Privacy and Data Protection Policy

1. The data controller.
In accordance with the provisions of REGULATION (EU) 2016/679 General Data Protection Regulation (GDPR) and the current Organic Law on Data Protection (LOPD), we hereby inform you that the party responsible for personal data processing is SERVICANTO, S.L., with C.I.F. (tax ID code) No. B-59119388. Based at la Calle Ezequiel Massoni, nº 50, 2º C, de Marín-36900 (Pontevedra).Telephone: (+34) 93 871 55 05. E-mail: protecciondedatos@servicanto.com

2. Purpose of personal data processing.
SERVICANTO, S.L. processes information provided to it by data subjects in order to manage and maintain appropriate professional, commercial, administrative or other relationships, as well as labour relationships with regard to its employees.

3. Data storage period.
The personal data provided shall be stored for as long as the professional, commercial, informative or labour relationship exists with the data subjects and as long as they do not request its deletion. However, the data controller may keep duly blocked data for the purposes of fulfilling potential administrative or legal responsibilities. Once the relationship between the data controller and the data subject has come to an end, the data controller shall proceed to completely delete all personal data in its possession, except in the case of blocking.

4. Legitimacy of data processing.
The legal basis for processing performed by the data controller is the consent of the data subjects, the execution of a professional order or, finally, the legitimate interest of the data controller.
The data subject is obligated to provide the necessary personal data to be able to carry out the relations requested with the data controller. If the data subject does not provide their data, or said data is inaccurate, the data controller shall be released from all liability that could be derived from the resulting consequences of the inaccurate or incorrect information.
The management of services using the information of interest is based on the consent requested from the data subject, and the withdrawal of this consent shall not, in any case, affect the execution of a possible professional order subscribed between the parties, where relevant.

5. Data recipients.
SERVICANTO, S.L. shall not transfer or communicate the personal data provided by the data subject to third parties except where legally required or where necessary for the fulfilment of the professional services requested.
In any case, if the data controller has the express authorisation of the data subject, it may transfer the data to a data processor for the sole purpose of executing the order and only for the time strictly necessary for said service, in the same conditions and with the same responsibilities attributed to the data controller. Upon completion of the order, the data processor shall return the personal data to the data controller and delete any copies in its possession. However, it may keep duly blocked data for the purposes of fulfilling potential administrative or legal responsibilities.
Data transfers to third countries are not provided for.

6.Rights of the data subject.
Any person has the right to obtain confirmation as to whether or not SERVICANTO, S.L. is processing data concerning them.
6.1. Right to access: the data subject shall have the right to obtain confirmation from SERVICANTO, S.L. on whether or not it is processing personal data concerning them and, if this is the case, the right to access the personal data, the purpose of processing, the personal data categories being processed and their recipients. They shall also have the right to be informed on the storage period of the data, the right to request rectification or erasure of the data, and the right to limit or oppose processing. Moreover, they shall have the right to be informed on the right to present a claim before the Control Authority on the existence of automated decisions and receive information on appropriate guarantees in the event of international data transfers.
6.2. Right to rectification: the data subject shall have the right to rectify inaccurate data and complete incomplete data, even by means of an additional declaration.
6.3. Right to erasure: the data subject shall have the right to erasure without undue delay in the event of the occurrence of any of the circumstances described in article 17 GDPR, such as unlawful data processing or instances where the purpose for which the data were processed or collected has ceased to exist. However, there are a series of exceptions in which this right shall not apply, for example, when the right to freedom of expression or freedom of information must prevail or for reasons of public interest.
6.4. Right to the limitation of processing: the data subject shall have the right to request that SERVICANTO, S.L. suspends data processing if any of the requisites of article 18 GDPR are fulfilled, for example, when the inaccuracy of data is contested while it is being verified, when the data subject opposes erasure in the event of unlawful processing and prefers limitation of processing, when the data controller no longer needs the data for the purpose for which it was collected but the data subject requires the data to exercise their rights, or while the reasons for the right to the opposition to the data are being verified. 
6.5. Right to data portability: the data subject shall have the right to receive their personal data in a structured, commonly used and machine-readable format and be able to transmit it to another controller, where technically feasible.
6.6. Right to opposition: the data subject shall have the right to oppose data processing when, due to their personal situation, the data controller must cease processing, except where there is a proven legitimate interest, necessary for the defence against claims or when, for example, the purpose of the processing is direct marketing.
6.7. Right not to be subject to automated decision-making: the data subject shall have the right to not be subject to decisions based solely on automated processing, including elaboration of profiles, regardless of whether this has legal effects or not.
In accordance with articles 15 to 22 of GDPR, for the exercise of rights to access personal data concerning the data subject and its rectification or erasure, or the limitation of or opposition to its processing, as well as the right to data portability, you may send a letter specifying the relevant request together with your identification data, a photocopy of your national ID document and correspondence address to the following address: Polígon Can Illa, C/ Pompeu Fabra, 16-18, 08530 de La Garriga (Barcelona) or by email to: protecciondedatos@servicanto.com  
If the request is made through a voluntary/legal representative, the identity of the represented party must also be stated, providing a copy of the national ID document or equivalent document and the representation granted by the holder of the personal data.

7. Security measures.
SERVICANTO, S.L. has adopted all the legal required technical and organisational security measures in its installations, systems and processing in accordance with the provisions of Regulation (EU) 2016/679 General Data Protection Regulation of 27th April 2016 and those applicable at any given time by virtue of Spanish regulations under development.

8. Confidentiality and duty of secrecy.
All information concerning personal data provided by the data subjects shall be kept in the strictest confidentiality and, therefore, SERVICANTO, S.L. undertakes to not disclose it, as long as it does not concern the strict performance of an order or the fulfilment of any mandatory legal obligation or court decision.