Privacy policy

This is a translation provided for information purposes only. The Spanish version of this Privacy Policy is the version that prevails and the only one with legal effect. Read the Spanish version.

1. INFORMATION FOR THE USER
This Privacy Policy applies to all personal data that the Data Subject may provide to PANELES DECORATIVOS PANEL PIEDRA S.L. by any means (website, email, telephone, in person, online or paper forms, etc.).

The Data Subject warrants the accuracy and truthfulness of the personal data provided, releasing PANELES DECORATIVOS PANEL PIEDRA S.L. from any liability in this respect, and undertakes to keep it duly up to date and to notify any change to it.

The services offered by PANELES DECORATIVOS PANEL PIEDRA S.L. are not aimed at minors, so if the Data Subject is under 18 we ask that they do not send us their personal information. Should we receive personal information from anyone under 18, it will be deleted as soon as we become aware of it.

2. DATA CONTROLLER
Identity: PANELES DECORATIVOS PANEL PIEDRA S.L.
Tax ID (CIF): B71331771
Registered office: Pol. Ind. Municipal, Vial Transversal, 2, s/n. – 31500 Tudela (Navarra), Spain
Telephone: +34 941 181 091
Email: info@panelpiedra.com

3. PURPOSES, RETENTION PERIODS AND LAWFUL BASIS FOR PROCESSING
PANELES DECORATIVOS PANEL PIEDRA S.L., as Data Controller of the personal data the Data Subject provides, as well as any data they may provide in the future, informs you that this data will be processed in accordance with current data protection legislation, and therefore provides the following information about the processing:

CONTACT / ENQUIRIES
Purpose of processing: to answer and follow up enquiries, applications or requests received, and to stay in touch with people who have shown an interest in the company, its products or its services.
Retention criteria: the data will be kept for as long as necessary to handle and answer the enquiry.
Lawful basis for processing: GDPR: 6.1.f) the lawful basis for processing is the legitimate interest of the Controller in dealing with and responding to the communications or requests received.

PRO FORMA INVOICES / QUOTATIONS
Purpose of processing: to prepare and deliver the pro forma invoices and/or quotations requested by Data Subjects, and to follow them up by telephone, electronically or in person.
Retention criteria: the data will be kept in the system indefinitely unless the data subject requests its deletion.
Lawful basis for processing: GDPR: 6.1.f) the lawful basis for processing is the legitimate interest of the Controller in dealing with and responding to the communications or requests received.

CUSTOMERS
Purpose of processing: customer management, maintaining contractual and/or commercial relations with customers, and the administrative (invoicing, collections, etc.), accounting and tax management of the company, together with compliance with the legal obligations all of this entails. This includes contact details of individuals providing services to a legal entity, including sole traders.
Retention criteria: the data will be kept for as long as contractual and/or commercial relations between the parties continue and deletion is not requested, and, if it is, for the period laid down by current legislation (tax, commercial, etc.) regarding the limitation of liability.
Lawful basis for processing: GDPR: 6.1.b) the lawful basis for processing is the performance and maintenance of the contractual and/or commercial relations between the parties, as well as compliance with the legal obligations (tax, commercial, etc.) all of this entails.

NEWSLETTER SUBSCRIPTION
Purpose of processing: to manage the sending of newsletters about the Controller, its products and its services.
Retention criteria: the data will be kept in the system indefinitely unless the data subject requests its deletion.
Lawful basis for processing: GDPR: 6.1.a) the lawful basis for processing is the consent given by the Data Subject when subscribing to the newsletter.

SENDING COMMERCIAL COMMUNICATIONS
Purpose of processing: to send information by any means, postal or electronic, about offers and promotions, events and activities and other advertising material from the Controller.
Retention criteria: the data will be kept in the system indefinitely unless the data subject requests its deletion.
Lawful basis for processing: GDPR: 6.1.f) sending commercial information to customers is based on the legitimate interest of the Controller in sending commercial communications about products or services similar to those contracted, and so building customer loyalty.
GDPR: 6.1.a) The basis for sending commercial communications to non-customer users is the consent given by the Data Subject when the data was collected.
In either case, however, the Data Subject has the right to object to this processing, and may do so by any of the means described in this document.
Withdrawing that consent will not affect the continuation of commercial relations in any way, but processing carried out for that purpose beforehand does not become unlawful because consent has been withdrawn.

SUPPLIERS
Purpose of processing: supplier management, maintaining contractual and/or commercial relations with suppliers, and the administrative (invoicing, collections, etc.), accounting and tax management of the company, together with compliance with the legal obligations all of this entails. This includes contact details of individuals providing services to a legal entity, including sole traders.
Retention criteria: the data will be kept for as long as contractual and/or commercial relations between the parties continue and deletion is not requested, and, if it is, for the period laid down by current legislation (tax, commercial, etc.) regarding the limitation of liability.
Lawful basis for processing: GDPR: 6.1.b) the lawful basis for processing is the performance and maintenance of the contractual and/or commercial relations between the parties, as well as compliance with the legal obligations (tax, commercial, etc.) all of this entails.

SENDING A CV
Purpose of processing: to file and record documentation and CVs provided voluntarily by data subjects for future recruitment processes for jobs at the company.
Retention criteria: the data will be kept for a maximum of one year, after which it will be deleted with full respect for confidentiality, both in its processing and in its subsequent destruction. Accordingly, once that period has elapsed, if you wish to continue taking part in the Controller’s recruitment processes, please send us your CV again.
Lawful basis for processing: GDPR: 6.1.a) the lawful basis for processing is the consent given by the Data Subject when providing their data to take part in recruitment processes.

CCTV
Purpose of processing: temporary storage of images captured by CCTV cameras in order to safeguard the security of people, property, premises and goods.
Retention criteria: the images will be kept for a maximum of 30 DAYS, except where they need to be kept as evidence of acts against the integrity of people, property or premises, or are provided to the courts or to the State security forces.
Lawful basis for processing: GDPR: 6.1.e) processing is necessary for the performance of a task carried out in the public interest: safeguarding the security of people, property and premises.

4. DISCLOSURE OF DATA
As a general rule, personal data will not be disclosed to third parties, except where there is a legal obligation or where it is necessary to provide the services or to maintain and develop the relationship, such as, by way of example but not limitation:
– The competent Public Authorities, in order to comply with applicable legislation.
– Financial/banking institutions, for the management of collections and payments.
– Service providers engaged by the Controller, who act as data processors.

International transfers
PANELES DECORATIVOS PANEL PIEDRA S.L. does not intend to carry out international data transfers. Where necessary, they will only be made to recipients located in a country, a territory or one or more specific sectors of that country, or an international organisation, that has been recognised by the European Commission as providing an adequate level of protection; or that rely on one of the appropriate safeguards set out in article 46.2 of Regulation (EU) 2016/679.

5. RIGHTS OF DATA SUBJECTS
Anyone has the right to obtain confirmation as to whether or not the Controller is processing personal data concerning them, and to withdraw, at any time, any consent they may have given for a specific purpose, without this affecting the lawfulness of processing based on consent before its withdrawal.
They may also exercise their rights of access, rectification, erasure and portability of their data, restriction of and objection to its processing, and the right not to be subject to decisions based solely on automated processing of their data, where applicable.
How can these rights be exercised?
Data Subjects may exercise their data protection rights by sending a written communication to the postal or email address of the Controller, quoting the reference “EJERCICIO DERECHOS LOPD”, enclosing a photocopy of their national identity document or equivalent identification and stating their full name, the specific request being made, an address for notifications, the date and their signature. Rights may also be exercised through a legal representative, in which case, in addition to the data subject’s identity document, the representative’s identity document and evidence of their authority must be provided. On request we will provide the forms for exercising these rights, indicating which right you wish to exercise.
What routes of complaint are available?
If you consider that your rights have not been properly attended to, or that the processing of the data does not comply with current legislation, you have the right to lodge a complaint with the supervisory authority: the Spanish Data Protection Agency (www.aepd.es).

6. SOCIAL NETWORKS
Please note that we are present on social networks. The processing of the data of people who become followers and/or make any connection or take any action through the Controller’s official pages on social networks will be governed by this section, by the rest of the privacy policy, and by the terms of use, privacy policies and other rules on access, use and similar matters belonging to the social network in question. The provider will process your data in order to properly manage its presence on the relevant social network, to inform you of the Controller’s activities, products and/or services, or those of third parties that may be related to our activity, and for any other purpose that the rules of the social networks may allow.

7. COOKIES
This website may use cookies and other similar technologies such as local shared objects, flash cookies or pixels: small files that some platforms, such as websites, can install on the user’s device (computer, tablet, smartphone, etc.).
They can do very different things: store browsing preferences, gather statistical information, enable certain technical features, store information about the user’s browsing habits or their device, and so on.
Cookies are useful for several reasons. Technically, they allow web pages to work more smoothly and to adapt to the user’s preferences, for example by storing their language or their country’s currency. They also help website owners improve their services and make the advertising shown on them more efficient, thanks to the statistical or behavioural information they collect through them.
Installing and using certain cookies requires the informed consent of users.
Cookies requiring the user’s consent include analytical, advertising and affiliate cookies. Technical cookies, and those necessary for the website to work or to provide services expressly requested by the user, are exempt.
Users can set their browser to alert them when cookies are received and to prevent them being installed on their device. Please see your browser’s instructions for more information. For more about cookies, see our Cookie Policy.

8. WHETHER THE INFORMATION PROVIDED BY THE USER IS MANDATORY OR OPTIONAL
By ticking the relevant boxes and entering data in the fields marked as mandatory in the various forms, Data Subjects expressly, freely and unequivocally accept that their data is necessary for the provider to deal with their request, and that including information in the remaining fields is optional.
If not all the data is provided, there is no guarantee that the information and services requested will fully match your needs.

9. SECURITY MEASURES
In accordance with current personal data protection legislation, the CONTROLLER complies with all the provisions of the GDPR and the LOPDGDD for the processing of the personal data for which it is responsible and, demonstrably, with the principles set out in the GDPR and the LOPDGDD, whereby data is processed lawfully, fairly and transparently in relation to the data subject and is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
The CONTROLLER warrants that it has implemented appropriate technical and organisational policies to apply the security measures laid down by the GDPR and the LOPDGDD in order to protect Users’ rights and freedoms, and has communicated adequate information to them so that they can exercise those rights.