Commitment to the protection of personal data
This English version is a translation provided for convenience. In the event of any discrepancy, the Spanish version prevails.
“INFORMED PERSONS AND DATA PROTECTED”
The Directorate / Governing Body of Deveco Tecnologías de la Información SL (hereinafter, the Data Controller) assumes the utmost responsibility and commitment to the establishment, implementation and maintenance of this Data Protection Policy, ensuring the continuous improvement of the Data Controller with the aim of achieving excellence in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119/1, 04-05-2016), and the Spanish regulations on the protection of personal data (Organic Law, specific sectoral legislation and its development regulations).
The Data Protection Policy of Deveco Tecnologias de la Información SL is based on the principle of proactive responsibility, according to which the controller of the processing is responsible for complying with the regulatory and jurisprudential framework governing that Policy, and is able to demonstrate this to the competent control authorities.
In this sense, the data controller shall be guided by the following principles that should serve all of its staff as a guide and reference framework for the processing of personal data:
- Data protection from the design stage: the controller of the processing applied, both at the time of determining the means of processing and at the time of the processing itself, shall take appropriate technical and organizational measures, such as pseudonymization, designed to effectively apply the principles of data protection, such as data minimization, and to integrate the necessary safeguards into the processing.
- Data protection by default: the controller shall apply appropriate technical and organizational measures to ensure that, by default, only personal data that is necessary for each specific purpose of the processing shall be subject to processing.
- Data protection in the information life cycle: the measures that guarantee the protection of personal data will be applicable throughout the entire life cycle of the information.
- Legality, loyalty and transparency: Personal data will be processed in a lawful, loyal and transparent manner in relation to the interested party.
- Purpose limitation: Personal data will be collected with determined, explicit and legitimate fines, and will not be further processed in a manner incompatible with those fines.
- Data minimization: Personal data shall be adequate, relevant, and limited to what is necessary in relation to the fines for which it is being processed.
- Accuracy: the personal data will be accurate and, if necessary, updated; all reasonable measures will be taken to delete or rectify without delay any personal data that is inaccurate in relation to the fines for which it is being processed.
- Limitation of the retention period: Personal data will be kept in a way that allows the identification of the data subjects for no longer than necessary for the purposes of processing the personal data.
- Integrity and confidentiality: Personal data shall be processed in such a way that an adequate level of security is guaranteed for personal data, including protection against unauthorized or unlawful processing and against loss, destruction or accidental damage, through the application of appropriate technical or organizational measures.
- Information and training: one of the keys to ensuring the protection of personal data is the training and information provided to the personnel involved in the processing of such data. Throughout the life cycle of the information, all personnel with access to the data will be appropriately trained and informed about their obligations regarding compliance with data protection regulations.
The Data Protection Policy of Deveco Tecnologias de la Información SL is communicated to all the personnel of the controller and made available to all interested parties.
As a consequence, this Data Protection Policy applies to all staff of the data controller, who must be aware of it and accept it as their own, being each member responsible for implementing it and verifying the data protection standards applicable to their activity, as well as identifying and proposing any improvement opportunities they consider appropriate in order to achieve excellence in compliance.
This Policy will be reviewed by the Management / Governing Body of Deveco Tecnologias de la Información SL, as often as deemed necessary, to adapt it at all times to the current provisions regarding the protection of personal data.