DATA CONTROLLER

The Data Controller is COMUNIDAD MÓVIL ALCOI SL, C/ San Juan de Ribera, N 11, 03801, Alcoy (ALICANTE).

 

Privacy principles

 

Processing activities we carry out

Processing of Employees
Legal basis: GDPR: 6.1.b) Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR: 6.1.c) Processing necessary for compliance with a legal obligation to which the controller is subject.
Royal Legislative Decree 2/2015, of 23 October, approving the consolidated text of the Workers’ Statute Law.
Purposes of processing: - Management of hired personnel.
- Personnel file. Time control. Training. Pension plans. Occupational risk prevention.
- Issuing staff payroll.
- Management of trade union activity.
Data subjects: Employees
Categories of data: - Name and surname, DNI/CIF/identification document, personnel registration number, Social Security/Mutual Insurance number, address, signature and telephone number.
- Special categories of data: health data (sick leave, workplace accidents and degree of disability, without including diagnoses), trade union membership, solely for the purpose of paying trade union fees (where applicable), trade union representative (where applicable), attendance certificates for the employee and third parties.
- Personal characteristic data: sex, marital status, nationality, age, date and place of birth and family data. Family circumstance data: start and end dates, licences, permits and authorisations.
- Academic and professional data: qualifications, training and professional experience.
- Employment and administrative career details. Incompatibilities.
- Attendance control data: entry and exit date/time, reason for absence.
- Economic and financial data: payroll economic data, credits, loans, guarantees, tax deductions, salary reduction corresponding to the previous job position (where applicable), court-ordered withholdings (where applicable), other withholdings (where applicable). Bank details.
Categories of recipients: - Entity entrusted with management in the field of occupational risks.
- General Treasury of Social Security.
- Trade union organisations.
- Financial institutions.
- State Tax Administration Agency.
- Main contractors for whom we provide services as subcontractors.
International transfers: No international data transfers are planned.
Deletion period: The data will be kept for the time necessary to fulfil the purpose for which it was collected and to determine any possible liabilities that may arise from that purpose and from the processing of the data.
The economic data of this processing activity will be kept under the provisions of Law 58/2003, of 17 December, General Tax Law.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Contacts
Legal basis: Consent of the data subject
Purposes of processing: To deal with your request, send you information and follow up on the request.
Data subjects: Contact persons, customers, suppliers
Categories of data: Name and surname, telephone number, email address
Categories of recipients: No data transfers to third parties are envisaged.
International transfers: No international data transfers are planned.
Deletion period: Contact data will be kept for the time necessary to fulfil the purpose for which it was collected or until the data subject withdraws their consent.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Assistance with people’s rights (ARCO)
Legal basis: GDPR: 6.1.c) Processing necessary for compliance with a legal obligation to which the controller is subject.
General Data Protection Regulation.
Purposes of processing: To handle requests in the exercise of the rights established by the General Data Protection Regulation: right of access, rectification, erasure, restriction, portability and objection to automated decision-making.
Data subjects: Natural persons who request it (employees, customers, suppliers, contact persons)
Categories of data: Name and surname, address, signature and telephone number.
Categories of recipients: Personal data may be communicated to the Supervisory Authority (Spanish Data Protection Agency) within the framework of an investigation for the protection of rights initiated by the data subject.
International transfers: No international data transfers are planned.
Deletion period: The data will be kept for a period of five years from the time of the request.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Candidates in selection processes (HR)
Legal basis: GDPR 6.1.a) The data subject gave consent to the processing of their personal data for one or more specific purposes.
GDPR: 6.1.b) Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Purposes of processing: Personnel selection and provision of job positions.
Data subjects: Candidates submitted to job provision procedures.
Categories of data: - Name and surname, DNI/CIF/identification document, personnel registration number, address, signature and telephone number.
- Personal characteristic data: sex, marital status, nationality, age, date and place of birth and family data.
- Academic and professional data: qualifications, training and professional experience.
- Employment details.
Categories of recipients: No data transfers to third parties are planned.
International transfers: No international data transfers are planned.
Deletion period: The data will be kept for the time necessary to fulfil the purpose for which it was collected and to determine any possible liabilities that may arise from that purpose and from the processing of the data.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Suppliers
Legal basis: GDPR: 6.1.b) Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR: 6.1.c) Processing necessary for compliance with a legal obligation to which the controller is subject.
Royal Legislative Decree 2/2015, of 23 October, approving the consolidated text of the Workers’ Statute Law.
Law 58/2003, of 17 December, General Tax Law.
Purposes of processing: - Acquisition of products and/or services that we need for the development of our activity.
- Control of subcontractors where applicable.
Data subjects: - Suppliers.
- People who work for our suppliers.
Categories of data: - Name and surname, DNI/NIF/identification document, address, signature and telephone number.
- Employment details: job position. Occupational safety training.
- Economic, financial and insurance data: bank details.
Categories of recipients: - Financial institutions. (Payment of invoices)
- State Tax Administration Agency.
International transfers: No international data transfers are planned.
Deletion period: The data will be kept for the time necessary to fulfil the purpose for which it was collected and to determine any possible liabilities that may arise from that purpose and from the processing of the data, in accordance with Law 58/2003, of 17 December, General Tax Law,
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Customers.
Legal basis: GDPR: 6.1.a) The data subject gave consent to the processing of their personal data for one or more specific purposes.
GDPR: 6.1.b) Processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
GDPR: 6.1.c) Processing necessary for compliance with a legal obligation to which the controller is subject.
GDPR: 6.1.f) Processing necessary for the purposes of the legitimate interests pursued by the controller.

Royal Legislative Decree 2/2015, of 23 October, approving the consolidated text of the Workers’ Statute Law.
Law 58/2003, of 17 December, General Tax Law.
Purposes of processing: Supply of our products / services
Data subjects: Customers
Categories of data: - Name and surname, DNI/NIF/identification document, address, signature and telephone number.
- Economic, financial and insurance data: bank details
Categories of recipients: - Financial institutions.
- State Tax Administration Agency.
International transfers: No international data transfers are planned.
Deletion period: The data will be kept for the time necessary to fulfil the purpose for which it was collected and to determine any possible liabilities that may arise from that purpose and from the processing of the data, in accordance with Law 58/2003, of 17 December, General Tax Law,
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Video surveillance
Legal basis: GDPR: 6.1.c) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
Organic Law 2/1986, of 13 March, on Security Forces and Corps.
Purposes of processing: To guarantee the security of people, property and facilities and for workplace control.
Data subjects: Workers, customers and suppliers, users.
Categories of data: Image
Categories of recipients: Recordings may be communicated to the Security Forces and Corps and to Courts and Tribunals, when required by them, or if they serve as evidence of the commission of offences or infringements.
International transfers: No international data transfers are planned.
Deletion period: No more than one month, except in the event of communication to the Security Forces and Corps and/or Courts and Tribunals.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Security breach notification
Legal basis: GDPR: 6.1.c) Processing necessary for compliance with a legal obligation to which the controller is subject.
General Data Protection Regulation. Articles 33 and 34
Purposes of processing: Management and assessment of security breaches that may occur in our organisation.
Data subjects: Variable: Employees, Customers, Suppliers, Contact Persons (depending on the security breach)
Categories of data: Variable. (Depending on the security breach)
Categories of recipients: - Spanish Data Protection Agency.
- State Security Forces and Corps.
International transfers: No international data transfers are planned.
Deletion period: The data will be kept for the time necessary to fulfil the purpose for which it was collected and to determine any possible liabilities that may arise from that purpose and from the processing of the data. The provisions of archive and documentation regulations shall apply.
Security measures: Adapted to the requirements of Regulation (EU) 2016/679, General Data Protection Regulation.

Processing of Website management
Legal basis: Legitimate interest of the controller to guarantee the security, technical maintenance, abuse prevention and proper functioning of the website; user consent for the use of non-technical cookies or similar technologies; performance of pre-contractual measures or consent for the handling of forms, depending on the nature of the request.
Purposes of processing: Management, maintenance, security and operation of the website; handling of requests received through forms; statistical analysis of browsing; measurement of advertising campaigns; conversion tracking; management of cookies and similar technologies in accordance with the cookie policy.
Data subjects: Website users, potential customers, customers, information requesters.
Categories of data: IP, identifying data, contact details, logs, data entered in forms, online identifiers.
Categories of recipients: No data transfers to third parties are envisaged, except where required by law. Technology providers acting as processors may access the data or, where applicable, third-party providers of cookies or similar technologies in accordance with the cookie policy.
International transfers: No international transfers are planned, except those that, where applicable, may arise from the use of technology providers or third-party cookie providers, which will be carried out in accordance with the safeguards provided for in the GDPR and will be identified in the cookie policy where appropriate.
Deletion period: Technical and security logs: for the time necessary to guarantee the security and operation of the website and, where applicable, to address possible liabilities. Forms: for the time necessary to deal with the request and, subsequently, during the applicable limitation periods. Cookies and similar technologies: according to the periods indicated in the cookie policy.
Security measures: HTTPS, access control, backups, WAF/CDN, minimisation, cookie configuration, processing agreement.

YOUR RIGHTS

You have the right to request a copy of your personal data from us, to rectify inaccurate data or complete it if it is incomplete, or, where applicable, to erase it when it is no longer necessary for the purposes for which it was collected.

You also have the right to restrict the processing of your personal data and to obtain your personal data in a structured and readable format.

You may object to the processing of your personal data in certain circumstances, in particular when we do not need to process it to comply with a contractual or other legal requirement, or when the purpose of the processing is direct marketing.

Where you have given us your consent, you may withdraw it at any time. At that point, we will stop processing your data or, where applicable, stop processing it for that specific purpose. If you decide to withdraw your consent, this will not affect any processing that took place while your consent was in force.

These rights may be limited; for example, if in order to comply with your request we had to disclose data about another person, or if you ask us to delete certain records that we are required to keep due to a legal obligation or legitimate interest, such as exercising our defence against claims. This may also apply in cases where the right to freedom of expression and information must prevail.

You can contact us by any of the means indicated in the Data Controller section of this privacy policy, providing a copy of a document proving your identity, normally your DNI.

Another of your rights is not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or affects you.

In the event of any infringement of your rights, such as, for example, if we have not dealt with your request, you have the right to lodge a complaint with the Supervisory Authority for data protection. This may be the authority in your country, if you live outside Spain, or the Spanish Data Protection Agency, if you live in Spain.

Additional information

Links to third-party websites.
Our website may, on some occasions, contain links to other websites. It is your responsibility to make sure you read the data protection policy and legal terms that apply to each site.

Third-party data.
If you provide us with third-party data, you assume responsibility for informing them beforehand in accordance with Article 14 of the GDPR.