INTRODUCTION

This Privacy Policy has been developed in accordance with Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the movement of such data (hereinafter, “GDPR”). The purpose of this Privacy Policy is to advise the owners of personal data, as to whom information may be collected, about the specific aspects concerning their data processing, among other matters, the purpose of processing, the contact data to exercise the rights to which they are entitled, the terms to retain the information and security measures, among others.

DATA CONTROLLER

In relation to data protection, Estudio Chaves & Asociados S.L. should be deemed a data controller of the files/processes that it manages. Below are the identification data of the owner of this website:

• Data controller: Estudio Chaves & Asoc., S.L.
• Registered office: Islas Canarias 27 – 28691 Villanueva de la Cañada (Madrid)
• Tax Identification No. (NIF): ESB02821619
• Telephone: +34 911 236 994
• E-mail: info@estudio-chaves.com

DATA PROCESSING

The personal data requested, as applicable, shall consist only of those strictly fundamental to identify and process the request made by the owner of such data (hereinafter, the “data subject”). Such information shall be processed in a loyal, lawful and transparent manner in relation to the data subject. In addition, personal data shall be collected for the specific, express and legitimate purposes and shall not be processed subsequently in a manner contradicting those purposes.

The data collected from each data subject shall be adequate, relevant and not excessive in relation to the intended purposes in each case and shall be updated as required.

The data owner shall be informed, prior to data collection, about the general provisions governed by this Policy, so as to provide express, accurate and unequivocal consent for his/her data processing, as established below.

a. Purpose of processing

The express purposes for which data are processed are included in the informative clauses incorporated in each data collection channel (web forms, paper forms, voice-over or signs and informative notes).

However, the data subject’s personal data shall be processed for the exclusive purpose of providing an effective response and managing the requests made by the user, as specified along with the option, service, form or data collection system used by the owner.

b. Legitimacy

As a general rule, prior to personal data processing, Estudio Chaves & Asociados S.L. obtains the express and unequivocal consent of the data owner by incorporating informed consent clauses in the different information collection systems.

However, if the consent of the data subject is not required, the basis for processing legitimacy that supports Estudio Chaves & Asociados S.L. is the existence of a law or specific standard authorizing or demanding the data subject’s data processing.

c. Recipients

As a general rule, Estudio Chaves & Asociados S.L. does not assign or communicate the data to third-party entities, except as legally required. However, if necessary, those data assignments or communications shall be notified to the data subject through the informed consent clauses contained in the different channels for personal data collection.

d. Origin

As a general rule, personal data are always collected directly from the data subject; however, there are exceptions in which data may be collected through third parties, entities or services other than the data subject. In this sense, this situation shall be communicated to the data subject through the informed consent clauses contained in the different channels for personal data collection within a reasonable term, once data are obtained, and no later than a term of one month.

e. Retention terms

The information collected by the data subject shall be retained as required to meet the purposes for which the personal data were collected. Once the purpose is met, the data shall be cancelled. Such cancellation shall cause the data to be blocked, being available only to public administration authorities, courts and tribunals for any potential liability arising from the processing during the statute of limitations thereof. Once such term has elapsed, the information shall be destroyed.

NAVIGATION DATA

As to the navigation data that may be processed through the Website, if data governed by the regulations are collected, it is recommended to read the Cookie Policy of the Legal Notice published in this Website.

DATA SUBJECTS’ RIGHTS

Data protection regulations grant a series of rights to data subjects or data owners, Website users or the users of Estudio Chaves & Asociados S.L.’s social network profiles. The rights of data subjects are as follows:

– Right of access: right to obtain information as to whether his/her own data are being processed, the purpose of processing, the categories of data involved, recipients or recipient categories, the retention term and the origin of such data.

– Right to rectification: right to rectify inaccurate or incomplete personal data.

– Right to erasure: right to erase data under the following circumstances:

– If the data are no longer necessary to fulfil the purpose for which they were collected.

– If the data owner withdraws his/her consent.

– If the data subject objects to processing.

– If data must be suppressed to fulfil a legal obligation.

– If data have been obtained by virtue of an information society service as set forth in article 8(1) of the General Data Protection Regulation.

– Right to object: right to object to specific processing based on the data subject’s consent.

– Right to restriction: right to restrict data processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the company to verify the accuracy of the personal data.
• The processing is unlawful, and the data subject opposes the erasure of the personal data.
• The company no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pending the verification whether the legitimate grounds of the company override those of the data subject.

The data subjects may exercise the rights previously mentioned by contacting Estudio Chaves & Asociados S.L. in writing at the following address: chaves@estudio-chaves.com, indicating in the subject the right intended to be exercised.

In this sense, Estudio Chaves & Asociados S.L. shall respond your request as soon as possible within the terms fixed by data protection regulations. Furthermore, note that the data subject or data owner may file a claim at any time before the competent enforcement authority.

SECURITY

The security measures adopted by Estudio Chaves & Asociados S.L. are those required by article 32 of the GDPR. In this regard, Estudio Chaves & Asociados S.L., based on the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, has implemented the appropriate technical and organizational measures to ensure an adequate level of security according to the existing risk.

In any case, Estudio Chaves & Asociados S.L. has implemented sufficient mechanisms to:

a) Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.

b) Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.

c) Regularly test, assess and evaluate the effectiveness of technical and organizational measures implemented for ensuring the security of processing.

d) Pseudonymize and encrypt personal data, as applicable.

AMENDMENT/UPDATE

This Privacy Policy may be amended/updated according to the legal requirements established or to adapt the Policy to the instructions provided by the Spanish Data Protection Agency or to changes in our Website.