Introduction
This Privacy Policy has been developed in accordance with the provisions of the Organic Act on Personal Data Protection currently in force, and of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter the GDPR (General Data Protection Regulations).
The purpose of this Privacy Policy is to inform the data subjects, in respect of whom information is been gathered, about specific issues relating to the processing of their data, including data-processing purposes, contact details for exercising their rights, data storage periods and security measures.
Controller
In terms of data protection, BAHÍA FELIZ INVEST S.L. must be considered as the Controller in relation to the files/processing identified in this policy, specifically in the Data Processing section.
The identification particulars of the owner of this website are as follows:
- Controller: BAHÍA FELIZ INVEST S.L.
- Postal address: Avenida Windsurfing esq. Viejos Tendereteros, local 6 S/N 1, 35107, San Bartolomé de Tirajana (Las Palmas).
- E-mail address: bfinvest@bahiafelizinvest.com
Data processing
The personal data requested, if any, shall consist exclusively in those data which are strictly essential in order to identify and meet the request made by the data subject. These personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. On the other hand, personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
The personal data gathered from each data subject shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed in each case and, where necessary, kept up to date.
Prior to the gathering of his or her personal data, the data subject shall be informed of the general points regulated by this policy, so that he or she may give his or her express, precise and unequivocal consent to the processing of his or her personal data.
Purposes of the data processing
The explicit purposes for which each processing is carried out are included in the information clauses contained in each of the data collection means (web forms, paper forms, voice-overs or posters and information notes).
Notwithstanding, the data subject’s personal data shall be treated with the exclusive purpose of providing him or her an effective answer and meet the requests made by the user, specified together with the data-collection option, service, form or system used by the data subject.
Lawfulness of processing
As a general rule, prior to the processing of personal data, BAHÍA FELIZ INVEST S.L. obtains the express and unequivocal consent of the data subject by means of the incorporation of informed consent clauses to the different data-collection systems.
Notwithstanding, where the data subject’s consent is not required, the basis legitimating the processing of personal data by BAHÍA FELIZ INVEST S.L. is the existence of a law or a specific rule authorising or requiring the processing of the data subject’s personal data.
Recipients
As a general rule, BAHÍA FELIZ INVEST S.L. does not assign or disclose personal data to third parties, except for mandatory disclosures under prevailing regulations. Notwithstanding, should it be necessary, such assignments or disclosures of personal data are informed to the data subject through the informed consent clauses contained in the various data-collection systems.
Origin
As a general rule, personal data are always collected directly from the data subject, but, in certain exceptions, the data may be collected through third parties, entities or services other than the data subject. In this connection, this point will be informed to the data subject through the informed consent clauses contained in the various data-collection systems and within a reasonable period after obtaining the data, which may not exceed one month.
Storage periods
The personal data obtained from the data subject will be stored for as long as it is necessary to fulfil the purpose for which they were collected, so that, once this purpose has been achieved, the data will be erased. This erasure will give rise to the blocking of the data, which shall be kept exclusively at the disposal of public authorities, courts and tribunals, for the purposes of dealing with any eventual liability arising from the data processing, pursuant to the statute of limitations applicable to such liability. After the expiry of the prescribed time-limit, the data will be destroyed.
Browsing data
In relation to the browsing data that may be processed through the website, for the case that any data subject to regulation is collected, we recommend you to consult the Cookie Policy published in our website.
Data subjects’ rights
The regulations in the matter of personal data protection grant certain rights to data subjects, website users and users of profiles of the social networks of BAHÍA FELIZ INVEST S.L.
The data subjects’ rights are as follows:
- Right of access: The right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipient, the storage period and the origin of such personal data.
- Right to rectification: The right to obtain the rectification of inaccurate or incomplete personal data concerning him or her.
- Right to erasure: The right to obtain the erasure of personal data concerning him or her in the following cases:
- Where the personal data are no longer necessary in relation to the purposes for which they were collected
- Where the data subject withdraws consent on which the processing is based
- Where the data subject objects to the processing
- Where the personal data have to be erased for compliance with a legal obligation
- Where the personal data have been collected in relation to an offer of information society services on the basis of the provisions of Article 8(1) of the European Regulation on Data Protection.
- Right to object: The right to object to a certain processing of his or her personal data based on the data subject’s consent.
- Right to restriction of processing: The right to obtain restriction of processing where one of the following cases applies:
- Where the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
- Where the processing is unlawful and the data subject opposes the erasure of the personal data
- Where the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims
- Where the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
- Right to data portability: The right to receive the personal data concerning him or her in a structured, commonly used and machine-readable format and to transmit those data to another controller where:
- The processing is based on consent
- The processing is carried out by automated means
- Right to file a complaint with the competent supervisory authority.
- The data subject may exercise the above-mentioned rights by means of a letter addressed to BAHÍA FELIZ INVEST S.L. and sent to the e-mail address bfinvest@bahiafelizinvest.com stating in the “Subject” line the right that he or her wishes to exercise.
Reliability
The security measures adopted by BAHÍA FELIZ INVEST S.L. are in keeping with the requirements provided in article 32 of the GDPR. In this respect, BAHÍA FELIZ INVEST S.L., taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, has implemented the appropriate technical and organisational measures to ensure a level of security appropriate to the existing risk.
In any case, BAHÍA FELIZ INVEST S.L. has implemented the mechanisms sufficient to:
- Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
- Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
- Regularly test, assess and evaluate the effectiveness of technical and organisational measures for ensuring the security of the processing.
- Apply pseudonymization and encryption of personal data, where required.