PRIVACY

Privacy Policy

This is a courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.

Introduction

This Privacy Policy has been drawn up taking into account the provisions of the Spanish Organic Law on the Protection of Personal Data in force, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter the GDPR.

The purpose of this Privacy Policy is to inform the owners of the personal data about whom information is being collected of the specific aspects relating to the processing of their data, including, among other things, the purposes of the processing, the contact details for exercising their rights, the periods for which the information will be retained and the security measures applied.

Data Controller

For data protection purposes, EFFIC SOLUTIONS SOFTWARE, S.L. must be considered the Data Controller in relation to the files/processing operations identified in this policy, specifically in the section Data processing.

The identification details of the owner of this website are set out below:

Data Controller: EFFIC SOLUTIONS SOFTWARE, S.L.

Postal address: C/ PROGRESO, 2 1ª Plta. Ofi 92, 28906, GETAFE, (MADRID).

Email address: info@efficsoftware.com

 

Data processing

Any personal data requested will consist solely of the data strictly necessary to identify and respond to the request made by the owner of such data, hereinafter the data subject. This information will be processed fairly, lawfully and transparently in relation to the data subject. Furthermore, personal data will be collected for specified, explicit and legitimate purposes and will not be further processed in a manner incompatible with those purposes.

The data collected from each data subject will be adequate, relevant and not excessive in relation to the corresponding purposes in each case, and will be kept up to date whenever necessary.

Before their data are collected, data subjects will be informed of the general points set out in this policy so that they can give their express, specific and unambiguous consent to the processing of their data, in accordance with the following aspects.

Purposes of processing.

The explicit purposes for which each processing operation is carried out are set out in the information clauses included in each of the data collection channels (web forms, paper forms, voice recordings or signs and information notices).

However, the data subject's personal data will be processed solely for the purpose of providing an effective response and dealing with the requests made by the user, as specified alongside the option, service, form or data collection system used by the data subject.

Legal basis

As a general rule, before processing personal data, EFFIC SOLUTIONS SOFTWARE, S.L. obtains the express and unambiguous consent of the data subject by including informed consent clauses in the different information collection systems.

 

However, where the data subject's consent is not required, the legal basis on which EFFIC SOLUTIONS SOFTWARE, S.L. relies for the processing is the existence of a specific law or regulation that authorises or requires the processing of the data subject's data.

 

Recipients

As a general rule, EFFIC SOLUTIONS SOFTWARE, S.L. does not transfer or disclose data to third parties, except where legally required. However, should this be necessary, the data subject will be informed of such transfers or disclosures through the informed consent clauses contained in the different personal data collection channels.

 

Source

As a general rule, personal data are always collected directly from the data subject. However, in certain exceptional cases, the data may be collected through third parties, entities or services other than the data subject. In such cases, the data subject will be informed of this through the informed consent clauses contained in the different information collection channels, within a reasonable period after the data have been obtained and, at the latest, within one month.

 

Retention periods

The information collected from the data subject will be retained for as long as necessary to fulfil the purpose for which the personal data were collected, so that, once that purpose has been fulfilled, the data will be cancelled. Such cancellation will result in the data being blocked and retained solely at the disposal of the public administrations, judges and courts, in order to address any liabilities arising from the processing during the corresponding limitation period; once that period has expired, the information will be destroyed. 

For information purposes, the legal retention periods for information relating to different matters are set out below:

 

DOCUMENT

PERIOD

LEGAL REF.

Employment or social security documentation

4 years

Article 21 of Royal Legislative Decree 5/2000 of 4 August approving the consolidated text of the Spanish Law on Infringements and Penalties in the Social Order (Ley sobre Infracciones y Sanciones en el Orden Social)

Accounting and tax documentation for commercial purposes

6 years

Art. 30, Spanish Commercial Code (Código de Comercio)

Accounting and tax documentation for tax purposes

4 years

Articles 66 to 70, Spanish General Tax Law (Ley General Tributaria)

Building access control

1 month

 Instruction 1/1996 of the AEPD (Spanish Data Protection Agency).

Video surveillance

1 month

AEPD guide on the use of video cameras for security and other purposes

Article 22.3 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPD)

 

 

 

Browsing data.

With regard to browsing data that may be processed through the website, if data subject to the regulations are collected, we recommend that you consult the Cookie Policy published on our website.

Data subjects' rights.

Data protection legislation grants a series of rights to data subjects or data owners, users of the website or users of the social media profiles of EFFIC SOLUTIONS SOFTWARE, S.L.

The rights to which data subjects are entitled are as follows:

  • Right of access: the right to obtain information on whether their own data are being processed, the purpose of the processing being carried out, the categories of data concerned, the recipients or categories of recipients, the retention period and the source of such data.

 

  • Right to rectification: the right to obtain the rectification of inaccurate or incomplete personal data.

 

  • Right to erasure: the right to obtain the erasure of the data in the following cases:
    • Where the data are no longer necessary for the purpose for which they were collected
    • Where the owner of the data withdraws their consent
    • Where the data subject objects to the processing
    • Where the data must be erased in compliance with a legal obligation
    • Where the data have been obtained in connection with an information society service pursuant to Article 8(1) of the European General Data Protection Regulation.

 

  • Right to object: the right to object to a specific processing operation based on the data subject's consent.

 

  • Right to restriction: the right to obtain restriction of the processing of the data where any of the following applies:
    • Where the data subject contests the accuracy of the personal data, for a period enabling the company to verify their accuracy.
    • Where the processing is unlawful and the data subject opposes the erasure of the data.
    • Where the company no longer needs the data for the purposes for which they were collected, but the data subject requires them for the establishment, exercise or defence of legal claims.
    • Where the data subject has objected to the processing pending verification of whether the legitimate grounds of the company override those of the data subject.

 

  • Right to data portability: the right to receive the data in a structured, commonly used and machine-readable format and to transmit them to another controller where:
    • The processing is based on consent
    • The processing is carried out by automated means

 

  • Right to lodge a complaint with the competent supervisory authority

Data subjects may exercise the above rights by writing to EFFIC SOLUTIONS SOFTWARE, S.L. at the following address: C/ PROGRESO, 2 1ª Plta. Ofi 92 28906 GETAFE (MADRID), stating in the subject line the right they wish to exercise.

EFFIC SOLUTIONS SOFTWARE, S.L. will deal with your request as quickly as possible and within the time limits laid down in data protection legislation.

Security

The security measures adopted by EFFIC SOLUTIONS SOFTWARE, S.L. are those required under Article 32 of the GDPR. Accordingly, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, EFFIC SOLUTIONS SOFTWARE, S.L. has put in place appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

In any case, EFFIC SOLUTIONS SOFTWARE, S.L. has implemented sufficient mechanisms to:

  1. Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
  2. Restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident.
  3. Regularly test, assess and evaluate the effectiveness of the technical and organisational measures implemented to ensure the security of the processing.
  4. Pseudonymise and encrypt personal data, where appropriate.