This Privacy Policy has been developed in accordance with the provisions of the current Organic Law on the Protection of Personal Data, as well as Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, concerning the protection of individuals with regard to the processing of personal data and the free movement of such data, hereinafter referred to as the GDPR.
The purpose of this Privacy Policy is to inform the owners of personal data, whose information is being collected, about specific aspects related to the processing of their data. This includes, among other things, the purposes of the processing, contact details for exercising their rights, data retention periods, and security measures.
Data Controller
In terms of data protection, the Data Controller is the entity responsible for the files/processing operations identified in this policy, specifically in the «Data Processing» section.
Below are the identification details of the owner of this website:
- Data Controller: Bjorn Dunkerbeck
- Postal Address: 35200
- Email Address: info@dunkerbeck.com
Data Processing
The personal data requested, where applicable, will be limited to those strictly necessary to identify and respond to the request made by the data subject (hereinafter referred to as the «interested party»). This information will be processed in a fair, lawful, and transparent manner concerning the interested party. Personal data will be collected for specific, explicit, and legitimate purposes, and will not be further processed in a manner incompatible with those purposes.
The data collected from each interested party will be appropriate, relevant, and not excessive in relation to the purposes for each case and will be updated as necessary.
Before collecting their data, the data subject will be informed of the general points regulated in this policy to provide express, precise, and unequivocal consent for the processing of their data, as follows:
Purposes of Processing
The explicit purposes for which each processing operation is carried out are detailed in the informative clauses incorporated into each data collection channel (web forms, paper forms, audio recordings, posters, or information notes).
However, the personal data of the interested party will be processed exclusively to provide an effective response and address the requests made by the user, as specified next to the option, service, form, or data collection system used by the data subject.
Legal Basis
As a general rule, prior to processing personal data, Bjorn Dunkerbeck obtains the express and unequivocal consent of the data subject through the inclusion of informed consent clauses in the various data collection systems.
In cases where consent is not required, the legal basis for the processing by Bjorn Dunkerbeck will be the existence of a law or regulation specifically authorizing or requiring the processing of the data subject’s data.
Recipients
As a general rule, Bjorn Dunkerbeck does not transfer or communicate data to third parties, except when legally required. In cases where this is necessary, such transfers or communications will be explicitly communicated to the data subject through informed consent clauses included in the various personal data collection systems.
Origin
As a general rule, personal data are always collected directly from the data subject. However, in certain exceptions, data may be collected through third parties, entities, or services other than the data subject. In such cases, this will be communicated to the data subject through informed consent clauses included in the various information collection systems within a reasonable time frame and no later than one month.
Retention Periods
The information collected from the data subject will be retained as long as it is necessary to fulfill the purpose for which the personal data was collected. Once the purpose has been fulfilled, the data will be deleted, leading to their blocking. The data will then be kept exclusively available to public administrations, judges, and courts for the purpose of addressing potential responsibilities arising from the processing during the statute of limitations period. After this period, the data will be destroyed.
For reference, the legal retention periods for different matters are as follows:
| Document | Period | Legal Reference |
|---|---|---|
| Labor-related or social security documents | 4 years | Article 21, Royal Legislative Decree 5/2000 |
| Accounting and tax documentation (commercial purposes) | 6 years | Article 30, Commercial Code |
| Accounting and tax documentation (fiscal purposes) | 4 years | Articles 66 to 70, General Tax Law |
| Building access control data | 1 month | AEPD Guidelines on video surveillance |
| Video surveillance | 1 month | AEPD Guidelines and Organic Law 4/1997, 4/2015 |
Browsing Data
Regarding browsing data that may be collected through the website, if such data are subject to regulation, please refer to the Cookie Policy published on our website.
Rights of Data Subjects
Data protection regulations grant a series of rights to data subjects or owners of the data, website users, or users of Bjorn Dunkerbeck’s social media profiles. These rights include:
- Right of Access: Obtain information on whether their data are being processed, the purposes of the processing, the categories of data, recipients, retention periods, and the data’s origin.
- Right of Rectification: Correct inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of data in certain situations:
- When data are no longer necessary for their original purpose.
- When the data subject withdraws consent.
- When the data subject objects to the processing.
- When data must be deleted to comply with a legal obligation.
- When data were collected based on online services as per Article 8(1) of the GDPR.
- Right to Object: Object to specific processing based on the data subject’s consent.
- Right to Restriction: Request limited processing under certain circumstances:
- When the data’s accuracy is contested.
- When processing is unlawful and erasure is opposed.
- When data are no longer needed but are required for legal claims.
- When objecting to processing pending legitimate interest verification.
- Right to Data Portability: Receive data in a structured, commonly used, and machine-readable format or transfer it to another data controller when:
- Processing is based on consent.
- Processing is automated.
- Right to Lodge a Complaint: File a complaint with the relevant supervisory authority.
To exercise these rights, data subjects may contact Miguel Ángel Suarez Brito by email at info@dunkerbeck.com, specifying the right they wish to exercise in the subject line. Requests will be addressed promptly, considering the deadlines established by data protection regulations.
Security
The security measures implemented by Bjorn Dunkerbeck comply with Article 32 of the GDPR. Measures are tailored to the state of the art, costs of implementation, the nature, scope, context, and purposes of processing, and the varying risks to individuals’ rights and freedoms. Measures include:
- Ensuring the confidentiality, integrity, availability, and resilience of processing systems and services.
- Restoring availability and access to data promptly in the event of a physical or technical incident.
- Regularly verifying, assessing, and evaluating the effectiveness of technical and organizational measures.
- Pseudonymizing and encrypting personal data where necessary.
