/PData protection
Privacy Policy
Identification of the controller
ASSOCIATION JUNIOR ENTERPRISE EACH (“EACH”) has tax identification number (NIF) G24840928 and is located in Bilbao, Spain.
Contact: info@eachcompany.com
Who is responsible for processing your personal data?
This privacy policy applies to all personal data that the data subject provides to EACH, as well as to any natural person interested in the activities and services that EACH offers through its web pages and through any other means of communication. The purpose of EACH’s Privacy Policy is to give transparency to information on how we process your personal data in compliance with the current data protection regulations. The interested party may contact EACH through the detailed information in the identification of the data controller.
For what purpose do we process your personal data and with what legitimacy?
EACH has a Record of Processing Activities where each of the following processing carried out as the data controller are detailed:
| Processing category | Purpose | Legal basis | Categories of personal data | Recipients | Erasure term |
|---|---|---|---|---|---|
| MEMBERS | Management of members’ personal data | GDPR Art. 6(1)(b) processing necessary for the performance of a contract to which the data subject is party, or to take steps at the data subject’s request prior to entering into a contract | Identifying data, economic data, professional data and curriculum data | Registry of Associations, Banks | 6 years once the relation has finished |
| CONTACT PEOPLE | Management of the contact database (persons linked to customers, suppliers, institutions, public administration and companies in general) | GDPR Art. 6(1)(f) processing necessary for the legitimate interests pursued by the controller or by a third party | Identifying and contact data | Not foreseen | Indefinite as long as they do not request the right of erasure or the data are no longer up to date |
| Website users | Management of enquiries and contact requests received through the website | GDPR Art. 6(1)(f) – legitimate interest | Contact data | Not foreseen | 5 years from the date on which performance of the obligation may be demanded |
| Management of event | Registering and management of personal data of participants of the event | Art. 6.1 a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; Art. 6.1 f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party in relation to advertising and commercial promotion | Identifying and contact data | Not foreseen | 5 years from the date on which performance of the obligation may be demanded |
| Consumers and customer services | Management of consumers purchasing products from the online shop | Art. 6.1 b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; Art. 6.1 f) processing is necessary for the purposes of the legitimate interests pursued by the controller for the sending of advertisement and commercial promotion | Identifying data, economic data, contact data | Tax Office, Banks | 5 years from the date on which performance of the obligation may be demanded |
| Accountability | Administrative and accounting management of clients | Art. 6.1 b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract | Identifying data, economic data, contact data | Tax Office, Banks, legal and financial consultants | 6 years from the date of the last entry made in the books |
In the case, duly justified, which requires to know more detail regarding the Record of Processing Activities, you can contact EACH through any of the channels identified.
How long do we store your personal data?
EACH will store the data of the data subjects during their relationship with the organization and thereafter, the data will be preserved according to the provisions of the archive and documentation regulations established by each applicable law. In case you request a right, you will proceed to delete your data according to the right you have requested.
Who has access to your personal data?
EACH may make transfers or communications of personal data in order to meet its obligations with the Public Administrations in cases that are required in accordance with the current legislation at any time.
What are the rights of those affected?
We inform you that you may exercise the following rights:
- Right of access to your personal data to know which are being processed;
- Right of rectification of any inaccurate personal data;
- Right to delete your personal data, where this is possible;
- Right to request the limitation of the processing of your personal data when the accuracy, the legality or the need for the processing of the data is doubtful, in which case, we may retain the data for the exercise or defense of claims.
- Right to object to the processing of your personal data, when the legal basis that enables us for your processing is the legitimate interest. EACH will stop processing your data unless it has a compelling legitimate interest or for the formulation, exercise or defence of claims.
- Right to the portability of your data, when the legal basis that enables us to process the indicated data is your consent.
Such rights may be exercised free of charge by the interested party and, where appropriate, by written request addressed to info@eachcompany.com.
In addition to the above rights, the data subject shall have the right to withdraw/revoke the consent granted at any time without such withdrawal of consent affecting the lawfulness of the processing prior to his/her withdrawal. EACH may continue to process the data of the data subject to the extent permitted by the applicable law.
EACH reminds the interested party that he/she has the right to file a complaint with the competent Control Authority of the country in which he is.
Unsubscribe from the sending of commercial communications
The interested party has the right to revoke at any time the consent provided for the sending of commercial communications with the simple notification to EACH by which it informs that he/she does not want to keep on receiving commercial communications. For this purpose, the interested party may click on the link included in each communication by canceling the sending of electronic commercial communications or revoking their consent by means of a statement to info@eachcompany.com.
What security measures do we have implemented?
EACH undertakes to comply with its obligation of secret of personal data and its duty to keep it, and will adopt the necessary measures to avoid its alteration, loss, treatment or unauthorized access, in accordance with the provisions of applicable regulations.
EACH has implemented the technical and organizational security measures necessary to guarantee the safety of your personal data and to avoid its alteration, loss and processing and/or unauthorized access, given the state of the technology, the nature of the data stored and the risks to which they are exposed, whether they come from human action or from the physical or natural environment, according to the provisions of the applicable regulations.
Links
The website of EACH may include hyperlinks to other sites that are not operated or controlled by EACH. For this reason, EACH does not guarantee, nor is it responsible for the lawfulness, reliability, utility, veracity and actuality of the contents of such websites or their privacy practices. Please note before providing your personal information to these websites other than EACH that your data protection compliance may differ from us.
Modification of the Privacy Policy
EACH may modify its Privacy Policy in accordance with the applicable law at any time. In any case, any modification of the Privacy Policy will be duly notified to the affected party, in order to be informed of the changes made in the processing of its personal data and, in case the applicable regulations so require, the affected party may grant its consent.