Cookie Consent by Free Privacy Policy Generator website
ES | EN | DE | FR

Siempre contigo
Always with you

       

 +34 93 729 27 00    Register

 

Privacy Policy


CONSTITUTIONAL LAW ON PERSONAL DATA PROTECTION - ENTITLEMENT

BCN DISTRIBUCIONES SAU must ensure that the personal data of the data subject collected on the website is processed in accordance with the following principles:

  • Processed lawfully, fairly, and transparently in relation to the data subject (“lawfulness, fairness, and transparency”).

  • Collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes (“purpose limitation”).

  • Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”).

  • Accurate and, where necessary, kept up to date, with reasonable technical and organizational measures being taken to ensure that inaccurate data are erased or rectified in relation to the purposes for which they are processed (“accuracy”).

  • Kept in a form which permits identification for no longer than is necessary for the purposes for which the personal data are processed (“storage limitation”).

  • Processed in such a way as to ensure adequate security through the application of appropriate technical and organizational measures (“integrity and confidentiality”).

Thus, BCN DISTRIBUCIONES SAU will be responsible for compliance with the above provisions and must be able to demonstrate such compliance subsequently (“proactive responsibility”).

  • The data subject has given consent to the processing of their personal data for one or more specific purposes.

  • Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;

  • Processing is necessary for compliance with a legal obligation to which the controller is subject;

  • Processing is necessary to protect the vital interests of the data subject or of another natural person;

  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This legitimate basis shall not apply to processing carried out by public authorities in the exercise of their administrative functions. Where processing is based on the data subject's consent, the controller shall be able to demonstrate that the data subject has consented to the processing of their personal data.

If the data subject's consent is given in the context of a written declaration that also addresses other matters, the request for consent must be presented in a way that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, and using clear and plain language.

The data subject has the right to withdraw their consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. Before giving consent, the data subject will be informed of this. Withdrawing consent will be as easy as giving it.

BCN DISTRIBUCIONES SAU must include in the forms used for collecting personal data the information required to comply with the duty to inform set out in Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR). In this regard, and in order to comply with applicable and current data protection regulations, when BCN DISTRIBUCIONES SAU obtains personal data directly from a data subject, it must:

1. Provide the identity and contact details of the Data Controller and, where applicable, their representative, the contact details of the Data Protection Officer, if applicable, and the purposes for which the personal data are processed, as well as the legal basis for the processing.

2. Specify the legitimate interests of the controller or of a third party when the processing is necessary for the purposes of those interests, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

3. Provide the recipients or categories of recipients of the personal data and, where applicable, the controller's intention to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission.

4. Indicate the period for which the personal data will be stored or the criteria used to determine the storage period.

5. Inform data subjects of their right to request from the Data Controller access to their personal data, its rectification or erasure (“right to be forgotten”), the restriction of its processing, or the right to object to its processing, as well as the right to data portability.

6. Inform data subjects of their right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. They should also be informed of their right to lodge a complaint with a Supervisory Authority.

7. Specify whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, and whether the data subject is obliged to provide the personal data, and inform them of the possible consequences of not providing such data.

8. Inform data subjects about the existence of automated decision-making, including profiling, and, at least in such cases, provide information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

When BCN DISTRIBUCIONES SAU does not obtain the personal data of the data subject, it must provide them with the information described in the previous section. This includes the categories of personal data being processed, their source, and, where applicable, whether they originate from publicly accessible sources.

BCN DISTRIBUCIONES SAU must include in the forms or documents used for collecting personal data, including those on its website, the information required to comply with the duty to inform as set forth in Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR), and, if necessary, record the consent given by the data subject.

To accommodate the increased information requirements for data subjects whose personal data will be processed, the possibility of presenting the information using a layered or tiered model is established. This must be consistent with the requirement that the information be provided in clear, simple, concise, transparent, intelligible, and easily accessible language.

Article 11 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), regulates the basic information required in the first layer.

The layered information consists of:

  • Presentation of Basic Information (1st Layer): This involves presenting basic information at a first level, in a summarized form, at the same time and through the same medium in which the data is collected.

  • Reference to Additional Information (2nd Layer): This involves presenting the information in detail and completely, in an appropriate, structured, concise, and precise format. The way this additional information is presented depends on the characteristics of the medium used to report it; it may be presented in paper or electronic format.