CUSTOMER DATA PROCESSING

Data of the person responsible for processing the data collected through the forms on the website:

Identity: ALMOZARA ARTISSTICA SL – – NIF: B-50659218

Postal address: Puerta Sancho Avenue 25 Local, 50003. ZARAGOZA

Telephone: 976443098 – Email: 'agencia@almozara.com'

At ALMOZARA ARTISSTICA SL – we process the information you provide us with in order to provide you with the requested service and invoice you. The data provided will be kept for as long as the business relationship is maintained or for the time necessary to comply with legal obligations and meet any potential liabilities that may arise from compliance with the purpose for which the data was collected. The data will not be transferred to third parties except in cases where there is a legal obligation. You have the right to obtain information about whether ALMOZARA ARTISSTICA SL – is processing your personal data, so you can exercise your rights of access, rectification, deletion and portability of data and opposition and limitation to its processing by writing to ALMOZARA ARTISSTICA SL – , Avenida Puerta Sancho 25 Local, 50003. ZARAGOZA or by email to 'agencia@almozara.com', attaching a copy of your ID or equivalent document. Likewise, and especially if you consider that you have not obtained full satisfaction in the exercise of your rights, you may file a claim with the national supervisory authority by contacting the Spanish Data Protection Agency, C/ Jorge Juan, 6 – 28001 Madrid.

We also request your authorization to offer you products and services related to those contracted and to retain you as a customer.”

SERVICE COMPANIES

Hosting Provider:

A) Clauses for service providers with access to information systems.

1. Purpose of the processing order

Through these clauses, SiteGround Spain SL, as the data processor, is authorized to process on behalf of ALMOZARA ARTISSTICA SL – , as the data controller, the personal data necessary to provide the service specified below.

The treatment will consist of web hosting.

2. Identification of the affected information

In order to carry out the services derived from the fulfilment of the purpose of this assignment, the entity ALMOZARA ARTISSTICA SL – as the data controller, makes available to the entity SiteGround Spain SL the information available on the computer equipment that supports the data processing carried out by the controller.

3. Duration

Once this contract has ended, the data processor must return the personal data processed to the controller and delete any copies in its possession. However, the data may be kept blocked for the minimum time necessary to meet any potential liabilities that may arise from its relationship with ALMOZARA ARTISSTICA SL – , and it will be safely and definitively destroyed at the end of said period.

4. Obligations of the data controller

The data controller and all its staff are obliged to:

Use the personal data to which you have access as a result of the provision of the service only for the purpose of this assignment. Under no circumstances may you use the data for your own purposes.
Process the data in accordance with the documented instructions of the data controller. If the data processor considers that any of the instructions provided infringe the General Data Protection Regulation or any other data protection provisions, the data processor shall immediately inform the controller.
Not to communicate or disseminate the data to third parties, unless expressly authorized by the data controller or in legally admissible cases. If the data processor wishes to subcontract, in whole or in part, the services covered by this contract, he must inform the controller and request his prior authorization.
Maintain the duty of confidentiality regarding the personal data to which you have had access by virtue of this assignment, even after the contract ends.
Ensure that persons authorized to process personal data undertake, expressly and in writing, to respect confidentiality and to comply with the corresponding security measures, of which the person in charge must inform them appropriately.
Keep the documentation proving compliance with the obligation established in the previous section available to the person responsible.
Ensure that persons authorised to process personal data provide the necessary training in the protection of personal data.
Notification of data security breaches:

The data processor shall notify the data controller, without undue delay and via the email address provided by the controller, of any breaches of security of the personal data under its control of which it is aware, together with all relevant information for the documentation and communication of the incident. It shall also notify any failure it has suffered in its information processing and management systems that may jeopardize the security of the personal data processed, its integrity or availability, as well as any possible breach of confidentiality as a result of the data and information accessed during the execution of the contract being made known to third parties.

The following information shall be provided as a minimum:

Description of the nature of the personal data breach, including where possible the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned.
Contact person details for further information.
Description of the possible consequences of a breach of personal data security.
Description of the measures taken or proposed to remedy the personal data breach, including, where applicable, the measures taken to mitigate any potential negative effects.

If and to the extent that it is not possible to provide the information simultaneously, the information will be provided gradually without undue delay.

Provide the controller with all necessary information to demonstrate compliance with its obligations, as well as to enable and contribute to the performance of audits or inspections carried out by the controller or another auditor authorized by him.
Assist the data controller in implementing the necessary security measures to:

a) Ensure the permanent confidentiality, integrity, availability and resilience of treatment systems and services.

b) Restore the availability and access to personal data quickly, in the event of a physical or technical incident.

c) Verify, evaluate and assess, on a regular basis, the effectiveness of the technical and organisational measures implemented to ensure the security of the processing.

Destination of data:

The data controller will not retain personal data relating to the processing carried out unless it is strictly necessary for the provision of the service covered by the contract and only for the minimum time necessary.

Once the provision of the contracted service has been completed, the data processor will delete, return to the controller or deliver, where appropriate, to a new controller, as determined by ALMOZARA ARTISSTICA SL – , all personal data.

Data destruction is not appropriate when there is a legal provision requiring its conservation, in which case it must be returned to the person responsible who will guarantee its conservation, duly blocked, while such obligation persists.

The return must involve the complete deletion of the data existing on the computer equipment used by the data processor. However, the data processor may retain a copy of the data, duly blocked, as long as liabilities may arise from the execution of the services provided to the data controller.

5. Obligations of the data controller

The data controller is responsible for:

Provide the person in charge with access to the equipment so that he or she can provide the contracted service.
Ensure, prior to and throughout the processing, compliance with the provisions in force regarding data protection by the data processor.
Monitor the processing, including the possibility of requesting information to verify compliance with the obligations established in this contract.

B) Confidentiality clauses for service providers with accidental access to data.

1. Duty of confidentiality

The provision of services covered by this contract does not include the processing of personal data.

However, in the event that SiteGround Spain SL staff, accidentally or incidentally, becomes aware of personal data information relating to the processing activities of ALMOZARA ARTISSTICA SL – , they will be obliged to strictly observe the duty of secrecy and confidentiality, both during the course of the contractual relationship and once it has ended,

Following at all times the instructions of the ALMOZARA ARTISSTICA SL staff –
not being able to use the information to which they may have had access for any purpose other than that derived from the provision of service and
not being able to disclose, make known or use for their own benefit or that of third parties the information that they may have learned during the provision of the service subject to this contract.

RECORD OF TREATMENT ACTIVITIES

The data controller must review the data recorded in the sections of the Records of Processing Activities generated and verify that they correspond to the exact circumstances of the data collected, the communications made and other conditions of each of the treatments.

Treatment: Customers

a) Data controller	Identity: ALMOZARA ARTISSTICA SL – – NIF: B-50659218 Postal address: Avenida Puerta Sancho 25 Local, 50003. ZARAGOZA Email: 'agencia@almozara.com' Telephone: 976443098
b) Purpose of the treatment	Customer relationship management
c) Categories of interested parties	Clients: People with whom a business relationship is maintained as clients.
d) Data categories	Those necessary for the maintenance of the commercial relationship. Billing, sending postal or email advertising, after-sales service and loyalty Identification: name and surname, NIF, postal address, telephone numbers, email Bank details: for direct debit payments
e) Categories of recipients	State Tax Administration Agency
f) International transfers	No international transfers are planned.
g) Deletion period	Those provided for by tax legislation regarding the limitation of liabilities
h) Security measures	Those reflected in the SECURITY MEASURES ANNEX

EXHIBIT

INFORMATION OF GENERAL INTEREST

This document has been designed for low-risk personal data processing, from which it follows that it cannot be used for personal data processing that includes personal data relating to ethnic or racial origin, political, religious or philosophical ideology, trade union membership, genetic and biometric data, health data, and data on the sexual orientation of individuals, as well as any other data processing that entails a high risk for the rights and freedoms of individuals.

Article 5.1.f of the General Data Protection Regulation (hereinafter, GDPR) determines the need to establish appropriate security guarantees against unauthorized or unlawful processing, against loss of personal data, accidental destruction or damage. This implies the establishment of technical and organizational measures aimed at ensuring the integrity and confidentiality of personal data and the possibility of demonstrating, as established in Article 5.2, that these measures have been put into practice (proactive responsibility).

In addition, it must establish visible, accessible and simple mechanisms for exercising rights and have defined internal procedures to guarantee effective attention to the requests received.

ATTENTION OF THE EXERCISE OF RIGHTS

The data controller shall inform all employees about the procedure for exercising the rights of interested parties, clearly defining the mechanisms by which the rights may be exercised (electronic means, reference to the Data Protection Officer if applicable, postal address, etc.) and taking into account the following:

Upon presentation of their national identity document or passport, the holders of personal data (interested parties) may exercise their rights of access, rectification, deletion, opposition, portability and limitation of processing. The exercise of rights is free of charge.
The data controller must respond to interested parties without undue delay and in a concise, transparent, intelligible manner, using clear and simple language and retain proof of compliance with the duty to respond to requests for the exercise of rights made.
If the application is submitted electronically, the information will be provided by these means whenever possible, unless the interested party requests otherwise.
Requests must be answered within 1 month of receipt, and may be extended by a further two months depending on the complexity or number of requests, but in this case the interested party must be informed of the extension within one month of receipt of the request, stating the reasons for the delay.

RIGHT OF ACCESS: The right of access shall provide interested parties with a copy of the personal data available together with the purpose for which they have been collected, the identity of the recipients of the data, the expected retention periods or the criteria used to determine it, the existence of the right to request the rectification or deletion of personal data as well as the limitation or opposition to their processing, the right to file a claim with the Spanish Data Protection Agency and if the data have not been obtained from the interested party, any available information about their origin. The right to obtain a copy of the data cannot negatively affect to the rights and freedoms of other interested parties.

Form for exercising the right of access.

RIGHT OF RECTIFICATION: The right to rectification shall be used to modify the data of interested parties that are inaccurate or incomplete in accordance with the purposes of the processing. The interested party must indicate in the request which data it refers to and the correction that must be made, providing, where necessary, the supporting documentation for the inaccuracy or incompleteness of the data being processed. If the data has been communicated by the controller to other controllers, they must be notified of the rectification of these unless it is impossible or requires a disproportionate effort, providing the interested party with information about said recipients, if requested.

Form for exercising the right of rectification

RIGHT OF ERASURE: The right to erasure shall mean that the data of interested parties shall be deleted when they state their refusal to the processing and there is no legal basis that prevents it, the data is not necessary in relation to the purposes for which it was collected, they withdraw the consent given and there is no other legal basis that legitimises the processing or it is unlawful. If the deletion is due to the exercise of the interested party's right to object to the processing of their data for marketing purposes, the data subject's identification data may be retained in order to prevent future processing. If the data has been communicated by the controller to other controllers, they must be notified of the deletion of the data unless it is impossible or requires a disproportionate effort, providing the interested party with information about said recipients, if requested.

Form for exercising the right to erasure.

RIGHT OF OPPOSITION: In the case of the right to object, when interested parties express their opposition to the processing of their personal data to the controller, the latter will stop processing them unless there is a legal obligation to do so. When the processing is based on a mission of public interest or on the legitimate interest of the controller, in response to a request to exercise the right to object, the controller will stop processing the data unless compelling reasons are proven that prevail over the interests, rights and freedoms of the interested party or are necessary for the formulation, exercise or defence of claims. If the interested party objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

Form for exercising the right to object.

RIGHT OF PORTABILITY: In the right to portability, if the processing is carried out by automated means and is based on consent or is carried out within the framework of a contract, interested parties may request to receive a copy of their personal data in a structured, commonly used and machine-readable format. They also have the right to request that they be transmitted directly to a new controller, whose identity must be communicated, when technically possible.

Form for exercising data portability.

RIGHT TO LIMIT PROCESSING: In the right to restriction of processing, interested parties may request the suspension of the processing of their data to challenge its accuracy while the controller carries out the necessary verifications or in the event that the processing is carried out based on the legitimate interest of the controller or in compliance with a mission of public interest, while it is verified whether these reasons prevail over the interests, rights and freedoms of the interested party. The interested party may also request the conservation of the data if he considers that the processing is illegal and, instead of deletion, requests the limitation of processing, or if, although the controller no longer needs them for the purposes for which they were collected, the interested party needs them for the formulation, exercise or defense of claims. The circumstance that the processing of the interested party's data is limited must be clearly stated in the systems of the controller. If the data has been communicated by the controller to other controllers, it must notify them of the restriction of processing of these data unless it is impossible or requires a disproportionate effort, providing the interested party with information about said recipients, if requested.

Form for exercising limitation of processing.

If the interested party's request is not acted upon, the data controller will inform the interested party, without delay and no later than one month after receipt of the request, of the reasons for its failure to act and of the possibility of filing a claim with the Spanish Data Protection Agency and of taking legal action.

SECURITY MEASURES

Depending on the type of processing you have indicated when completing this form, the minimum security measures you should take into account are the following:

ORGANIZATIONAL MEASURES

INFORMATION THAT SHOULD BE KNOWN BY ALL PERSONNEL WITH ACCESS TO PERSONAL DATA

All staff with access to personal data must be aware of their obligations in relation to the processing of personal data and will be informed about these obligations. The minimum information that will be known to all staff will be the following:

DUTY OF CONFIDENTIALITY AND SECRECY
Access to personal data by unauthorised persons must be prevented. To this end, personal data must not be left exposed to third parties (unattended electronic screens, paper documents in public areas, media containing personal data, etc.). This consideration includes screens used to display images from the video surveillance system. When you leave your workstation, the screen must be blocked or your session closed.
Paper documents and electronic media will be stored in a secure location (cupboards or rooms with restricted access) 24 hours a day.
Documents or electronic media (CDs, pen drives, hard drives, etc.) containing personal data will not be discarded without ensuring their effective destruction.
No personal data or any other personal information will be communicated to third parties, paying particular attention to not disclosing protected personal data during telephone consultations, emails, etc.
The duty of secrecy and confidentiality persists even when the employee's employment relationship with the company ends.

PERSONAL DATA SECURITY VIOLATIONS
When personal data security breaches occur, such as theft or improper access to personal data, the Spanish Data Protection Agency will be notified within 72 hours of said security breaches, including all the information necessary to clarify the events that led to improper access to personal data. Notification will be made by electronic means through the electronic headquarters of the Spanish Data Protection Agency at the address https://sedeagpd.gob.es/sede-electronica-web/.

TECHNICAL MEASURES

ID

When the same computer or device is used for processing personal data and for personal use, it is recommended to have several different profiles or users for each of the purposes. Professional and personal uses of the computer must be kept separate.
It is recommended to have profiles with administrative rights for the installation and configuration of the system and users without privileges or administrative rights for access to personal data. This measure will prevent access privileges from being obtained or the operating system from being modified in the event of a cybersecurity attack.
Passwords must be provided for access to personal data stored in electronic systems. The password must be at least 8 characters long and consist of a mix of numbers and letters.
When personal data is accessed by different people, a specific username and password will be available for each person with access to the personal data (unique identification).
The confidentiality of passwords must be guaranteed, preventing them from being exposed to third parties. For password management, you can consult The Guide to Internet Privacy and Security of the Spanish Data Protection Agency and the National Cybersecurity Institute. Under no circumstances will passwords be shared or left written down in a common place and access by persons other than the user.

DUTY OF SAFEGUARDING

The minimum technical measures to ensure the protection of personal data are set out below:

UPDATING COMPUTERS AND DEVICES: The devices and computers used for the storage and processing of personal data are updated to the extent possible.
MALWARE: On computers and devices where the automated processing of personal data is carried out, an antivirus system is available to ensure that personal information and data are not stolen or destroyed as far as possible. The antivirus system is updated periodically.
FIREWALL OR FIREWALL: To prevent unauthorized remote access to personal data, care will be taken to ensure that a firewall is activated and correctly configured on those computers and devices where personal data is stored and/or processed.
DATA ENCRYPTION: When it is necessary to extract personal data from outside the premises where it is processed, whether by physical or electronic means, the possibility of using an encryption method will be assessed to guarantee the confidentiality of personal data in the event of improper access to the information.
BACKUP COPY: A backup copy will be made periodically on a second medium different from the one used for daily work. The copy will be stored in a safe place, different from the one where the computer with the original files is located, in order to allow the recovery of personal data in case of loss of information.

Security measures are reviewed periodically; the review may be carried out by automatic mechanisms (software or computer programs) or manually.