PRIVACY POLICY

Below is the Privacy and Cookies Policy governing the Web Platform https://www.caminobarrancodemasca.com/en (hereinafter, “the Platform”), under the ownership of EMPRESA DE TRANSFORMACIÓN AGRARIA, S.A., S.M.E., M.P., (hereinafter, TRAGSA), a company with a registered address at Calle Maldonado nº 58, 28006, Madrid, Spain, Tax Registration Number A-28476208, registered in the Companies Register of Madrid, on Page M-59.813, Folio 62, Book 171 of Section 89.

We recommend that you take a few minutes to read our privacy policy; it won’t take long. In it, we endeavour to explain simply, clearly and transparently how we process and protect your personal information, and your rights. Your security and that of your personal information are very important to us, and we take very seriously the need to protect them effectively.

HOW DO WE USE THE DATA?

The personal data that you provide to us via the Platform will be processed for the specific purpose stipulated in this privacy policy and, where appropriate, through the various data forms available on the platform. Therefore, data will be gathered and processed for the following purposes:

To enable users to browse our web Platform, and to access the information and content available there.
To resolve quickly and effectively any queries you may have regarding our services via the various channels available to that end (email, telephone, etc.).
To deliver any service contracted by the user, and to manage the invoicing and charging for the services.
To enable you to register as a user and manage your registration,if required.
To allow TRAGSA to send out satisfaction surveys in relation to the quality of goods and services supplied.
To manage the possible participation of the user in any special offers, discounts, prize draws that may be made available on the Platform.
To send out, subject to your express consent, marketing communications and advertising relating to TRAGSA’s products and services.
To inform you about various products and services similar to those contracted and offered by TRAGSA, independently of the channel of communication used. All this in accordance with Article 21.2 of the Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce, without prejudice to the legitimate exercise of your personal rights at all times and, in particular, your right to object.
In the event that you have accepted the cookies policy for the fulfilment of the purposes related to the different types of cookies described in the policy, and particularly analytical cookies (browsing/user profile), to undertake an analysis and gather statistics regarding your web browsing so that we can improve our services and the quality of their delivery. At any time, if you so wish, you can configure the use of analytical cookies, as you have the right to withdraw your consent to the purpose served by the cookies. You are advised that the withdrawal of your consent to the processing of your data in respect of certain types of cookies, such as session cookies or technical cookies, may prevent you from browsing our platform (see Cookies policy).
To adopt whatever protection measures may be required in compliance with current law, including possible anonymisation of your personal data by the application of the appropriate technology which may be available for the purpose. Consequently, in the same area, anonymisation and pseudonymisation may be undertaken in order to better protect your personal data.
To apply the relevant security, technical and/or organisational measures to your personal data, which may be necessary in the light of risks to your rights detected at any time by TRAGSA, including the encryption of personal data and other measures that may involve particular processing of the data of users of the Platform.

If you do not agree with the processing of your data for these purposes, you are urged to leave our Platform immediately. Otherwise, if for example you accept this policy, or simply continue browsing the Platform, as you are in possession of the information contained in this policy, you will be deemed to have consented unequivocally to the purposes of data processing mentioned above.

WHAT KIND OF DATA DO WE PROCESS?

We need to process your data in order to give you access to the content and/or functionality of the Platform, to send you information or to provide services via the platform, should you require them. To that end, we are firmly committed to treating your personal data in accordance with the law and with the principles and obligations contained in the current regulations governing the protection of personal data.

When you browse our Platform (and especially when you interact or register with us) you provide us with data directly; for example, when you complete any online form or application for the purposes indicated in each case.

The data that you provide to us relates to such forms or applications available via the platform, and can vary depending on the type of form or application concerned. Without prejudice to the above, various kinds of personal details can be gathered via the platform, and its different forms/applications. We will always ask you for details that are appropriate, relevant and limited to what is strictly necessary for the purpose of the data processing.

Identifying personal data (first name and surname(s), ID or passport).
Personal contact data (telephone or mobile phone number, email address).
Data concerning personal characteristics (related requirements or queries, for example, which you have expressed via our contact form, etc.).

Similarly, when you browse our web platform, you need to be aware of the cookies that will be installed on your computer or device, as this involves personal data processing depending on the type of cookies used and their specific purposes (see Cookies policy). If you accept our cookies policy, analytical cookies will be used which involve the processing of personal data generated by your browsing profile for analytical and/or statistical purposes. It is important to be aware that by continuing to browse our platform, having been given information on our legal personal data processing policies, you will be confirming that you unreservedly accept the cookies to be used, although you can at any time configure the use of these analytical cookies as indicated in the said cookies policy.

WHAT IS THE LEGAL BASIS FOR OUR PROCESSING OF YOUR DATA?

Purposes of the data processing	Legal basis of the data processing
To enable users to browse our web Platform.	Your consent and, where applicable, the satisfaction of a legitimate interest (whether our own or that of third parties) related to the correct management, development and evolution of the platform, its tools, network, and associated information systems, thereby enabling it to operate correctly, to use its functionalities, and to access its content and services, in addition to the general security points previously mentioned.
To be able to contact the user, and to respond to their orders, requests or queries.	Your consent and, where applicable, the carrying out of precontractual measures at the request of the user/interested party.
To deliver any service contracted by the user, and to manage the invoicing and charging for the services.	Execution of the contract.
To enable you to register as a user and manage your registration, if required.	Your consent.
To send out satisfaction surveys in relation to the quality of goods and services supplied.	Execution of the contract and, where applicable, the satisfaction of a legitimate interest.
To manage the possible participation of the user in any special offers, discounts, prize draws that may be made available on the Platform.	Your consent.
To inform you about various products and services similar to those contracted and offered.	Legitimate interest in accordance with Article 21.2 of the Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce.
If you have accepted the cookies policy as set down, to enable the development of the data processing purposes associated with them and, in particular, the undertaking of the relevant analysis generated by your web browsing for analytical and/or statistical purposes.	Your consent.
To adopt whatever protection measures may be required in compliance with current law, including possible pseudonymisation and anonymisation of your personal data by the application of the appropriate technology which may be available for the purpose.	Compliance with a legal obligation (European Data Protection Regulation).
To apply the relevant security measures and technical and/or administrative processes to your personal data, with an emphasis on the ever-present risks.	Compliance with a legal obligation (European Data Protection Regulation).

When the main legal basis for the data processing is your informed consent, which you grant unequivocally and freely for your personal data to be processed for the purposes described, you will be able to decide on the manner of the data processing and the destination of your data, in accordance with your specific interests and needs in each case, so that, when the data processing has as its legal basis your consent to the same, you will have the right to withdraw your consent at any time, although any such withdrawal will not affect in any way the lawfulness of previous processing of your data by TRAGSA.

TRAGSA may block access to the Platform and its associated services, content and functionalities if you do not accept the present policy, or you do not consent to the processing of your personal information in accordance with the terms of this policy. However, acceptance of the present policy is independent of the possible acceptance of the particular legal terms and conditions that may govern the specific contracting by users of goods and services offered through the Platform.

WHAT WOULD BE THE CONSEQUENCES OF NOT PROVIDING US WITH YOUR DATA?

A failure to provide the personal data required could make it impossible to process any specific order or request, and could result in TRAGSA disregarding and/or refusing your specific order or request.

In all cases, the information and personal data which you provide to us must be:

Sufficient, although adapted, limited and commensurate with the legal data processing purposes advised by TRAGSA, and showing the maximum respect for the purpose limitation principle and the minimisation of personal data principle.
Accurate, up-to-date and truthful, so that your identity and capacity (and, if applicable, representation) can be properly verified, and so that we can, in each case, adapt the data processing to your specific needs and situation. All this will be undertaken in accordance with the principle of accuracy of personal data.

You are also advised that this Platform is intended for use by persons over the age of 18 years, and its use by persons under this age is prohibited.

HOW DO WE SHARE YOUR DATA?

In general, users’ personal data which are gathered through the Platform will not be transferred to third parties without prior notice to the users of the specific details to be transferred, as well as of the identity of the transferees or recipients of the data, their activity and the specific purposes for which the said transferees could process the data.

Likewise, it is possible that certain third parties may have access to your personal information through the delivery of services supplied on behalf of TRAGSA. For example, in respect of third-party cookies which are used on the platform; in this case, we encourage you to read our Cookies Policy.

Users’ personal data will not be passed to any third party, unless subject to the consent of the user, or unless there exists some other legal basis for the data processing pursuant to Article 6 of the GDPR such as, for example, any requirement for TRAGSA to comply with a legal obligation (lawfulness of data processing).

TRAGSA has various entities that manage data processing under its direction, and access to the data is allowed by them, as trusted suppliers, to the extent that is strictly necessary for the delivery of services contracted with them. Such data processors operate under a contract which complies with the conditions and guarantees set down in Article 28 of the GDPR, and the relevant controls, inspections and audits are undertaken in this area to check that such data processors strictly comply with the signed contracts to this end and with the applicable legislation.

WILL ANY INTERNATIONAL TRANSFER OF YOUR DATA OCCUR?

You are advised that, in general, we do not expect to make any international transfer of your personal data, and we adopt the necessary measures and guarantees in compliance with current protection of personal data legislation.

In addition to the above, in our cookies policy, you are advised of the possibility of the international transfer of personal data, in respect of the service supplied to us by certain companies (third-party cookies). All these international transfers of data are fully guaranteed in accordance with the applicable legislation, as the recipients are entities listed under the Privacy Shield framework.

FOR HOW LONG WILL WE STORE YOUR DATA?

Purposes of the data processing	Timescales and criteria for the storage
To enable users to browse our web Platform.	- In general, for this purposes your data will be stored for the length of time that is essential and necessary to enable you to properly browse the website, use our platform and access the content available via the same. - In regard to the data associated with your browsing profile, by virtue of the placement of analytical cookies which you have consented to in accordance with the cookies policy.
To be able to contact the user, and to respond to their orders, requests or queries.	- For the length of time essential in order to properly attend to your requests and/or specific applications, in each individual case. - If these consist of the execution, at request, of precontractual measures or the execution of a contract, your data will be stored for the time required to fulfil such purposes.
To deliver any service contracted by the user, and to manage the invoicing and charging for the services.	For the periods of time necessary to properly complete the execution of all the elements of the contract between the parties.
To enable and manage your registration as a user, if required by you.	Until the time when you request the effective cancellation of the same. If you are a customer, the timescales for the storage of personal details in each case are indicated below.
To send out satisfaction surveys in relation to the quality of goods and services supplied.	For as long as you do not exercise your right to object.
To allow you access, as a customer, to the customers’ digital channel available via the platform.	Until the time when you request the effective cancellation of the subscription.
To manage the possible participation of the user in any special offers, discounts, prize draws that may be made available on the Platform.	Until the time when you request the effective cancellation of the subscription.
To inform you about various products and services similar to those contracted and offered.	Until you exercise your right to object.
To adopt whatever protection measures may be required in compliance with current law, including possible pseudonymisation and anonymisation of your personal data by the application of the appropriate technology which may be available for the purpose.	While the user’s personal data is being processed, including the storage of such data for the legally stipulated timescales, regardless of the legal basis of the data processing.
To apply the relevant security measures and technical and/or administrative processes to your personal data, with an emphasis on the ever-present risks.	While the user’s personal data is being processed, including the storage of such data for the legally stipulated timescales, regardless of the legal basis of the data processing.

In all cases, and without prejudice to the above, the user is advised of the following:

With regard to the storage period for cookies, you are advised to consult our cookies policy.
In general, when personal data is no longer necessary for the data processing purpose for which it was collected, the data will be blocked. It will remain available only to the appropriate authorities for the possible discharge of legal responsibilities during the processing of the same, and always in accordance with the applicable legislation—the data cannot be used for purposes other than these. After the expiry of the relevant legal timescales applicable to instances of blocking, the said data will be deleted in accordance with the applicable legislation, or may, if applicable, be securely anonymised by TRAGSA (anonymised data/non-personal data).

WHAT RIGHTS DO YOU HOLD OVER YOUR DATA?

You can exercise your rights of access, rectification, erasure, limitation on processing, data portability or the right to object by sending a written request by email to info@caminobarrancodemasca.com quoting the reference “Exercise of Rights,” accompanied by a copy of your National ID Document or equivalent (passport, Foreigner’s Identification Number, etc.). In the event that you consider that your personal rights have not been sufficiently regarded, you can make a complaint to the competent authority, in this case the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

WILL MEASURES BE TAKEN TO SAFEGUARD AND PROTECT YOUR PERSONAL DATA?

Taking into consideration the nature, scope, context and stated purposes of the data processing, as well as the likelihood of serious risk to your rights and liberties, TRAGSA applies (and will continue to apply) appropriate technical and administrative measures to ensure the proper security and protection of your personal data, applying standards of privacy by design and by default, in addition to applying a concurrent risk-focused system which will be reviewed and updated as necessary.

The use of the Hypertext Transfer Protocol Secure (HTTPS) on our platform provides an enhanced guarantee of the security of your personal data.

VALIDITY AND AMENDMENT OF THE PRIVACY POLICY

TRAGSA reserves the right to amend this policy to adapt it to future legislative doctrinal or case-law changes resulting from application, or from technical, operational, commercial, corporate or business developments, by giving you reasonable advance notice of the changes whenever possible. In all cases, it is recommended that, whenever you access this platform, you carefully read this policy, as any amendment will be published here. Similarly, TRAGSA may inform you personally and in advance of planned changes to this policy, before such changes come into effect, provided that this is technically and reasonably possible, and particularly if you are a registered user or a customer of TRAGSA.