RIGHTS OF THE INTERESTED PARTIES
Procedure for the exercise and obligations for the controller.
In general, Regulation (EU) 2016/679 requires data controllers to make it easier for data subjects to exercise their rights. This mandate implies that the procedures and forms for this must be visible, accessible and simple. Regulation (EU) 2016/679 does not establish a specific way for exercising rights, but it does require controllers to make it possible to submit requests by electronic means, especially when processing is carried out by such means.
SERECO GESTIÓN, S.L. guarantees that the exercise of these rights is free of charge for the data subject, provided that the requests are not manifestly unfounded or excessive, especially because they are repetitive, and it is the responsibility of the data controller to demonstrate the unfounded or excessive nature of the requests, and in these cases the controller may charge a fee to compensate for the administrative costs of complying with the request or refusing to act.
The interested party will be informed of the actions arising from its request within a period of one month, which may be extended by two months in the case of particularly complex requests.
Such extension of the time limit is notified within the first month. If the person responsible decides not to comply with the request, he/she must inform of this, giving reasons for his/her refusal, within one month of its submission.
All reasonable measures are taken to verify the identity of those exercising the rights recognized in Regulation (EU) 2016/679, through the requirement of the national identity card or equivalent document proving the identity of the data subject. It also maintains a REGISTER OF EXERCISES OF RIGHTS (see annex) where all the exercises of the rights requested by the interested parties are collected and kept under control.
For the exercise of rights through requests, the company provides interested parties who wish to exercise their rights with the corresponding models included in the annexes and specified in the following points:
Right of acces:
The right of access is regulated in art. 15 of Regulation (EU) 2016/679. In recitals 63 and 64, it is included as a right of the data subject to obtain, from the controller, confirmation of whether or not personal data concerning him/her are being processed.
To meet the access rights of any interested party SERECO GESTIÓN, S.L. provides an appropriate application form, model included in the Annex APPLICATION FOR ACCESS TO DATA.
The interested party who requests this right and who identifies himself/herself appropriately will obtain from the company the appropriate response by means of an informative document (model included in the Annex RESPONSE TO THE EXERCISE OF THE RIGHT OF ACCESS).
If the response to the right of access is sent by mail, the applicant of the right will be sent the response document by letter with acknowledgement of receipt, bureaufax or any other means that accredits the sending and receipt.
In the event of a positive reply, the information shall include the personal data of the data subject which are processed, the purposes of the processing, the categories of personal data processed as well as the recipients or categories of recipients to whom the data are or will be disclosed, in addition to any available information on the origin of the data, the expected period of retention of the data or, if this is not possible, the criteria used to determine this period, as well as the right to lodge a complaint with a supervisory authority. The data subject shall also be informed of the existence of the right to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data relating to the data subject, or to object to such processing.
Right of rectification
The right of rectification is set out in Article 16 of Regulation (EU) 2016/679, whereby the data subject shall have the right to obtain without undue delay from the controller the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data supplemented, including by means of an additional declaration.
In the event that the data subject’s data is incomplete or inaccurate, the company guarantees to update the data without undue delay.
The data subject may request the right to rectify his/her data by means of the request form attached in the Annex REQUEST FOR RECTIFICATION OF DATA.
Once the data has been rectified, the company will inform the data subject about the rectification carried out (Annex RESPONSE TO EXERCISE OF RIGHTS).
Right to limitation of processing
The right to limitation of treatment is regulated in art. 18 of Regulation (EU) 2016/679 and establishes the right to have the data limited at the request of the interested party.
The interested party can request the right to limit their data by means of the request model that is attached in the Annex REQUEST FOR LIMITATION OF DATA PROCESSING.
The company in response may proceed to limit the processing of the data of the interested party if any of the following circumstances occur:
For data limitation, the company will follow one of the following methods:
In the cases in which the company proceeds to limit the treatment, the data of the affected party may only be processed:
Once the data is limited, the interested party will be informed justifying their decision (Annex RESPONSE TO THE EXERCISE OF RIGHTS) as well as the limitation carried out. Likewise, it will be informed when the limitation to the treatment is lifted.
Right of erasure / right to be forgotten
The art. 17 of Regulation (EU) 2016/679 indicates that the interested party shall have the right to obtain, without undue delay, from the controller the deletion of personal data that concerns them.
The interested party can request the right to rectify their data by means of the request model that is attached in the Annex REQUEST FOR SUPPRESSION/RIGHT TO BE FORGOTTEN.
The company proceeds to suppress the processing of the data of the interested party when any of the following circumstances occur:
The company does not proceed to accept requests for deletion of the interested party when the treatment is necessary in the following cases:
The company informs without delay of the positive or negative nature of the right requested by the interested party, as well as the deletion carried out. Model Annex RESPONSE TO THE EXERCISE OF RIGHTS.
Right of opposition
The right of opposition is regulated in art. 21 of Regulation (EU) 2016/679. We can say that it is the right of the interested party to oppose, at any time, for legitimate and well-founded reasons related to their particular situation, the personal data that concerns them being processed.
To meet the right of opposition of any interested party SERECO GESTIÓN, S.L. provides a suitable application model, a model included in the OPPOSITION APPLICATION Annex.
When the interested party exercises the right of opposition, SERECO GESTIÓN, S.L. will stop processing said personal data, carrying out an analysis in order to consider whether or not the right of the interested party prevails over the legitimate interests of the company. For this purpose, the situation, the reasons and the documentation provided by the interested party will be analyzed in detail.
If there are legitimate reasons that justify the treatment (for example for the formulation, exercise or defense of claims) the data will continue to be processed, even if the request of the interested party is met, and may be rejected.
Right of portability
Art. 20 of Regulation (EU) 2016/679, states that users have a new right, the right to portability. This right complements the right of access, as it allows data subjects to obtain the data provided in a structured, commonly used and machine-readable format.
The right to portability also implies that the data subject’s personal data could be transmitted directly from one entity or company to another, without having to be given to the data subject himself, provided that this is technically possible.
The Regulation thus opens up the possibility not only of obtaining the data and reusing them, but also of transmitting them to another service provider. The data subject will therefore have the option of requesting his or her data or the transmission of the data directly from one entity to another.
The company guarantees the exercise of the data subject’s right to portability by means of an appropriate request form, which is included in Annex REQUEST FOR PORTABILITY.
Once the right has been requested, the data subject is sent all the personal data concerning him/her that he/she has provided, provided that the processing is based on consent or is necessary for the performance of a contract and is carried out by automated means.
It also facilitates that data subjects receive the data in a structured, commonly used, machine-readable and interoperable format, where technology permits.
The company does not apply the right to portability to data provided by the data subject about third parties or data provided to it through third parties.
Processing of Data through Video Surveillance
SERECO GESTIÓN, S.L. informs that certain areas of its facilities are subject to a video surveillance system, whose purpose is to ensure the safety of individuals, property, and facilities.
This processing of personal data is carried out in accordance with the provisions of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.
The purpose of the video surveillance system is to safeguard the security of individuals, property, and facilities. The legal basis for this data processing is the legitimate interest of the data controller (Article 6.1.f of the GDPR).
The images captured by the video surveillance system will be retained for a maximum period of 30 days, after which they will be deleted, unless required to be retained by competent authorities or as evidence of acts that threaten the safety or integrity of individuals or property.
Data will not be disclosed to third parties, except where required by law enforcement authorities, judicial authorities, or any other legally competent public entity. In addition, images may be shared with the company’s legal services and/or collaborating entities for the purpose of legal action or the investigation of thefts, accidents, or incidents—provided such disclosure is necessary to clarify the facts and complies with current data protection legislation.
Data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection, and data portability as recognized in Articles 15 to 22 of the GDPR.
To do so, they must submit a written request accompanied by a copy of an identity document, using one of the following methods:
Furthermore, if you believe that your personal data is being processed in violation of applicable regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD) through its electronic headquarters: https://www.aepd.es
