise these rights, you must contact us by writing to: CECARN SA, PI VILANOVETA C/ RABASSAIRES, 18 08812 SANT PERE DE RIBES BARCELONA, or by e-mail to pere@cecarn.com accompanied by a copy of your ID. Likewise, you can contact the Spanish Data Protection Agency to file a complaint, especially if you have not obtained satisfaction in the exercise of your rights on our part. | |||
4. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA
The Personal Data Protection Policy is a measure of Proactive responsibility, which aims to ensure compliance with the applicable legislation in this matter and, in relation to this, respect for the right to honour and privacy in the processing of personal data of all persons who are related to CECARN SA.
Pursuant to the provisions of this Policy, the Principles that govern the processing of data in the organization are established and, consequently, the procedures and organizational and security measures that the persons affected by this Policy undertake to implement within their area of responsibility.
In relation to the above, CECARN SA will ensure compliance with the following Principles:
- Legality, loyalty, transparency and limitation of purpose.
Data processing must always be communicated to the affected person, through established clauses and procedures; and it will only be considered legitimate if there is consent for the processing of data (with special attention to that given by minors), or there is another valid legitimation, and the purpose of the same is in accordance with the applicable regulations.
- Data minimization.
The data processed must be adequate, relevant and limited to what is necessary in relation to the different purposes of the processing.
- Accuracy.
The data must be accurate and, where necessary, updated. In this regard, the necessary measures will be taken to ensure that any personal data that are inaccurate with respect to the purposes of the processing are deleted or rectified without delay.
- Limitation of the conservation period.
The data will be kept in a way that allows the identification of the interested parties for no longer than necessary for the purpose of the processing in question.
- Integrity and Confidentiality.
Personal data will be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical or organizational measures.
- Data transfers.
The purchase or obtaining of personal data from illegitimate sources is prohibited, or in cases where such data has been collected or transferred in violation of the law or its legitimate origin is not sufficiently guaranteed.
- Hiring suppliers with access to data.
Only suppliers offering sufficient guarantees to apply appropriate technical and security measures in data processing will be selected for contracting. The appropriate Contract in this regard will be documented with these suppliers.
- International data transfers.
Any processing of personal data subject to European Union regulations that involves a transfer of data outside the European Economic Area must be carried out in strict compliance with the requirements established in the applicable law.
- Rights of affected users.
The Company will facilitate the exercise of the rights of access, rectification, deletion, limitation of processing, opposition and portability to the affected persons, establishing internal procedures for this purpose, and in particular, the models that are necessary and appropriate for their exercise, which must satisfy, at least, the legal requirements applicable in each case.
CECARN SA will promote that the principles set out in this Personal Data Protection Policy are taken into account:
- In the design and implementation of all work procedures
- In the products and services offered
- In all contracts and obligations that they formalize or assume and
- In the implementation of any systems and platforms that allow access to your plan by employees or third parties and/or the collection or processing of personal data.
5. PERSONAL DATA OF MINORS
In compliance with the provisions of articles 8 of the GDPR and 7 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights, only those over 14 years of age may give their consent for the lawful processing of their personal data by CECARN SA. If the person is under 14 years of age, the consent of the parents or guardians will be required for the processing, and this will only be considered lawful to the extent that they have authorized it.
6. SECRECY AND SECURITY OF PERSONAL DATA
The Website has an SSL (Secure Socket Layer) certificate, which ensures that personal data is transmitted securely and confidentially, as the transmission of data between the server and the User is fully encrypted.
However, since CECARN SA cannot guarantee the total security of the Internet, or the absence of hackers or others who fraudulently access personal data, the Data Controller undertakes to notify the User, without undue delay, when a personal data security breach occurs that is likely to entail a high risk for their rights and freedoms. Pursuant to Article 4 of the GDPR, a personal data security breach is understood to mean any breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or unauthorized communication or access to such data.
Personal data will be treated as confidential by the Data Controller, who undertakes to inform and guarantee by means of a legal or contractual obligation that said confidentiality is respected by its employees, associates, and any person to whom it makes the information accessible.
7. COMMITMENT OF CECARN SA STAFF
For the above, we state that the workers of CECARN SA are informed of this Policy, and declare that they are aware that personal information is an asset of CECARN SA, and in this regard they adhere to it, committing to the following:
- Take the Data Protection awareness training that CECARN SA makes available to you.
- Apply the user-level security measures that apply to your job, without prejudice to the responsibilities in their design and implementation that may be attributed to you based on your role within CECARN SA
- Use the established formats for the exercise of Rights by affected users, and inform CECARN SA immediately, so that the response can be effective.
- Inform CECARN SA, as soon as it becomes aware, of deviations from the provisions of this Policy, in particular “Violations of personal data security”, using the format established for this purpose.
8. CONTROL AND EVALUATION
CECARN SA will carry out an annual verification, evaluation and assessment, as well as each time there are significant changes in data processing, of the effectiveness of the technical and organisational measures to guarantee the security of the processing.
Below CECARN SA provides you with its data protection policy, also offering you information on the data processing it carries out.
CECARN S.A.