Privacy Policy

Version:  25/05/2018

Download

 

1. Identification.

1.1. Mac Puar, S.A. (hereinafter, MP); a company registered in the Commercial Registry of Seville, volume 194, folio 107, section 3, page SE-5611; with tax ID A-41023607 and registered office at Calle Leonardo Da Vinci, 15, 41092, Seville (Spain); telephone 902197277; and e-mail elevacion@mpascensores.com, is the owner of the website located at the Internet address http://www.macpuarsa.es and its social network accounts (hereinafter, this Website).

 

1.2. MP is the owner of the following social network accounts:

 

 

1.3. The person who accesses this website (hereinafter, the User) declares that he or she is of legal age as established in the General Data Protection Regulation (16 years of age) or in the applicable domestic laws and is thus able to give consent in relation to information society services.

 

1.4. By accessing this Website, the User expressly accepts all clauses of the legal disclaimer, this privacy policy, and the cookie policy  as well as the particular conditions that apply to the use of certain services. Users who do not accept all of the aforementioned clauses must refrain from accessing this Website.

 

2. Processing personal data as data controller.

2.1. Below is additional information on how the information is processed by MP as data controller.

 

 

Data provided on the form under the "Customer Service" section

Who is responsible for processing your data?

MP (more information under 1.1)

Why do we process your personal data?

We process the information you provide or which you authorize us to access in order to manage the contents of your communications.

How long will we keep your data?

The personal data you provide will be kept for as long as your communications need to be managed, as long as there is a contractual relationship, or as long as necessary to comply with legal obligations.

What is the legal basis for processing your data?

The legal basis for processing your data is your freely given consent.

To whom will your data be disclosed?

No data will be disclosed to third parties unless there is a legal obligation to do so or you give prior consent.

What are your rights when you provide us with your data?

You have the right to ask the data controller for access to personal data relating to the User and to correct or erase, restrict or oppose processing, as well as the right to data portability, the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority (more information in point 6).

What data is mandatory?

All of the information on the form is required; if you do not provide it, you will not be able to contact MP.

 

Data provided on the form under the "Request Quote" section.

Who is responsible for processing your data?

MP (more information under point 1.1).  

Why do we process your personal data?

We process the information you provide or authorize us to access in order to manage your request for a quote on a product or service.

How long will we keep your data?

The personal data you provide will be kept for as long as the requested quote needs to be managed, as long as there is a contractual or pre-contractual relationship, or as long as necessary to comply with legal obligations.

What is the legal basis for processing your data?

The legal basis for processing your data is your freely given consent.

To whom will your data be disclosed?

No data will be disclosed to third parties, unless there is a legal obligation to do so or you give prior consent.

What are your rights when you provide us with your data?

You have the right to ask the data controller for access to personal data relating to the User, and to correct or erase, restrict or oppose processing, as well as the right to data portability, the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority (more information in point 6).

What data is mandatory?

All of the information on the form is required; if you do not provide it, you will not be able to send the request for a quote.

 

Contact by e-mail

Who is responsible for processing your data?

MP (more information under point 1.1).  

Why do we process your personal data?

We process the information you provide or which you authorize us to access in order to manage the contents of your communications.

How long will we keep your data?

The personal data you provide will be kept for as long as there are communications between us, as long as there is a contractual relationship, or as long as necessary to comply with legal obligations.

What is the legal basis for processing your data?

The legal basis for processing your data is your freely given consent.

To whom will your data be disclosed?

No data will be disclosed to third parties unless there is a legal obligation to do so or you give prior consent.

What are your rights when you provide us with your data?

You have the right to ask the data controller for access to personal data relating to the User, and to correct or erase, restrict or oppose processing, as well as the right to data portability, the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority (more information in point 6).

What data is mandatory?

You are not obligated to provide any data in order to contact MP by e-mail.

 

Contact via social networks

Who is responsible for processing your data?

MP (more information under 1.1)

Why do we process your personal data?

We process the information you provide or which you authorize us to access to manage social media contacts.

How long will we keep your data?

The personal data you provide will be kept for as long as there are communications between use, as long as there is a contractual relationship, or as long as necessary to comply with legal obligations.

What is the legal basis for processing your data?

The legal basis for processing your data is your freely given consent.

To whom will your data be disclosed?

No data will be disclosed to third parties, unless there is a legal obligation to do so or you give prior consent.

What are your rights when you provide us with your data?

You have the right to ask the data controller for access to personal data relating to the User, and to correct or erase, restrict or oppose processing, as well as the right to data portability, the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority (more information in point 6).

What data is mandatory?

You are not obligated to provide any data in order to contact MP on social media.

 

3. Processing of personal data as data processor.

3.1. The User who signs a contract for the provision of services with MP, as the party in charge of data processing, authorises MP to process the personal data as needed to provide the requested service.

 

3.2. In order to render the services which are the object of this order, data controllers shall provide MP with the personal data needed to render the requested service.

 

3.3. This agreement lasts for as long as the contractual relationship is maintained. Upon termination of the contractual relationship, MP shall return the personal data to the data controller or transfer the personal data to another controller designated by the controller and delete any copies in its possession. However, it may keep blocked data in order to fulfil any possible administrative or jurisdictional responsibilities.

 

3.4. MP and its personnel are obligated to:

 

  • Use the personal data that is processed or collected for the sole purpose of rendering the requested service.  Under no circumstances may the data be used for personal gain.
  • Process the data following the data controller's instructions.
  • Keep a written record of all categories of processing carried out on behalf of the data controller, including:
    • The names and contact details of the processor(s) and of each data controller whose behalf the processor is acting.
    • The categories of processing carried out on behalf of each data controller.
    • A general description of the appropriate technical and organizational security measures being implemented.
  • Refrain from disclosing the data to third parties without the controller's express consent and only insofar as is legally permitted. If the data processor wishes to subcontract, the data controller must be informed and provide authorization in advance.
  • Uphold the duty of secrecy with regard to the personal data to which it has access under this order, even after the contract has concluded.
  • Ensure that persons authorized to process personal data expressly undertake, in writing, to keep the information confidential and to comply with the relevant security measures, which must be duly informed.
  • Keep all justifying documentation to accredit fulfilment of the obligation established in the previous section at the disposal of the data controller.
  • Ensure that persons authorised to process personal data receive the necessary training in personal data protection.
  • When data subjects exercise their rights to access, correct, erase and oppose, to restrict processing, the right to data portability and to not be the subject of automated individualised decisions, MP must report it by sending an email to the data controller.  It must be reported immediately and never more than the next business day after receiving the request, along with any other relevant information for responding to the request.
  • Notification of data security breaches:  MP must notify the controller by email, without undue delay, of any security breaches involving personal data under its control that come to its attention, along with relevant information for the documentation and reporting of the incident. At a minimum, the following information must be provided:
    • Description of the breach of personal data security including, where possible, the categories and approximate number of data subjects affected and the categories and approximate number of data records affected.
    • Information for the contact person to obtain more information.
    • Description of the possible consequences of the personal data security breach.
    • Description of the measures taken or proposed to remedy the personal data security breach including, where appropriate, measures taken to mitigate possible negative effects. If it is not possible to provide all information simultaneously, the information may be provided gradually but without undue delay.
  • At the data processor's request, MP must report such data security breaches to data subjects as soon as possible if the breach is likely to pose a high risk to the rights and freedoms of natural persons. The notification should be in plain and simple language and should indicate, at the very least:
    • The nature of the data breach.
    • Details of the point of contact for the data controller or processor where additional information can be obtained.
    • Describe the possible consequences of a personal data security breach.
    • Describe the measures taken or proposed by the controller to remedy personal data security breaches including, where appropriate, the measures taken to mitigate possible negative effects.
  • Provide the data controller with all the information needed to demonstrate compliance with its obligations, as well as for the audits or inspections carried out by the data controller or another auditor authorized by him.
  • Implement the technical and organizational security measures required to guarantee the confidentiality, integrity, availability and permanent resilience of the processing systems and services.
  • Return the personal data and, where appropriate, the media on which they are stored to the data controller once the service has been provided.
  • The return must involve the complete erasure of all existing data in the computer equipment used by MP. However, MP may retain a copy with the data duly blocked for as long as it has any liability for the rendering of the service.

 

3.5. The data controller is responsible for:

 

  • Delivering to the data processor all information needed by the latter to render the service.
  • Ensuring, before and during the processing, that MP is compliant with the General Data Protection Regulation.
  • Supervising the processing.

 

4. Social networks.

4.1. By accessing MP's social network accounts, the User consents to the processing of his/her personal data by those platforms, in accordance with their cookie policies:

 

 

5. Warranty.

5.1. The User warrants that the data provided are true, accurate, complete and up to date, and is responsible for any direct or indirect damage or harm that could be caused as a consequence of User's breach of such obligation.

 

5.2. If the data provided belong to a third party, the User warrants that it has informed said third party and obtained its authorisation to provide its personal data to MP.

 

6. Rights

6.1. Right to access:  The User has the right to obtain confirmation from MP as to whether or not his or her personal data are being processed and, if so, the right to access the personal data.

 

6.2. Right to correction:  The User has the right to demand that MP, without undue delay, correct any inaccurate personal data concerning him or her. Depending on the purpose of the processing, the User is entitled to have incomplete personal data supplemented, including by means of additional declarations.

 

6.3. Right to erasure  The User has the right to demand that MP, without undue delay, eliminate his or her personal data.

 

6.4. Processing restrictions. The User has a right to restrict how the data can be processed by MP.

 

6.5. Right to data portability: Users are entitled to receive the personal data concerning them or provided by them to MP in a commonly used and machine-readable structured format and to transmit them to another data controller without being prevented from doing so by the first controller.

 

6.6. Right to opposition:  Users have the right to oppose at any time, for reasons related to their particular situation, the processing of personal data relating to them.  MP may no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User or for the establishment, exercise or defence of legal claims.

 

6.7. Individualized automated decisions, including profiling:  Users have the right not to be the subject of decisions based solely on automated processing, including profiling, which have legal ramification for them or can significantly affect them in a similar way.

 

6.8. Right to withdraw consent: Users have the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to withdrawal. It shall be as easy to withdraw consent as it is to give it.

 

6.9. The User may exercise his/her rights by writing to MP at Pabellón MP, Calle Leonardo Da Vinci, 15, 41092, Sevilla (Spain), or by sending an email to elevacion@mpascensores.com.

 

6.10. More information on these rights here.