1. Introduction

The purpose of this Data Protection Policy is to provide information on the processing of your Personal Data and your rights under Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter RGPD).

It should be noted that, from time to time, we may modify this Data Protection Policy, either to adapt it to the regulations in force at any given time, or in the development of this policy always aiming to improve our objectives and protect your rights. We therefore advise you to visit this page if you wish to be kept informed, as we will publish all changes on this page.

2. Who is the Data Controller of your data?

The controller responsible for the processing of your personal data is:

• Identification: Centro Regional de Servicios Avanzados, S.A (from now on, CSA)
• CIF Number: A09310475
• Postal address: Santo Domingo de Guzmán Square 1, Planta 6ª Floor, 09004, Burgos (Spain).
• Telephone number: 947 25 62 50
• Email: dpo@csa.es

We also inform you that CSA has appointed a Data Protection Delegate (DPD), who can be contacted at the following e-mail address indicated above.

3. For what purposes do we process your data and on what grounds?

We process the personal data that you provide us with for the following purposes:

• To manage your queries and/or requests made through forms, e-mail, telephone or messaging systems), the services contracted and, where appropriate, for the management of the existing relationship between you and CSA.

The legal basis for the processing of your personal data is based on:

• The consent given by the data subject himself/herself. Article 6.1 (a) of the GDPR.
• Performance of a contract to which the data subject is a party or for the implementation at the data subject's request of pre-contractual measures. Article 6.1 (b) of the GDPR.

4. Use of cookies on the CSA website

CSA makes use of cookie technology to optimise the services provided to the data subject. Further information on the use of cookies by CSA can be accessed via the specific links on the CSA website.

5. What Personal Data does CSA collect and how does it use it?

The personal information that CSA collects about the interested parties and how it does so may vary depending on the procedure and/or request requested. In any case, the personal data collected by CSA is exclusively that which is necessary to manage the procedure and/or request requested and is pertinent to its purpose. Failure to provide them will prevent the procedures and/or requests requested by the interested party from being carried out.

Under no circumstances will CSA use the Personal Data of the interested parties for purposes that are not legitimate or different to the purpose for which they were collected or compatible with the same.

On the other hand, we inform you that CSA does not collect Personal Data of the interested parties with the aim of adopting any type of automated decision, nor for the elaboration of profiles, market studies, etc.

In order to provide personal data to CSA, the interested party must be over 14 years of age, and the provision of Personal Data of third parties is not permitted without their prior unequivocal and express consent. In this regard, the person who breaches such obligations shall be liable for any damages and/or losses that may be caused by such breach.

6. How long does CSA keep your Personal Data?

The Personal Data provided by data subjects are kept for the time strictly necessary to fulfil the purpose for which they have been collected and to determine any possible liabilities that may arise from the purpose of the processing.

Once the processing activity has been completed, they will be kept in accordance with the legally stipulated periods. Once these periods have expired, CSA will proceed to delete the Personal Data, provided that no liability of any kind may arise from a legal relationship or obligation or from the performance of a contract, or from the application of pre-contractual measures requested by the data subject.

7. Does CSA share the Personal Data it processes?

CSA does not provide the data subject's Personal Data to third parties, except in those cases in which it is legally obliged to do so, such as in the case of communication with State Security Forces and Bodies, courts and tribunals and/or other bodies and administrations or public entities with jurisdiction.

Any communication of Personal Data not provided for in the regulations will require the consent of the interested party.

8. Does CSA carry out International Transfers of Personal Data?

CSA does not transmit Personal Data outside the European Economic Area.

In some cases, an International Transfer of Personal Data could be contemplated, which, in any case, would be covered by European Commission Decisions or the adoption, through appropriate safeguards, of appropriate security measures, and would always be limited to the provision of services to be carried out by our Suppliers on behalf of CSA.

9. Does CSA apply security measures to the Personal Data it processes?

The security measures that CSA has implemented to guarantee the security of Personal Data correspond to those set out in Annex II (Security measures) of Royal Decree 311/2022, of 3 May, which regulates the National Security Scheme (ENS).

In addition to these measures, CSA has adopted the necessary levels of protection depending on the technique, the costs of application, and the nature, scope, context and purposes of each processing operation it carries out, as well as risks to the rights and freedoms of natural persons.

10. How can I exercise my rights?

Any Data Subject has the right to obtain, free of charge, information on the processing of their Personal Data carried out by CSA, as well as to withdraw the consent given for the processing of their personal data, provided that such processing is not based on another type of legitimisation.

The data subject may exercise his/her rights of access, rectification, deletion and portability of his/her data, of limitation and opposition to the processing thereof, as well as the right not to be subject to decisions based solely on the automated processing of his/her data, where applicable, before CSA through the postal address indicated above, or through the email address: dpo@csa.es.

CSA will respond to the exercise of the rights of each data subject within a maximum period of one month. This period may be extended for a further two months, taking into account the complexity and number of requests, but CSA will inform the data subject of the extension within one month of receipt of the request, stating the reasons for the delay.

Likewise, the data subject may submit any claim he/she deems appropriate to the Supervisory Authority (the Spanish Data Protection Agency), when he/she has not obtained satisfaction with regard to the exercise of his/her Rights, both in time and in form. For further information: www.aepd.es.

Date last updated: 22/11/2023