WEBSITE USERS
BASIC INFORMATION ON DATA PROTECTION
| CONTROLLER | CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A. |
| PURPOSE | Management of communication and information through the website |
| LAWFUL BASIS | Request for pre-contractual measures (information and quotations) at the request of the data subject |
| RECIPIENTS | No data will be disclosed to third parties, except where legally required |
| RIGHTS | You have the right to access, rectify and delete the data, as well as other rights, as explained in the additional information |
| ADDITIONAL INFORMATION | You can consult additional and detailed information on Data Protection on our website under Privacy Policies/website users |
EXTENDED INFORMATION ON DATA PROTECTION
PROCESSING ACTIVITY: WEBSITE USERS
Who is responsible for processing your personal data?
Company name: CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A.
Tax ID (CIF): A78632965
Address: C/ Marie Curie, 5-7 Edificio Beta, 2nd floor, offices 2.5 and 2.6, 28521 Rivas Vaciamadrid (Madrid)
Contact email: PROTECCIONDEDATOS@CESTEL.ES.
Tel.: +34 91 871 20 95
For what purpose will we process your personal data?
Your personal data will be used for the purpose of maintaining communications with you in order to handle your requests for information and, where applicable, quotations.
How long will we keep your personal data?
The personal data provided will be kept for as long as the requested relationship lasts, you do not withdraw consent for these voluntary contacts and, once this action has been carried out, they may be kept duly “blocked” on the basis of the statutory limitation periods for any liabilities arising from the processing of your personal data, for a maximum of 3 years.
What is the lawful basis for processing your personal data?
The legal basis for processing your personal data is:
Implementation of pre-contractual measures (requests for information and quotations) at the request of the data subject
Is it mandatory to provide this personal data?
A necessary requirement in order to contact us.
What are the consequences of not providing it?
Impossibility of providing you with the requested information.
Will we disclose your personal data?
No disclosures of data nor international transfers are envisaged, except where legally required.
What rights do you have when you provide us with your personal data?
Right of Access: You have the right to know whether your data is being processed and to receive that information in writing through the requested means.
Right of Rectification: You have the right to request that your data be rectified if it is inaccurate or incomplete.
You have the right to request the erasure of your data; however, you should bear in mind that the right to erasure is limited where there is a legal obligation to retain or block your data.
In certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only keep it for the exercise or defence of claims, the protection of third parties, or for reasons of important public interest.
In certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. The controller will stop processing the data, except for compelling legitimate grounds, or for the exercise or defence of possible claims.
Where the processing of your data is based on consent or is necessary for the performance of a contract or pre-contract and is carried out by automated means, you will have the right to data portability, i.e. to receive your data in a structured, commonly used and machine-readable format, and even to have it transmitted to a new controller.
Any data subject may lodge a complaint with the competent Data Protection Supervisory Authority, especially where they have not obtained satisfaction in the exercise of their rights. To contact it, you may send a letter to the Spanish Data Protection Agency (Agencia Española de Protección de Datos Personales) at C/Jorge Juan n.º 6, 28001 Madrid, or through its electronic office at www.agpd.es.
Templates for requesting the exercise of your rights can be found in the Privacy Policies / rights section of our website. You may also request them from us in writing at the controller’s address, and you may also obtain them from the Supervisory Authority’s electronic office at www.agpd.es, and they must be sent to the controller’s postal or email address.
CUSTOMERS AND SUPPLIERS
BASIC INFORMATION ON DATA PROTECTION
| CONTROLLER | CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A. |
| PURPOSE | To establish the necessary communications that give content to the contractual relationship established and to economic, administrative and tax obligations. |
| LAWFUL BASIS |
Performance of a contract Compliance with a legal obligation Controller’s legitimate interest |
| RECIPIENTS | No data will be disclosed to third parties, except where legally required, and to banking institutions for the payment or collection of the services provided. |
| RIGHTS | You have the right to access, rectify and delete the data, as well as other rights, as explained in the additional information |
| ADDITIONAL INFORMATION | You can consult additional and detailed information on Data Protection by requesting it at our offices or by email: PROTECCIONDEDATOS@LCESTEL.ES. |
EXTENDED INFORMATION ON DATA PROTECTION
PROCESSING ACTIVITY: CUSTOMERS AND SUPPLIERS
Who is responsible for processing your personal data?
Company name: CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A.
Tax ID (CIF): A78632965
Address: C/ Marie Curie, 5-7 Edificio Beta, 2nd floor, offices 2.5 and 2.6, 28521 Rivas Vaciamadrid (Madrid)
Contact email: PROTECCIONDEDATOS@LCESTEL.ES.
Tel.: +34 91 871 20 95
For what purpose will we process your personal data?
Your personal data will be used for the purpose of giving effect to the contractual relationship established in the sale/purchase or the provision of services and, as a consequence, to comply with the resulting economic and tax obligations, and to establish the necessary contractual communications.
How long will we keep your personal data?
Your personal data will be kept for as long as the relationship lasts and, once it ends, it will be kept in accordance with the legally established retention periods which, depending on economic and tax regulations, range between 4 and 10 years.
What is the lawful basis for processing your personal data?
The legal basis for processing your personal data is:
Performance of a contract to which the data subject is a party (main basis)
As a result of the contractual relationship established with customers and suppliers, the controller has legal obligations in economic and tax matters arising from the following regulations, which affect the retention periods:
Commercial Code of 1885
Corporate Income Tax Law (RDL 4/2004, of 5 March) art. 133.1
Tax regulations
General Tax Law 58/2003
Article 24 of Royal Legislative Decree 1/2011 of 1 July, approving the consolidated text of the Audit of Accounts Act.
Royal Decree 1514/2007 of 16 November, approving the General Accounting Plan
On the basis of the controller’s legitimate interest.
On the basis of the controller’s legitimate interest, in the contractual communications we will establish with customers and suppliers.
Is it mandatory to provide this personal data?
A contractual requirement.
What are the consequences of not providing it?
Impossibility of providing the requested service.
Will we disclose your personal data?
Recipients or categories of recipients:
TAX AUTHORITY, for compliance with tax obligations
BANKS, SAVINGS BANKS AND RURAL SAVINGS BANKS, for the collection/payment of the services provided/received
What rights do you have when you provide us with your personal data?
Right of Access: You have the right to know whether your data is being processed and to receive that information in writing through the requested means.
Right of Rectification: You have the right to request that your data be rectified if it is inaccurate or incomplete.
You have the right to request the erasure of your data; however, you should bear in mind that the right to erasure is limited where there is a legal obligation to retain or block your data.
In certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only keep it for the exercise or defence of claims, the protection of third parties, or for reasons of important public interest.
In certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. The controller will stop processing the data, except for compelling legitimate grounds, or for the exercise or defence of possible claims.
Where the processing of your data is based on consent or is necessary for the performance of a contract or pre-contract and is carried out by automated means, you will have the right to data portability, i.e. to receive your data in a structured, commonly used and machine-readable format, and even to have it transmitted to a new controller.
Any data subject may lodge a complaint with the competent Data Protection Supervisory Authority, especially where they have not obtained satisfaction in the exercise of their rights. To contact it, you may send a letter to the Spanish Data Protection Agency (Agencia Española de Protección de Datos Personales) at C/Jorge Juan n.º 6, 28001 Madrid, or through its electronic office at www.agpd.es.
Templates for requesting the exercise of your rights can be found in the rights section of our website. You may also request them from us in writing at the controller’s address, and you may also obtain them from the Supervisory Authority’s electronic office at www.agpd.es, and they must be sent to the controller’s postal or email address.
SOCIAL MEDIA FOLLOWERS
BASIC INFORMATION ON DATA PROTECTION
| CONTROLLER | CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A. |
| PURPOSE | To receive information directly related to the services we provide, events, activities and promotions of our organisation, always through the chosen social network, and to interact with us. |
| LAWFUL BASIS | Data subject’s consent |
| RECIPIENTS | No data will be disclosed to third parties. |
| RIGHTS | You have the right to access, rectify and delete the data, as well as other rights, as explained in the additional information |
| ADDITIONAL INFORMATION | You can consult additional and detailed information on Data Protection on our website under Privacy Policies/Social media followers |
EXTENDED INFORMATION ON DATA PROTECTION
PROCESSING ACTIVITY: SOCIAL MEDIA FOLLOWERS
Who is responsible for processing your personal data?
Company name: CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A.
Tax ID (CIF): A78632965
Address: C/ Marie Curie, 5-7 Edificio Beta, 2nd floor, offices 2.5 and 2.6, 28521 Rivas Vaciamadrid (Madrid)
Contact email: PROTECCIONDEDATOS@LCESTEL.ES.
Tel.: +34 91 871 20 95
For what purpose will we process your personal data?
Your personal data will be used for the purpose of managing the list of people who like our Facebook, Twitter, YouTube, Google+ and Linkedin pages.
And thus to receive information directly related to the services we provide, events, activities and promotions of our organisation, always through the chosen social network, and to interact with us.
How long will we keep your personal data?
The data provided on the corresponding social network will remain accessible to us while you keep the “follow” or “like” button active. When you wish to stop following us, all you have to do is click the “unfollow” or “unlike” button, or leave Google+ contacts and delete the contact on Linkedin.
What is the lawful basis for processing your personal data?
The legal basis for processing your personal data is:
Data subject’s consent, and this relationship is subject to the terms established in the privacy and data protection policies of each social network. We provide a link to each of them for you to read:
Is it mandatory to provide this personal data?
There is no obligation to provide data beyond what is necessary to register on each social network.
What are the consequences of not providing it?
Impossibility of communication and following through social media.
Will we disclose your personal data?
There is no plan to disclose your personal data nor to carry out international transfers with it.
What rights do you have when you provide us with your personal data?
Please note that we only access the personal data that appears on your profile as a result of mutual following of our Twitter, Facebook or Instagram accounts; therefore, we understand that the exercise of rights over your personal data should be carried out with the social network itself. Nevertheless, we inform you of what they are:
Right of Access: You have the right to know whether your data is being processed and to receive that information in writing through the requested means.
Right of Rectification: You have the right to request that your data be rectified if it is inaccurate or incomplete.
You have the right to request the erasure of your data; however, you should bear in mind that the right to erasure is limited where there is a legal obligation to retain or block your data.
In certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only keep it for the exercise or defence of claims, the protection of third parties, or for reasons of important public interest.
In certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. The controller will stop processing the data, except for compelling legitimate grounds, or for the exercise or defence of possible claims.
Where the processing of your data is based on consent or is necessary for the performance of a contract or pre-contract and is carried out by automated means, you will have the right to data portability, i.e. to receive your data in a structured, commonly used and machine-readable format, and even to have it transmitted to a new controller.
Any data subject may lodge a complaint with the competent Data Protection Supervisory Authority, especially where they have not obtained satisfaction in the exercise of their rights. To contact it, you may send a letter to the Spanish Data Protection Agency (Agencia Española de Protección de Datos Personales) at C/Jorge Juan n.º 6, 28001 Madrid, or through its electronic office at www.agpd.es.
Templates for requesting the exercise of your rights can be found in the rights section of our website. You may also request them from us in writing at the controller’s address, and you may also obtain them from the Supervisory Authority’s electronic office at www.agpd.es, and they must be sent to the controller’s postal or email address.
NEWSLETTER USERS
BASIC INFORMATION ON DATA PROTECTION
| CONTROLLER | CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A. |
| PURPOSE | Management of newsletter communications and information through the website |
| LAWFUL BASIS | Data subject’s consent |
| RECIPIENTS | No data will be disclosed to third parties, except where legally required |
| RIGHTS | You have the right to access, rectify and delete the data, as well as other rights, as explained in the additional information |
| ADDITIONAL INFORMATION | You can consult additional and detailed information on Data Protection on our website under Privacy Policies/Newsletter |
EXTENDED INFORMATION ON DATA PROTECTION
PROCESSING ACTIVITY: NEWSLETTER
Who is responsible for processing your personal data?
Company name: CENTRO ESPAÑOL DE SERVICIOS TELEMATICOS, S.A.
Tax ID (CIF): A78632965
Address: C/ Marie Curie, 5-7 Edificio Beta, 2nd floor, offices 2.5 and 2.6, 28521 Rivas Vaciamadrid (Madrid)
Contact email: PROTECCIONDEDATOS@LCESTEL.ES.
Tel.: +34 91 871 20 95
For what purpose will we process your personal data?
Your personal data will be used for the purpose of sending you our newsletter or information bulletin with information that may be of interest to you related to our sector of activity, by registering you on the distribution list.
How long will we keep your personal data?
Your personal data will be processed for as long as you do not withdraw the consent given for this type of commercial or informational communications and, once withdrawn, we will keep them “blocked” until the liabilities arising from the processing of your personal data are time-barred, for a maximum of 3 years.
What is the lawful basis for processing your personal data?
The legal basis for processing your personal data is:
Data subject’s consent.
Is it mandatory to provide this personal data?
A necessary requirement to subscribe to the newsletter.
What are the consequences of not providing it?
Impossibility of sending it to you.
Will we disclose your personal data?
No disclosures of your personal data nor international transfers are envisaged.
Processors involving transfers to third countries.
Commercial communications by email are carried out through MailChimp, which acts as a data processor, and with which we have entered into a contract in accordance with Article 28 of the GDPR.
With your contact data, specifically your email address, an international transfer of data to the USA is envisaged, as we use a service provider for the management of informational/commercial communications (information bulletin or newsletter) that hosts your data there.
Such transfer is regulated by the agreement between European and US authorities known as Privacy Shield, which offers guarantees equivalent to European ones for data subjects.
What rights do you have when you provide us with your personal data?
Right of Access: You have the right to know whether your data is being processed and to receive that information in writing through the requested means.
Right of Rectification: You have the right to request that your data be rectified if it is inaccurate or incomplete.
You have the right to request the erasure of your data; however, you should bear in mind that the right to erasure is limited where there is a legal obligation to retain or block your data.
In certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only keep it for the exercise or defence of claims, the protection of third parties, or for reasons of important public interest.
In certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. The controller will stop processing the data, except for compelling legitimate grounds, or for the exercise or defence of possible claims.
Where the processing of your data is based on consent or is necessary for the performance of a contract or pre-contract and is carried out by automated means, you will have the right to data portability, i.e. to receive your data in a structured, commonly used and machine-readable format, and even to have it transmitted to a new controller.
Any data subject may lodge a complaint with the competent Data Protection Supervisory Authority, especially where they have not obtained satisfaction in the exercise of their rights. To contact it, you may send a letter to the Spanish Data Protection Agency (Agencia Española de Protección de Datos Personales) at C/Jorge Juan n.º 6, 28001 Madrid, or through its electronic office at www.agpd.es.
Templates for requesting the exercise of your rights can be found in the rights section of our website. You may also request them from us in writing at the controller’s address, and you may also obtain them from the Supervisory Authority’s electronic office at www.agpd.es, and they must be sent to the controller’s postal or email address.
DATA SUBJECTS’ RIGHTS
BASIC INFORMATION ON DATA PROTECTION
Who can exercise the rights?
Data subjects’ rights remain personal in nature; therefore, they must be exercised by the data subject, who must duly prove their identity (for this purpose, their National Identity Document (DNI) or equivalent will be requested).
However, they may also be exercised through the data subject’s legal representative, either due to incapacity or minority preventing the personal exercise of these rights, in which case that status must be proven.
They may also be exercised through voluntary representation by a representative expressly appointed to exercise the right. In this case, the identity of the represented person must be clearly proven by providing a copy of their National Identity Document or equivalent, and the representation granted by them.
How can you exercise your rights?
The exercise of rights must be carried out by means of a communication addressed to the controller, which shall include:
- Full name of the data subject.
- Photocopy of their National Identity Document, passport or other valid document identifying them, or, where applicable, of the person representing them.
- The use of an electronic signature identifying the affected person or data subject will exempt them from submitting photocopies of the DNI or equivalent document.
- If the data subject requests any of their rights electronically, the response will be given by the same means, unless the data subject specifies another method.
- The request specifying what is being sought.
- Address for notifications, date and signature of the applicant.
- Supporting documents for the request, where applicable.
What are our obligations?
The controller must respond to any request addressed to it in all cases, regardless of whether or not the controller’s processing activities include personal data relating to the affected person or data subject.
Where the request does not meet the specified requirements, the file controller must request that it be corrected.
The burden of proving compliance with the duty to respond lies with the controller, who must keep evidence of compliance with said duty.
The response will be provided within the maximum period established by regulation, although, whenever workload allows, we will try to prepare and deliver the information within a shorter period. Please note that the regulatory response periods are:
- 30 days.
- An extension of up to two additional months in exceptionally complex cases, duly justified and notified to the data subject.
RIGHT OF ACCESS
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed and, where that is the case, the right of access to the personal data (Art. 15 GDPR).
RIGHT OF RECTIFICATION
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them and to have incomplete personal data completed by means of providing a supplementary statement (Art. 16 GDPR).
RIGHT OF ERASURE
The data subject shall have the right to obtain from the controller without undue delay the erasure of personal data concerning them, and the controller shall have the obligation to erase personal data without undue delay in certain cases, which will be analysed below (Art. 17 GDPR).
RIGHT TO RESTRICTION OF PROCESSING
The data subject shall have the right to obtain from the controller restriction of processing in certain cases, which will be analysed further below (Art. 18 GDPR).
RIGHT TO DATA PORTABILITY
The data subject shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided in certain cases (Art. 20 GDPR).
RIGHT TO OBJECT
The data subject shall have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them in certain circumstances, which will be analysed further below (Art. 21 GDPR).
RIGHT NOT TO BE SUBJECT TO AUTOMATED INDIVIDUAL DECISION-MAKING
Every data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them (Art. 22 GDPR).
REPRESENTATION FORM
Any data subject may exercise their rights through duly completed representation, with both the data subject and the representative duly identified.