Processing of personal data

PROCESSING OF PERSONAL DATA

At CENTRO DE EMPRESAS E INNOVACIÓN DE ÁLAVA, S.A. we care about the personal data we process and the exact compliance with the current regulations on personal data protection, among others, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC and the Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights.

Accordingly, we hereby inform you of the following matters relating to the processing of personal data carried out at CENTRO DE EMPRESAS E INNOVACIÓN DE ÁLAVA, S.A.

Who is responsible for the processing of your personal data?

Identity: CENTRO DE EMPRESAS E INNOVACIÓN DE ÁLAVA, S.A. (hereinafter, BIC ARABA)

TAX ID: A01046937

Postal address: Calle Albert Einstein, nº 15

01510 of Miñano (Álava)

Phone: 945 298 282

E-mail: bicaraba@bicaraba.eus

Contact details of the Data Protection Officer: dpo@bicaraba.eus

Treatment principles

In the processing of personal data carried out therein, the principles required by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as the General Data Protection Regulation) are respected:

Principle of legality, loyalty and transparency: the data we collect are processed in a lawful, fair and transparent manner, with the prior consent of the data subjects where necessary or, where appropriate, for the performance of a contract to which the data subject is a party or for the implementation at the request of the data subject of pre-contractual measures, or, if the processing is necessary for compliance with an applicable legal obligation or for the fulfilment of legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Principle of purpose limitation: the personal data we process are used for the purposes indicated in the section “For what purpose do we use your personal data?”

Principle of data minimization: in accordance with this principle, the only personal data we collect from users are those strictly necessary to manage the contractual relationship or to be able to respond to queries, suggestions and / or requests for information made to us.

Accuracy principle: the personal data we collect will be kept accurate and, if necessary, updated. To this end, in the event of any change in personal data, the user must inform us so that we can make the appropriate update.

Principle of limitation of the storage period: the personal data we process will be kept for the periods indicated in the “How long will we keep your personal data?” section.

Principle of integrity and confidentiality: to respect this principle, personal data shall be processed in such a way as to ensure adequate security of the data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical and organizational measures.

What categories of personal data do we process?

The categories of data we process through this website are:

Data collected through the contact form: name, e-mail address, telephone number and comment or message sent by the user.

Data collected through the newsletter subscription form: name and surname, company, position, e-mail address.

We do not process data that the General Data Protection Regulation qualifies as “special categories of data” (health data, biometric data, trade union membership, etc.) or personal data relating to criminal convictions or offenses.

All personal data requested, marked with an asterisk, are mandatory, so if the user does not provide any of them we will not be able to fulfill the request and, therefore, we will not be able to fulfill the purpose associated with the corresponding form.

For its part, through cookies, information is collected on the use made by users of the website, pages visited, origin, geographical location, IP addresses, although such information will be collected in aggregate form, i.e. without identifying users. You can consult the information on the cookies used in the Cookies Policy.

How did we obtain your personal information?

All personal data that we process at BIC ARABA are provided to us by the interested parties themselves or their legal representatives.

The personal data that we collect through this website have been collected through the forms provided or through the e-mail address provided to contact us.

The personal data we request, marked with an asterisk, are the minimum necessary to attend and comply with the corresponding purposes in such a way that, in case of not providing them, we will not be able to attend them.

For what purpose do we use your personal data (website users or not)?

Customer data: for the proper maintenance, development, fulfillment and control of the contractual relationship with our customers and the services they demand.

We will also use your identification and contact information to conduct satisfaction surveys and to send you, by electronic means, information of interest on events, courses, grants and any other information related to the interests of customers in your business area.

In this sense, we inform you that in order to manage in a more efficient, dynamic and operative way and to be able to keep a better control of the commercial communications that we send by e-mail we use MailChimp, a platform developed by The Rocket Science Group Llc., whose use implies the installation by the provider of the mentioned service in such mailings of tracking devices of the activity of the recipients, in order to control the opening of the e-mails and the clicking of the links contained in the e-mails, and to be able to elaborate with the information collected reports of follow-up of the campaigns.

Supplier data: For the proper maintenance, development, fulfillment and control of the contractual relationship with our suppliers and the services they provide us.

Personnel data: For maintenance, development, compliance and control of the contractual relationship with our employees, as well as compliance with current regulations on labor, Social Security and Occupational Risk Prevention that may be applicable.

Data of newsletter subscribers: we use your personal data to manage your subscription to our newsletter and, therefore, the sending by e-mail of newsletters or newsletters about our company, its products, services, news, offers or promotions.

In this sense, we inform you that in order to manage in a more efficient, dynamic and operative way and to be able to keep a better control of the commercial communications that we send by e-mail we use MailChimp, a platform developed by The Rocket Science Group Llc., whose use implies the installation by the provider of the mentioned service in such mailings of tracking devices of the activity of the recipients, in order to control the opening of the e-mails and the clicking of the links contained in the e-mails, and to be able to elaborate with the information collected reports of follow-up of the campaigns.

Data collected through the contact form: To manage and respond to queries and requests made by users of our website.

Data of users of our profiles on social networks: To interact with our users, mainly by responding to comments they make to the publications we make in the profiles we have in different social networks.

What is the legitimacy for the processing of your personal data?

Customer data: the legal basis that legitimizes the processing of customers’ personal data is that it is necessary for the execution of the contract to which they are party.

With regard to conducting satisfaction surveys and sending commercial information by BIC ARABA, the legal basis that legitimizes such treatment is that it is necessary for the satisfaction of legitimate interests pursued by it as contemplated in Article 6.1. f) of the General Data Protection Regulation, in terms of commercial prospecting for customer loyalty. This is without prejudice to the possibility they have to oppose the sending of such commercial information, which they may do at any time and, in any case, to receive each of the commercial communications they receive, since in each of them they will be offered the possibility to unsubscribe to stop receiving them.

Suppliers “data: the legal basis that legitimizes the processing of suppliers” personal data is that it is necessary for the performance of the contract to which they are a party.

Personnel data: the legal basis that legitimizes the processing of employees’ personal data is that it is necessary for the performance of the employment contract to which they are party.

Data of newsletter subscribers: the legal basis that legitimizes the processing of your personal data is the consent given when subscribing to our newsletter and, therefore, the need for such processing to meet your subscription. In this sense, we inform you that you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

Data collected through the contact form: the legal basis that legitimizes the processing of the personal data provided by the interested parties when completing the form is their need for the execution of the legal relationship that arises when making the consultation or request.

Data of users of our profiles on social networks: the legal basis for the processing of your personal data is the consent given by following us on our social networks, such processing therefore being necessary to interact with users (e.g., to respond to comments).

To which recipients will your personal data be communicated?

We will only disclose personal data of data subjects if this is necessary for the performance of a contract or legal relationship to which they are a party or in order to comply with legal obligations.

For some matters, the services of third parties are used, acting as data processors, with whom the corresponding data processing contract has been signed in accordance with the provisions of article 28.3 of the General Data Protection Regulation.

International data transfers

We inform you that for some information management, administrative and communications issues we use services offered by providers acting as data processors and that, despite being outside the European Union and the European Economic Area, international data transfers involving their use have the appropriate safeguards referred to in Article 46.2 c) of the General Data Protection Regulation (standard contractual clauses approved by the European Commission) as well as being certified under the EU-US Data Privacy Framework.

How long will we keep your personal data?

Customer, supplier and employee data: we will retain such personal data for the duration of the relevant contractual relationship and, after its termination, for the periods necessary to comply with legal obligations.

However, the identification and contact data of customers that we use to conduct satisfaction surveys and to send newsletters or commercial information will be retained until they express their opposition or refusal to continue receiving it, which they can do at any time and in each communication they receive, where we have enabled a simple and free system to unsubscribe and stop receiving it.

Data of newsletter subscribers: we will keep your personal data until, where appropriate, you revoke your consent, which you can do at any time and in each communication you receive, where we have enabled a simple and free system to unsubscribe and stop receiving it.

Data collected through the contact form: the personal data provided to us will be kept only during the management of the queries or requests made to us in such a way that, once their processing is completed, they will be deleted.

Data of users of our profiles on social networks: the terms of conservation of the personal data of our followers in social networks depend on the policies of each social network, although we will treat them only until they stop following us.

What are your rights when you provide us with your personal data?

• Right to request access to your personal data: in order to know and verify the lawfulness of the processing, you may at any time request confirmation that BIC ARABA is processing your personal data and, in such case, we will inform you, among other questions, about what data we are processing, its purpose, origin of the data, expected period of data retention and, where appropriate, recipients or categories of recipients.
• Right to request rectification: you may ask us to rectify inaccurate personal data or to supplement incomplete personal data, including by means of an additional statement. In this case, you must indicate in your request which data is concerned and the correction to be made, accompanied, where appropriate, by supporting documentation for the inaccuracy or incompleteness of the data being processed.
• Right to request deletion (“right to be forgotten”): you can ask us to delete and stop processing your personal data if they are no longer necessary for the purposes for which they were collected or otherwise processed, you withdraw your consent, they have been unlawfully processed or they must be deleted in order to comply with a legal obligation.
• Right to request the limitation of the processing of your personal data: in this case BIC ARABA will only keep your personal data for the formulation, exercise or defense of claims, or with a view to the protection of the rights of another natural or legal person or for reasons of important public interest.
• Right to portability of your personal data: you can ask us to provide your personal data, to you or to another data controller you specify, in a structured, commonly used and machine-readable format.
• Right to object to the processing: BIC ARABA will stop processing your personal data in the way you indicate, unless we have to continue processing it for compelling legitimate reasons or for the formulation, exercise or defense of possible claims.

How to exercise your data protection rights: to exercise your rights you must send us a written request addressed to CENTRO DE EMPRESAS E INNOVACIÓN DE ÁLAVA, S.A. at calle Albert Einstein, nº 15 C.P. 01510 de Miñano (Álava) or by sending an e-mail to dpo@bicaraba.eus.

CENTRO DE EMPRESAS E INNOVACIÓN DE ÁLAVA, S.A. will respond to all requests within the terms and conditions required by current legislation on personal data protection.

How to file a complaint before the Basque Data Protection Authority: if you consider that we have not treated your personal data properly or that we have not duly attended to the exercise of your data protection rights, you can file a complaint before the Basque Data Protection Authority, at Beato Tomás de Zumárraga Street, nº 71-3ª Planta – C.P. 01008 Vitoria-Gasteiz (Álava).

Security

In accordance with the provisions of Article 32 of the General Data Protection Regulation, BIC ARABA has adopted the appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

In order to assess the adequacy of the security level, particular account has been taken of the risks presented by data processing, in particular as a result of accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or unauthorized disclosure of or access to such data.

Duty of secrecy

BIC ARABA has adopted measures to ensure that any person acting under their respective authority and having access to the personal data provided by users, can only process them following the instructions of the company, and must also keep the corresponding professional secrecy about them, which will have an indefinite duration.

To this end, our employees have signed a confidentiality and secrecy agreement regarding the information and personal data they handle in connection with their employment relationship with the company.

Use of the web site by minors

We kindly ask users to read the policies on web use by minors that we have published in the “Legal Notice” of our website.

Social networks

Profiles in social networks: BIC ARABA has profiles in some of the main social networks that exist today, so that there may be a processing of personal data of our followers, people who appear in the publications we make (for example, photographs) and people who send us private messages.

Data processing and purpose: the data treatments that BIC ARABA will carry out are limited and conditioned to the policies and functionalities of each social network.

When a user becomes a follower of ours on a social network, he/she authorizes us to use his/her personal data only within the scope of the corresponding social network for the management of our page or profile and the communications that we maintain in a bidirectional manner with our followers through chat, messages or other means of communication that the Social Network currently and in the future allows. This implies that we will have access to your profile information that appears in the comment, for example and without limitation, your username, image (if the user has put a picture on your profile), and comments made.

We also want to inform that, when a user becomes a follower of ours, the news that we publish may also appear on his wall and that, if he makes comments on ours, his comment will be accessible by the other followers as well as the name of his profile and, where appropriate, the photograph that he has on it. In any case, it is the responsibility of the user to use the Social Network.

We will not use the personal data of users for purposes other than those indicated in previous paragraphs or to send them information through an environment other than the social network.

We will not extract your personal data from the social network environment unless you give your consent or request us to do so in order to fulfill a request you make to us.

Legitimacy of the treatment: the legal basis that legitimizes the processing of the personal data of our followers is the consent they provide by following us.

Data recipients: we will not communicate to third parties or make international transfers of the personal data of our followers unless it is necessary to comply with any legal obligation. This is without prejudice to the fact that public comments made on our social networks by followers and our responses will be seen by the rest of the followers.

Data retention period: the terms of conservation of the personal data of our followers in social networks depend on the policies of each social network, although we will treat them only until they stop following us.

Data protection rights: regarding the rights of access, rectification or deletion, limitation of processing, opposition and portability of your personal data, we can only act in accordance with the possibilities allowed by each social network. BIC ARABA will provide all possible assistance to the interested party to exercise these rights.

In any case, any of our followers may unsubscribe from our page or profile at any time so that we would no longer have access to their personal data, although the social network may retain the comments previously made on our wall.

In any case, it is the responsibility of the user to use the Social Network, so BIC ARABA does not assume any responsibility in this regard.

You can consult below the privacy policy of each of the social networks where BIC ARABA has a page or profile:

LinkedIn: Privacy Policy

X (Twitter): Privacy Policy

Instagram: Privacy Policy

Cookies

Cookies are small text files that are stored on the hard disk or in the memory of the computer that accesses or visits the pages of certain websites, so that the user’s preferences can be known when reconnecting. Cookies stored on the user’s hard drive cannot read the data contained therein, access personal information or read cookies created by other providers.

See information on the cookies used on this website in the “Cookies Policy” section.

Date text: September 1, 2024