Legal

II. CUSTOMER DATA PROCESSING

Information Clause:

Data of the data controller:

Identity: Óscar González Moreno (Spain and the Chef) - Tax ID: 45541816e

Postal Address: Avd. de la Filosofia 15, Block 5, 2ndB. Postal Code: 41927 Mairena del Aljarafe (Seville)

Phone: +34 611355793 - Email: info@spainandthechef.com

At Spain and the Chef, we process the information you provide us in order to provide the requested service and invoice accordingly. The provided data will be kept for as long as the commercial relationship is maintained or for the time necessary to comply with legal obligations and address potential liabilities that may arise from the fulfillment of the purpose for which the data was collected. The data will not be transferred to third parties except in cases where there is a legal obligation. You have the right to obtain information about whether Óscar González Moreno is processing your personal data, and you can exercise your rights of access, rectification, deletion, data portability, opposition, and limitation to its processing at Óscar González Moreno, Avd. de la Filosofia 15, Block 5, 2ndB. Postal Code: 41927 Mairena del Aljarafe (Seville) or via email at info@spainandthechef.com, identifying yourself sufficiently in your request through electronic means or, if necessary, through a duly signed request. However, if the data controller has reasonable doubts about the identity of the individual making the request, they may request additional information necessary to confirm their identity. Also, especially if you believe you have not obtained full satisfaction in the exercise of your rights, you may file a complaint with the national supervisory authority by addressing the Spanish Data Protection Agency, C/ Jorge Juan, 6 – 28001 Madrid.

APPENDIX

GENERAL INFORMATION

This document has been designed for the processing of personal data with low risk, from which it is inferred that it cannot be used for processing personal data that includes information related to ethnic or racial origin, political, religious or philosophical ideology, union membership, genetic and biometric data, health data, and sexual orientation data of individuals, as well as any other data processing that poses a high risk to the rights and freedoms of individuals.

Article 5.1.f of the General Data Protection Regulation (GDPR) determines the need to establish adequate security safeguards against unauthorized or unlawful processing, loss of personal data, destruction, or accidental damage. This implies the establishment of technical and organizational measures aimed at ensuring the integrity and confidentiality of personal data and the ability to demonstrate, as stated in Article 5.2, that these measures have been implemented (proactive responsibility).

Additionally, visible, accessible, and straightforward mechanisms must be established for the exercise of rights, and internal procedures must be defined to ensure effective handling of received requests.

EXERCISE OF RIGHTS ATTENTION

The data controller will inform all employees about the procedure for addressing the rights of data subjects, clearly defining the mechanisms through which rights can be exercised (electronic means, reference to the Data Protection Officer if applicable, postal address, etc.) and considering the following:

• Upon presentation of their national identity card or passport, data subjects may exercise their rights of access, rectification, erasure, objection, portability, and restriction of processing. The exercise of these rights is free of charge.

• The data controller must respond to data subjects without undue delay and in a concise, transparent, intelligible, clear, and simple language, preserving evidence of compliance with the duty to respond to requests for the exercise of rights. 

• If the request is made electronically, the information will be provided through electronic means whenever possible, unless the data subject requests otherwise.

• Requests must be responded to within 1 month of receipt, with the possibility of an extension of up to two months considering the complexity or number of requests, but in that case, the data subject must be informed of the extension within one month of receiving the request, indicating the reasons for the delay.

RIGHT OF ACCESS: In the right of access, data subjects will be provided with a copy of the personal data available, along with the purpose for which they were collected, the identity of the recipients of the data, the envisaged retention periods or the criteria used to determine them, the existence of the right to request rectification or erasure of personal data, as well as the right to restrict or object to their processing, the right to lodge a complaint with the Spanish Data Protection Agency, and if the data were not obtained from the data subject, any available information about their origin. The right to obtain a copy of the data must not adversely affect the rights and freedoms of other data subjects.

 Form for exercising the right of access.

RIGHT OF RECTIFICATION: In the right of rectification, the data of data subjects that are inaccurate or incomplete will be modified according to the purposes of processing. The data subject must indicate in the request which data are involved and the correction to be made, providing, when necessary, supporting documentation of the inaccuracy or incompleteness of the data being processed. If the data have been communicated by the data controller to other controllers, the rectification must be notified to them unless it is impossible or requires a disproportionate effort, providing the data  with information about such recipients, if requested.

 Form for exercising the right of rectification. 

RIGHT OF ERASURE: In the right of erasure, the data of data subjects will be deleted when they express their refusal to processing and there is no legal basis preventing it, they are no longer necessary for the purposes for which they were collected, the data subject withdraws the consent given, and there is no other legal basis legitimizing the processing, or it is unlawful. If the erasure results from the data subject's exercise of the right to object to the processing of their data for marketing purposes, the identifying data of the data subject may be retained to prevent future processing. If the data have been communicated by the data controller to other controllers, the erasure must be notified to them unless it is impossible or requires a disproportionate effort, providing the data subject with information about such recipients, if requested.

 Form for exercising the right of erasure. 

RIGHT OF OBJECTION: In the right of objection, when data subjects express their refusal to the processing of their personal data to the controller, the latter will stop processing them unless there is a legal obligation preventing it. When the processing is based on a public interest mission or the legitimate interest of the controller, in response to a request to exercise the right of objection, the controller will stop processing the data unless compelling legitimate grounds override the interests, rights, and freedoms of the data subject or are necessary for the formulation, exercise, or defense of legal claims. If the data subject objects to the processing for direct marketing purposes, personal data will cease to be processed for these purposes.

 Form for exercising the right of objection.

RIGHT OF PORTABILITY: In the right of portability, if the processing is carried out by automated means and is based on consent or is performed under a contract, data subjects may request a copy of their personal data in a structured, commonly used, and machine-readable format. Likewise, they have the right to request that it be transmitted directly to a new controller, whose identity must be communicated, whenever technically possible.

 Form for exercising data portability. 

RIGHT OF LIMITATION OF PROCESSING: In the right of limitation of processing, data subjects may request the suspension of the processing of their data to challenge their accuracy while the controller conducts necessary verifications or in case the processing is based on the legitimate interest of the controller or in compliance with a public interest mission, while verifying whether these reasons prevail over the interests, rights, and freedoms of the data subject. The data subject can also request the retention of the data if they consider the processing to be unlawful and, instead of deletion, request the limitation of processing, or if, even though the controller no longer needs them for the purposes for which they were collected, the data subject needs them for the formulation, exercise, or defense of legal claims. The fact that the processing of the data subject's data is limited must be clearly stated in the systems of the controller. If the data have been communicated by the controller to other controllers, the limitation of processing must be notified to them unless it is impossible or requires a disproportionate effort, providing the data subject with information about such recipients, if requested.

 Form for exercising the right of limitation of processing.

If the data subject's request is not granted, the data controller will inform them, without delay and no later than one month after receiving the request, of the reasons for not taking action and the possibility of filing a complaint with the Spanish Data Protection Agency and taking legal action.