Personal Data Protection Policy of the ENOTURISMO DE GALICIA platform
In compliance with current regulations on data protection, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR) and the Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD, Organic Law 3/2018 of December 5), we inform you of the Personal Data Protection Policy, as regards the processing of personal data, which is detailed below.
RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA
The controller is the legal entity that determines the purposes and means of processing personal data. In other words, the controller decides how and for what purposes the personal data is processed.
On this platform there are five persons responsible for the processing of personal data, who act under a Joint Responsibility Agreement that you can consult at the end of this policy.
The data of the co-responsibles are:
1. Ruta do Viño Rías Baixas Association, with NIF G36597201, registered with the number 2009/13090-1st Section 1 of the Central Register of Associations of the Xunta de Galicia
Address: Rúa do Príncipe nº 10, Pazo Torrado, postal code 36630, Cambados, province of Pontevedra
Contact email: info@rutadelvinoriasbaixas.com
Telephone: (34) 986 091 088 / 687 523 230
2. Ruta do Viño do Ribeiro Association, with NIF G32367211, registered under number 2007/10518-1 Section 1 of the Provincial Register of Associations of the Xunta de Galicia,
Address for the purposes of notifications in Praza Maior s/n, postal code 32400, Ribadavia, province of Ourense.
Contact email: ruta@rutadelvinoribeiro.com
or Telephone: 988 47 71 00
3. Ruta do Viño Monterrei Association, with NIF G32404006, registered under number 2010/013898 Section 1 of the Provincial Registry of Associations of the Xunta de Galicia,
Address for the purposes of notifications in Verín, rúa Castelao s/n, portal 10, plant BJ, postal code 32600, province of Ourense.
Contact email: info@domonterrei.com
or Telephone: 988 590 007
4. Ruta do Viño da Ribeira Sacra Association, with NIF G27402437, registered under number 2010/013789-1st Section 1 of the Central Registry of Associations of the Xunta de Galicia,
Address for notification purposes at Ría do Comercio 6-8, postal code 27400, Monforte de Lemos, province of Lugo.
Contact email: rutavino@ribeirasacra.org
Contact telephone number: 982 410 968 – 698 167 991
5. Ruta do Viño de Valdeorras Association, with NIF G32395246, registered under number 2009/012921-1º Section 1 of the Central Registry of Associations of the Xunta de Galicia,
Address for notification purposes at Estrada N-120, PK 463 (Valdeorras Regulatory Council headquarters), postal code 32340, Vilamartín de Valdeorras, province of Ourense.
Contact email: info@rutadelvinovaldeorras.com
Contact telephone number: 988 321 150
WHAT PERSONAL DATA DO WE PROCESS AND HOW DO WE PROTECT IT?
Personal data is any information about an identified or identifiable natural person.
For the purposes established in this Privacy Policy, the person in charge collects and treats the personal data that is explained in each type of treatment, and that will depend on the different services that you request or the contractual relationship that you maintain with our entity.
Our organization undertakes to treat it with complete confidentiality and to apply the appropriate security measures, of a physical, technical and organizational nature, for the protection of your personal data.
You guarantee and are responsible, in any case, for the veracity, accuracy, validity and authenticity of the personal data provided and undertake to keep them duly updated.
DATA PROCESSING OF “MEMBERS ADHERED TO THE WINE TOURISM OF GALICIA PLATFORM AND SUPPLIERS”
1. What kind of personal data do we process?
• Identification data: name, DNI/NIF, address, telephone, email address.
• Financial data: bank account, credit card, bank details (TPV,….)
• Data related to transactions: products and services provided, financial transactions.
• Commercial information data: activities, licenses or authorizations, administrative records, etc…
• Academic and professional data: qualifications, professional associations, authorizations.
2. For what purpose do we process your personal data?
- The purpose of the treatment is the management of the commercial relationship with the different partners attached to the platform that sell their tourist products and services through it.
- The personal data provided will be kept as long as the commercial relationship is maintained. If you decide to cancel your personal data, they may be kept in our databases for the periods provided by law in order to comply with tax and accounting obligations, and they will be deleted once said legal periods or those that are applicable have expired.
3. What is the legitimacy for the processing of your data?
- The legal basis for the treatment of your data is the execution of a contract, as well as the fulfillment of a legal obligation of the person in charge.
4. To which recipients will your data be communicated?
- The necessary data will be transferred, both to the clients/consumers and to the financial entities that intervene in the payment operation to carry out the economic transactions in the commercialization platform.
- Your personal data will not be transferred to any entity, except those that are necessary to public organizations due to legal obligation.
- Nor are international transfers of personal data foreseen.
DATA PROCESSING OF “CLIENTS, CONSUMERS OR USERS OF THE PLATFORM”
1. What kind of personal data do we process?
• Identification data: name, ID, address, telephone, email address, IP.
• Personal characteristics data: age and/or date of birth
• Financial data: bank account, credit card data.
• Data related to transactions: products and services provided.
2. For what purpose do we process your personal data?
We treat the personal data that you provide us for the management of customer data to maintain the commercial relationship, accounting, administrative and billing management, as well as tax obligations. In short, the management of purchases that customers/users/consumers make on the Galician wine tourism marketing platform.
The personal data provided will be kept as long as the commercial relationship is maintained. If you decide to cancel your personal data, they may be kept in our databases for the periods provided by law in order to comply with tax and accounting obligations, and they will be deleted once said legal periods or those that are applicable have expired.
3. What is the legitimacy for the processing of your data?
The legal basis for the treatment of your data is the execution of a contract, as well as the fulfillment of a legal obligation of the person in charge.
4. To which recipients will your data be communicated?
The data will be transferred to the adhered partners that offer the tourist product or service that the client contracts, as well as to financial institutions for making payments.
Your personal data will not be transferred to any entity, except those that are necessary to public organizations due to legal obligation.
Nor are international transfers of personal data foreseen.
DATA PROCESSING OF “CONTACTS AND POTENTIAL CLIENTS”
1. What kind of personal data do we process?
• Identification data: name, address, telephone, email address, IP.
2. For what purpose do we process your personal data?
We treat the personal data that you provide us in the contact form for the management of business contact data and potential customers.
The purpose of advertising and commercial prospecting has also been foreseen, for which the express consent of the interested party is requested.
The personal data provided will be kept as long as the opposition to the treatment is not communicated. If you decide to cancel your personal data, it will be removed from our contact database.
3. What is the legitimacy for the processing of your data?
The legal basis for the processing of your data is the express consent that is requested.
4. To which recipients will your data be communicated?
Your personal data will not be transferred to any entity.
Nor are international transfers of personal data foreseen.
PROCESSING OF “NEWSLETTER” DATA
1. What kind of personal data do we process?
• Identification data: name, address, telephone, email address, IP.
2. For what purpose do we process your personal data?
The purpose of the treatment is to send offers and commercial communications, as well as news of interest and news about wine tourism in Galicia through a newsletter or bulletin.
The purpose of advertising and commercial prospecting has also been foreseen, for which the express consent of the interested party is requested.
The personal data provided will be kept as long as the opposition to the treatment is not communicated. If you decide to cancel your personal data, it will be removed from our contact database.
3. What is the legitimacy for the processing of your data?
The legal basis for the processing of your data is the express consent that is requested.
4. To which recipients will your data be communicated?
Your personal data will not be transferred to any entity.
Nor are international transfers of personal data foreseen.
WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA?
In accordance with the applicable regulations on data protection, you have a series of rights in relation to the processing of your personal data. The exercise of these rights will be free for you, except in cases in which manifestly unfounded or excessive requests are made, especially because they are repetitive.
These rights are the following:
1. Right to information: You have the right to be informed in a concise, transparent, intelligible and easily accessible manner, with clear and simple language, about the use and processing of your personal data.
2. Right of access: You have the right to ask us at any time to confirm whether we are processing your personal data, to provide you with access to it and to information about its processing, and to obtain a copy of said data. The copy of your personal data that we provide to you will be free of charge although the request for additional copies may be subject to charging a reasonable amount based on administrative costs. For our part, we may ask you to prove your identity or require more information that is necessary to manage your request.
3. Right of rectification: You have the right to request the rectification of inaccurate, outdated or incomplete personal data that concerns you. You may also request that incomplete personal data be completed, including through an additional statement.
4. Right of deletion: You have the right to request the deletion of your personal data when, among other reasons, the data is no longer necessary for the purposes for which it was collected. However, this right is not absolute, so that our organization may continue to keep them duly blocked in the cases provided for by the applicable regulations.
5. Right to limit processing: You have the right to request that we limit the processing of your personal data, which means that we may continue to store it, but not continue to process it if any of the following conditions are met:
or that you challenge the accuracy of the data, during a period that allows the person in charge to verify the accuracy of the data;
or the treatment is unlawful and you oppose the deletion of the data and instead request the limitation of its use;
or our entity no longer needs the data for the purposes of the treatment, but you need them for the formulation, exercise or defense of claims;
- You have opposed the treatment, while it is verified if the legitimate reasons of our entity prevail over yours.
6. Right to data portability: You have the right to have your data transmitted to another data controller in a structured, commonly used and machine-readable format. This right applies when the processing of your personal data is based on consent or on the execution of a contract and said processing is carried out by automated means.
7. Right of opposition: This right allows you to oppose the processing of your personal data, including profiling. We will not be able to attend to your right only when we treat your data in the event that we prove legitimate reasons for the treatment or for the formulation, exercise or defense of claims.
8. Right not to submit to automated decisions, including profiling: This right allows you not to be subject to a decision based solely on automated processing, including profiling, which produces -said decisions- legal effects or affects you in a similar way. . Unless said decision is necessary for the conclusion or performance of a contract, is authorized by law or is based on consent.
9. Right to withdraw consent: In cases where we have obtained your consent for the processing of your personal data in relation to certain activities (for example, in order to send you commercial communications), you may withdraw it at any time. In this way, we will stop carrying out that specific activity for which you had previously consented, unless there is another reason that justifies the continuity of the processing of your data for these purposes, in which case, we will notify you of said situation.
10. Right to file a claim with a control authority: You have the right to file a claim with the Spanish Data Protection Agency, C/ Jorge Juan, 6, 28001 Madrid, 901 100 099 – 912 663 517 (www.agpd .es), or at the electronic address: https://sedeagpd.gob.es/sede-electronica-web/vistas/formQuejasSugerencias/seleccionarQuejaSugerencia.jsf
You may exercise the rights indicated above, by sending us a communication to the physical address or to the electronic address indicated at the beginning of this document, along with by providing a document proving your identity and providing the necessary details to process your request.
Interested parties can obtain additional information about their rights on the website of the Spanish Agency for Data Protection, www.agpd.es.
On conformity with the expressed in the article. 23 of Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (LOPDGDD), we inform you that you can restrict unwanted advertising by registering your data free of charge and voluntarily in a file of advertising exclusion. Currently, there is only the file called Robinson List, which is managed by the Spanish Association of Digital Economy (ADIGITAL).
The Robinson List must be consulted by those who are going to carry out an advertising campaign in order to exclude registered persons from it. However, even if you have registered on the Robinson List, merchants can send you advertising for their products or services if you are a customer or if you have given your consent.
By registering on the Robinson List you can choose the means or channel of communication through which you do not wish to receive advertising (postal mail, telephone calls, email or other means). You should take into account that the registration in the Robinson List is effective from the third month from the date you register your data, so it is possible that during that period you will continue to receive some commercial communication.
You can consult the advertising exclusion systems on the website of the Spanish Data Protection Agency: https://www.aepd.es/areas/publicidad/index.html.
Finally, if you wish to register on the Robinson List, you can do so through this link: https://www.listarobinson.es/
AGREEMENT ON JOINT RESPONSIBILITY IN THE PROCESSING OF YOUR PERSONAL DATA
The five Galician wine routes, in accordance with the provisions of article 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, regarding the Protection of Physical Persons with regard to the Treatment of Personal Data and the Free Movement of these (RGPD) – General Data Protection Regulation (hereinafter RGPD), will jointly agree on the objectives and means of the processing of personal data that are carried out on the Galician Wine Tourism Marketing Platform Therefore, they must be considered co-responsible for the treatments that have been mentioned in this data protection policy.
1. DATA PROCESSING OF JOINT CONTROLLERS
The relations of the co-responsibles in relation to the interested parties, occurs in relation to the following TREATMENTS:
• Activity of treatment of members adhered to the Marketing Platform
• User treatment activity of the Trading Platform.
• Activity of treatment of suppliers of the Marketing Platform
• Activity of treatment of contacts of the Marketing Platform
• Activity of newsletter treatment of the Marketing Platform
• Treatment activity derived from the cookies on the website of the Marketing Platform.
2. FUNCTIONS AND RELATIONSHIPS OF THE JOINT RESPONSIBLE PARTIES
The co-responsibility relationships between the Galician wine routes are subject to these points:
• Any of the wine routes is a contact point for the interested parties to exercise their rights of access, rectification, limitation, deletion, opposition, portability and any other recognized in the GDPR.
Consequently, you can go to any of the Galician wine routes to demand compliance with your rights or request information.
All the routes are responsible for complying with the duty of information to the interested parties (arts. 13 and 14 of the GDPR).
3. OBLIGATIONS OF THE JOINTLY RESPONSIBLE PARTIES:
Each co-responsible is aware of the obligations established by the GDPR for a data controller, for which all of them have committed to:
• Keep a record of processing activities.
• Guarantee that the persons authorized to process personal data undertake, expressly and in writing, to respect confidentiality and comply with the corresponding security measures, of which they must be duly informed.
• Maintain documentation proving compliance with the obligations of the GDPR.
• Guarantee the necessary training on the protection of personal data of the persons authorized to process personal data.
• Respond to the exercise of rights by the interested parties.
• Notification to the rest of the co-responsible parties of data security violations without undue delay, in order to jointly and in a coordinated manner proceed to notify the same to the AEPD.
• Jointly coordinate the implementation of impact assessments related to data protection, when appropriate.
• Jointly coordinate prior consultations with the control authority, when appropriate.
• Implement the following measures:
o Guarantee the confidentiality, integrity, availability and permanent resilience of treatment systems and services.
o Restore availability and access to personal data quickly, in the event of a physical or technical incident.
o Verify, evaluate and value, on a regular basis, the effectiveness of the technical and organizational measures implemented to guarantee the safety of the treatment.
o Pseudonymize and encrypt personal data, if applicable.
The five routes will maintain the following documents in common for the management of the Galician Wine Tourism Marketing Platform:
• A Register of Joint Treatment Activities as co-responsible parties
• A data protection policy for the Platform
• Specific information clauses for the Platform
• A marketing platform cookie policy
• A legal notice of the Marketing Platform in accordance with the LSSI-CE
• Some processes for the exercise of the rights of the interested parties
4. RESPONSIBILITIES
• In relation to the possible responsibilities that could arise with respect to the damages and losses caused to the interested parties, the wine route will not have responsibility that demonstrates its lack of guilt regarding the damage caused, in accordance with the provisions of art. 82.3 of the GDPR.
• The wine route that has paid a penalty or compensation for damages may claim the proportional part from the other co-responsible parties based on the responsibilities assumed by each one. In this sense, it is established that the assumption of responsibilities in this agreement is proportional for each wine route, therefore
