Privacy Policy
I. Introduction
This Privacy Policy has been prepared to provide clear and transparent information regarding the processing of personal data collected by GRUPO MALASA and its member companies. This policy applies to all entities within the group, which operate under the same principles and guidelines regarding data protection, ensuring compliance at all times with current regulations, particularly Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter “GDPR”) and applicable national legislation, thereby ensuring consistent and uniform processing of personal data.
II. Data Controller
Data Controller: MALASA GRUPO, S.L.
Tax ID: B70303482
Address: P.I. O Acevedo, Nave 28, 15185, Cerceda, A Coruña.
Email address for exercising rights: protecciondedatos@grupomalasa.com
III. Shared Responsibility
The Malasa Group is a business group composed of various companies that, for certain personal data processing activities, acts as the data controller; therefore, a joint responsibility agreement has been established with the participating companies regarding the processing of data pertaining to customers and potential customers. This agreement governs the use of data, the provision of information, and the division of responsibilities regarding the management of data subjects’ rights.
IV. Purposes and Legal Bases
This website processes certain personal data about its visitors, primarily data related to browsing (use of cookies) and, where applicable, data voluntarily provided through the contact form.
The personal data collected through the contact form is limited exclusively to the information that the user chooses to provide when contacting us, for the purpose of addressing their inquiry, request, or message. Under no circumstances will unnecessary data be requested, nor will it be used for purposes other than those expressly stated.
In addition, this website uses cookies and similar technologies that collect information related to users’ browsing habits in order to ensure the proper functioning of the site, improve the browsing experience, and, where applicable, obtain statistical data on website usage; for more information, please visit our website policy.
The following section details the purposes for which the personal data collected through this website is processed, as well as other relevant information regarding its processing.
Website users
Personal data is collected through the website for various purposes, including, but not limited to:
- Contact section for submitting inquiries, complaints, suggestions, or claims.
- Analysis of browsing habits using analytical cookies (see the Cookie Policy published on the website).
The lawfulness of the processing is based on Article 6(1)(a) of the GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes.”
Data Disclosures or Transfers
In order to manage certain services offered by the entity, it is necessary to grant access to certain data to third-party service providers contracted for this purpose; In this regard, the entity enters into the necessary data processor agreements and has provided specific instructions to the various service providers or data processors to ensure the security and integrity of the data to which they have access in connection with the provision of the contracted service.
Except as noted above, your personal information will not be disclosed to third parties, except as required by law.
Data Retention Period
In addition to the basic information on data protection provided through each data collection channel, the following is additional information regarding the purposes and legal bases for the following data files or processing activities:
- Website users:
- Contact Form: Your information will be retained for the duration of the processing of your request.
- Cookie data: The data will be retained for a maximum period of 2 years from the date it is collected.
Profiles and International Data Transfers
No profiles will be created.
Certain processing of personal data carried out through Google Analytics, such as that associated with _ga cookies, may involve international data transfers to Google LLC, located in the United States.
Google LLC is certified under the EU-U.S. Data Privacy Framework, as well as its extension for the United Kingdom and the Swiss-U.S. Data Privacy Framework, all of which have been recognized as adequacy mechanisms by the European Commission. Consequently, such transfers are carried out in accordance with Article 45 of Regulation (EU) 2016/679 (GDPR).
The processing of data through these cookies is based on the user’s consent, which can be withdrawn at any time through the cookie settings panel available on the website.
Withdrawal of Consent
In cases where the processing of personal data is based on consent, data subjects are informed of their right to withdraw their consent at any time, easily and free of charge, by writing to the address of the data controller or via protecciondedatos@grupomalasa.com. The withdrawal of consent shall not affect the lawfulness of processing based on consent given prior to its withdrawal.
Rights of Data Subjects
Data protection regulations grant a number of rights to data subjects; these rights are as follows:
- Right of access: the right to obtain information regarding whether your personal data is being processed, the purpose of such processing, the categories of data being processed, the recipients or categories of recipients, the retention period, and the source of such data.
- Right to rectification: the right to have inaccurate or incomplete personal data corrected.
- Right to object: the right to object to certain processing based on the consent provided.
- Right to erasure: the right to have data erased in the following cases:
- When the data is no longer necessary for the purpose for which it was collected
- When the data subject withdraws consent
- When the data subject objects to the processing
- When they must be deleted in compliance with a legal obligation
- When the data has been obtained through an information society service in accordance with the provisions of Article 8(1) of the European General Data Protection Regulation.
- Right to restriction of processing: the right to have the processing of personal data restricted in any of the following cases
- If the data subject disputes the accuracy of the personal data, for a period of time sufficient to allow the company to verify the accuracy of the data.
- When the processing is unlawful and the data subject objects to the erasure of the data.
- When the company no longer needs the data for the purposes for which it was collected, but the data subject needs it to assert, exercise, or defend claims.
- When the data subject has objected to the processing while it is being determined whether the company’s legitimate interests override those of the data subject.
- Right to data portability: the right for the data subject, when processing is carried out by automated means, to receive their personal data in a structured, commonly used, machine-readable, and interoperable format, and to transmit those data to another data controller, provided that the processing is based on consent or is necessary for the performance of a contract.
- By its very nature, this right cannot be exercised when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Right not to be subject to automated individual decision-making: the right not to be subject to a decision based solely on the processing of personal data, including profiling, that produces legal effects concerning the data subject or similarly significantly affects him or her.
This right shall not apply when:
- It is necessary for the conclusion or performance of a contract between you and the data controller.
- The processing of your data is based on the consent you previously provided.
* In these first two cases, the responsible party must ensure that the individuals concerned have the right to seek human intervention, express their point of view, and challenge the decision.
It must be authorized by Union law or the laws of the Member States, and appropriate measures must be in place to safeguard the rights, freedoms, and legitimate interests of the data subject.
* Furthermore, these exceptions shall not apply to special categories of data (Art. 9.1), unless Article 9.2(a) or (g) applies and the appropriate measures referred to in the preceding paragraph have been taken.
Interested parties may exercise the rights listed above by contacting the company, by sending an email to protecciondedatos@grupomalasa.com, indicating in the subject line the right you wish to exercise, or, if you prefer, by sending your request to the company’s mailing address: Polígono Industrial de O Acevedo, Nave 28, 15185, Cerceda, A Coruña.
In this regard, the organization will process your request as soon as possible, taking into account the timeframes established by data protection regulations. Furthermore, please note that the data subject may at any time file a complaint with the Spanish Data Protection Agency (www.aepd.es).
Security
The security measures adopted by the entity are those required in accordance with the provisions of Article 32 of the GDPR. In this regard, the entity, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, has established appropriate technical and organizational measures to ensure a level of security appropriate to the existing risk.
In any case, the entity has implemented sufficient mechanisms to:
- Ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
- Restore the availability of and access to personal data quickly in the event of a physical or technical incident.
- Regularly verify, evaluate, and assess the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
- Pseudonymize and encrypt personal data, where appropriate.
Cookies
A cookie is a file or device that is downloaded to users’ devices for the purpose of storing data that can be updated and retrieved by the entity responsible for its installation. In other words, it is a file that is downloaded to your computer when you access certain websites. For more information, please see our cookie policy.