The data subject who provides EXPAL with personal data (the USER) through this online platform or by other means (for example, social networks) is informed that the processing of their data is carried out by: EXPALCorp Holding, S.L. and its subsidiaries (hereinafter “EXPAL”), with Corporate Tax Id (CIF) B84598754 and registered office in Avenida del Partenón, 16, 28042 Madrid. You can consult the complete list of the companies that make up the Group on www.EXPAL.net . Telephone: +34 91 722 01 00 Email: gdpr@EXPAL.net
Purposes of data processing
At EXPAL, the processing of data is carried out for the following purposes, depending on the reason for which they have been provided:
- To manage the commercial relationship with the customer and associated services, as well as to send commercial communications regarding products or services similar to those initially contracted.
- To send information about events related to EXPAL.
- To send EXPAL surveys.
- To manage, where applicable, the participation of the USER in available promotions, discounts, raffles and competitions.
- To contact the sender of the information, respond to their application, request or query and manage the publication of queries and comments and conduct a later follow up.
- To manage, where applicable, the USER registration process on the Online Platform.
- To carry out, where applicable, the profile of the USER in order to offer him/her contents, products and services in a personalised way.
- To assess and manage, where applicable, their curriculum vitae for selection processes that adapt to their professional profile and carry out the necessary actions for the selection and recruitment of staff.
Duration of the data processing
The data for the management of the relationship with the customer and the invoicing and payment of services will be kept for as long as the contract is in force. Once this relationship has been terminated, the data may be kept for the period of time required by applicable legislation and until the possible liabilities arising from the contract expire. The data for the management of queries and requests will be kept for the time necessary to respond to them. The data relating to the publication of comments on our products will be kept during the validity and advertising of the products or services to which they refer, unless you express your wish to have them removed at any time. The data for participation in competitions, raffles and promotions will be kept for their duration, according to their specific rules, to manage their development and, later, until the possible liabilities arising from their implementation have expired. The data to send commercial communications and the preparation of commercial profiles of our products or services will be kept indefinitely until, where applicable, you express your wish to have them deleted. Curriculum vitae data for selection processes shall be retained for the period necessary to manage the selection process in question or, in any event, for a period of one year.
Legitimacy for data processing
The legal basis for the processing of personal data is to implement the provision of the corresponding services as well as to offer new products or services to our customers. This legitimate interest is recognised by the applicable legal regulations (General Data Protection Regulations), which expressly allow the processing of personal data concerning this legal basis. The basis for sending commercial communications to non-customer users is the consent that has been requested and may be revoked at any time. The withdrawal of such consent shall in no case affect the implementation of the contract, but the processing of data for that purpose carried out previously shall not lose their lawfulness as a result of the fact that the consent has been revoked. The basis for the processing of the curriculum vitae is the consent given by the applicant to participate in the selection process. However, the rights of access, rectification, cancellation, opposition to the processing may be exercised by any of the means described in this Policy.
EXPAL guarantees an adequate level of security in relation to the risks presented by the processing and the nature of the data to be protected. Such measures are established for the prevention of any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss or alteration and any other form of unlawful processing. In the event of international transfers, EXPAL ensures that personal data transferred outside the EU/EEA are adequately protected.
EXPAL guarantees that the access and transfer of personal data to third parties is carried out in accordance with the applicable laws and regulations and with the appropriate contractual guarantees.
Communication of your data
Your data may be communicated to the following entities: To the companies of the EXPAL Group headed by EXPALCorp Holding, for the purpose of centralized management of our activities and compliance with internal administrative purposes, including the processing of personal customer data. Also, if consent has been given, the data may be transferred to these companies for the purpose of sending commercial communications that may be of interest, taking into account the customer profile. To the financial institutions through which the management of collections and payments is made. To the competent Public Administrations and Authorities, in the cases provided for in the Law and for the purposes defined therein.
You may exercise your rights of access, rectification, deletion or opposition, as well as any other legally provided for at any time, as well as in the event that your data are no longer necessary for the purposes for which they were collected. Likewise, and in certain circumstances, you may request a limitation on the processing of your data, in which case they will only be kept for the purpose of exercising or defending you against possible claims before the Spanish Data Protection Agency. To exercise any of these rights, you must send an e-mail to gdpr@EXPAL.net, indicating 'data protection' as the subject line. In your request, you must indicate the right you wish to exercise and identify yourself accordingly. We also inform you that you can file a complaint with the Spanish Data Protection Agency.