Privacy policy

1. Who does this Privacy Policy apply to?
   
2. Who is the data controller?
   
3. What is the legal basis for processing the data?
   
4. What information do we process?
   
5. For what purposes do we process the data?
   
6. How long will we keep the data?
   
7. To which recipients is the data disclosed?
   
8. Can the data be transferred internationally?
   
9. What rights does the user have over the data they provide?
   
10. How do we protect our users’ data?
    
11. Amendments
    
12. Applicable law

1. Who does this Privacy Policy apply to?

By visiting or browsing the website circuitcalafat.com (hereinafter, the ‘Website’) and using the services offered on the platform, the user (prospective customers) accepts the processing of their personal data in accordance with the terms set out in this document (hereinafter, the ‘Privacy Policy’).

This Privacy Policy and the way in which your data is processed shall be governed by the General Data Protection Regulation, Regulation (EU) 2016/679 (‘GDPR’).

2. Who is the data controller?

The relevant information about the Controller of the personal data processed and provided by users is as follows:

3. What is the legal basis for processing the data?

The legal bases for processing personal data are:

• The completion of the forms on the CIRCUIT CALAFAT Website: these forms (section 4.a) are filled in by the data subject, or the data subject shares certain information, thereby giving their full consent to the processing of their personal data.
  
• The legitimate interest of CIRCUIT CALAFAT.
  
• The performance of a contract.

4. What information do we process?

The information we receive from users, or that users share with us, which will be treated with the utmost confidentiality, is processed and managed as set out below.

a) Information that users provide to us directly: CIRCUIT CALAFAT collects and stores certain information that the user enters on the CIRCUIT CALAFAT Website through the following sections/forms.

b) Information that users provide to us indirectly:

4.1 Data quality: The user must guarantee, both to CIRCUIT CALAFAT and to third parties, the quality of the information and personal data they provide through the CIRCUIT CALAFAT Website. This means that all personal data and information provided must be real, truthful and up to date, and must belong to the user and not to third parties. Where they belong to third parties, we understand that they are provided with those third parties’ consent, and we ask that such third parties be invited to read our legal texts as soon as possible.

4.2 Changes to data: The user must notify CIRCUIT CALAFAT of any change to the personal data provided, and shall in all cases be responsible for the truthfulness and accuracy of the data supplied at any given time.

5. For what purposes do we process the data?

6. How long will we keep the data?

CIRCUIT CALAFAT will keep the user’s personal data for as long as is reasonably necessary to: fulfil any of the purposes mentioned in this Privacy Policy and comply with current legislation, regulatory requirements and relevant orders of competent courts or, in any event, for as long as we send you information or communications and the data subject does not request erasure or object.

Your personal data will be anonymised or deleted once it is no longer relevant to the purposes for which it was collected.

7. To which recipients is the data disclosed?

The personal data collected by CIRCUIT CALAFAT will be used exclusively to achieve the purpose defined on the CIRCUIT CALAFAT Website. To achieve that purpose and to provide the service properly, CIRCUIT CALAFAT may share certain personal data of users:

• Subject to a legal requirement, CIRCUIT CALAFAT may share information with law enforcement authorities and/or third parties in response to requests for information relating to criminal investigations and alleged illegal activities.
  
• External service providers: certain companies subcontracted by CIRCUIT CALAFAT may have access to your personal data and personal information, always under the exclusive control of CIRCUIT CALAFAT, where necessary to provide our services.

a. If the user expressly authorises the sending of commercial information, we may work with Socialwibox (Social WIFI, S.L.), a company registered in Barcelona, Spain. It processes personal data in order to provide, improve and develop new services, always under the exclusive control of CIRCUIT CALAFAT. The user may also consult this provider’s Privacy Policy here.

b. Payment gateway: Comercia Global Payments (Comercia Global Payments Entidad de Pago, S.L.), a company registered in Madrid, Spain. The user may consult this provider’s Privacy Policy here.

• With the user’s consent: apart from the above, the user will be informed if any information about them is to be disclosed to the Website’s business partners or to third parties for purposes other than those set out on the CIRCUIT CALAFAT Website (e.g. for commercial purposes), so that they have the opportunity to decide that their information should not be shared. None of the above disclosures of data will involve selling, renting, sharing or otherwise disclosing customers’ personal information for commercial purposes in a manner contrary to the commitments made in this Privacy Policy.

8. Can the data be transferred internationally?

Should we transfer your personal data to a third country, that is, a country outside the European Economic Area (the countries of the European Union plus Liechtenstein, Iceland and Norway), we will comply with all laws applicable to such transfer, including ensuring that your personal data is kept secure and that safeguards are in place to guarantee adequate protection. To this end, CIRCUIT CALAFAT will use the standard data protection clauses adopted by the European Commission.

9. What rights does the user have over the data they provide?

The user may exercise the following rights before CIRCUIT CALAFAT:

• Right to be informed: the user has the right to receive clear, transparent and easily understandable information about how we use their information and about their rights. That is why we provide this information in this privacy policy.

• Right of access: the user has the right to obtain access to their information (if we are processing it), as well as to other information (similar to that provided in this Privacy Policy), so that they are informed and can verify that we are using their information in accordance with data protection legislation.

• Right to rectification: the user has the right to have their information (inaccurate data) corrected if it is incorrect or incomplete.

• Right to erasure: also known as the ‘right to be forgotten’, this ultimately allows you to request the deletion or erasure of your information where the data is no longer necessary for the purposes for which it was collected. This is not a general right to erasure; there are exceptions.

• Right to restriction of processing: the user has rights that allow them to ‘block’ or prevent further use of their information. Where processing is restricted, we will only keep their information for the establishment, exercise or defence of legal claims. We also keep lists of users who have requested that their information be ‘blocked’ from further use, in order to ensure that the restriction is respected in the future.

• Right to data portability: the user has rights that allow them to obtain and reuse their personal data for their own purposes across different services.

• Right to object: the user has the right to object to certain types of processing, including processing for direct marketing purposes, except where there are compelling legitimate grounds or for the establishment, exercise or defence of possible legal claims.

The rights mentioned above are strictly personal, so the user will be required to prove their identity.

To exercise the rights provided for by law, the user may contact CIRCUIT CALAFAT by email at info@circuitcalafat.com or by letter sent to the address given in section 1 of this Policy. The request must include the following information and documents:

• The data subject’s first name and surname(s), together with a photocopy of their national identity document (DNI) or other valid identification document and, where applicable, that of their representative; the use of an electronic signature will exempt the data subject from submitting these documents.

• The data subject’s address and the specific request being made (the right they wish to exercise).

The user also has the right to lodge a complaint with the relevant Supervisory Authority/Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) whenever they consider it appropriate.

10. How do we protect our users’ data?

CIRCUIT CALAFAT informs the user that it has adopted the technical and organisational measures required by current data protection legislation to guarantee the security of their data and to prevent its alteration, loss, or unauthorised access or processing.

As mentioned above, the personal data provided by users through the CIRCUIT CALAFAT Website will not be transferred to other entities or companies for use for their own purposes. However, certain companies subcontracted by CIRCUIT CALAFAT may have access to personal data and information, always under the exclusive control of CIRCUIT CALAFAT and solely for the purpose of providing a service necessary for the proper functioning of the CIRCUIT CALAFAT Website.

11. Amendments

CIRCUIT CALAFAT reserves the right to amend this Privacy Policy in accordance with the legislation applicable at any given time. The user is therefore advised to review this Privacy Policy periodically in order to stay informed about the processing and protection of personal data and about the rights to which they are entitled.

12. Applicable law

This Policy shall be governed by and construed in accordance with Spanish law, as shall the resolution of any dispute or disagreement relating to this Website. Use of the services of this Website implies express acceptance of Spanish jurisdiction.