DATA PROTECTION POLICY
LEWIS MCNEICE with CIF X2354490A registered office in AVDA DE LOS CASTROS, locality SANTANDER CP 39005. Cantabria province of Spain is responsible for the processing of personal data that it carries out.
LEWIS MCNEICE applies the principle of active responsibility in the processing of your personal data, maintaining a constant update and a promotion of the continuous improvement of the data protection system. Maintains all documentation and records available to the control authority and those in charge of the treatment, providing the evidences that demonstrate its firm commitment to the protection of personal data.
LEWIS MCNEICE guarantees:
Respect for the freedoms and fundamental rights of natural persons
that data is treated in a lawful, fair and transparent way
that the data processed is accurate, adequate, relevant and limited in relation to the purposes for which they are collected
that the purposes for which they are collected are explicit and legitimate and that they are not treated
in a manner incompatible with those purposes.
that the data will not be kept beyond the time necessary for the purposes for which they were collected
- the appropriate technical and organizational measures to guarantee a level of security appropriate to the risk.
In those data treatments that entail a high risk for the rights and freedoms of people, LEWIS MCNEICE will carry out an impact evaluation as set out in this manual.
Also, if you have to designate a data protection representative for advice, supervision and cooperation between the company and the control authority, it will be determined in accordance with art. 37 of Regulation (EU) 2016/679 and as established in this manual.
RIGHTS OF INTERESTED PARTIES
Procedure for the exercise and obligations for the person in charge.
In general, Regulation (EU) 2016/679 requires those responsible to facilitate the exercise of their rights by those concerned. This mandate assumes that the procedures and forms for this must be visible, accessible and simple. Regulation (EU) 2016/679 does not establish a specific way for the exercise of rights, but it does require those responsible to enable the submission of applications by electronic means, especially when the treatment is carried out by these means.
LEWIS MCNEICE guarantees that the exercise of these rights is free for the interested party, provided that the requests are not manifestly unfounded or excessive, especially by repetitive ones, corresponding to the person in charge of the company demonstrating the unfounded or excessive nature of the requests, being able in these cases the person in charge will charge a fee that compensates the administrative costs of attending the request or refuses to act.
The interested party will be informed about the actions derived from his request within the period of one month, which may be extended two more months in the case of particularly complex requests. That extension of the term is notified within the first month. If the person in charge decides not to comply with the request, he must inform of this, motivating his refusal, within a period of one month from its presentation.
All reasonable measures are taken to verify the identity of those exercising the rights recognized in Regulation (EU) 2016/679, through the requirement of a national identity document or equivalent document proving the identity of the interested party. Likewise, it maintains a REGISTRY OF EXERCISES OF RIGHTS (see annex) where all the exercises of the rights requested by the interested parties are collected and maintained.
For the exercise of rights through applications, the company provides the interested parties wishing to exercise their rights the corresponding models included in the annexes and specified in the following points:
Right of rectification
The right of rectification is set out in Article 16 of Regulation (EU) 2016/679, by which the interested party will have the right to obtain, without undue delay, the rectifier of the inaccurate personal data concerning him. Taking into account the purposes of the treatment, the interested party shall have the right to complete incomplete personal data, including by means of an additional declaration.
In the event that the data of the interested party are incomplete or inaccurate, the company guarantees the update thereof without undue delay.
The interested party can request the right to rectify their data by means of the application form that is included in the Annex DATA RECTIFICATION APPLICATION.
Once the data has been rectified, the company will inform the interested party about the rectification carried out (Annex RESPONSE TO THE EXERCISE OF RIGHTS)
Right to limitation of treatment
The right to limitation of treatment is regulated in art. 18 of Regulation (EU) 2016/679 and establishes the right to limited data at the request of the interested party.
The interested party can request the right to limit their data by means of the application form that is included in the Annex REQUEST FOR LIMITATION OF DATA PROCESSING.
The company in response may proceed to limit the processing of data of the interested party if any of the following circumstances:
When the interested party challenges its accuracy, the treatment is limited for the time necessary to verify the accuracy of the data.
when the processing of the data is illegal but the interested party is opposed to the deletion of their data
when the data is no longer necessary for the purposes of the company but is necessary for the interested party (claims, etc ...)
when the interested party opposes the treatment while verifying if the legitimate interests of the company prevail over those of the interested party
For the limitation of the data, the company will follow any of the following methods:
It will temporarily transfer the selected data to another treatment system. It will prevent user access to the selected personal data.
It will temporarily remove the published data from an internet site.
It will clearly indicate in the system (automated file) that the data that is intended to be treated is limited in its treatment.
In the cases in which the company proceeds to the limitation of the treatment, the data of the affected one can only be object of treatment:
for its conservation.
with the consent of the interested party.
for the formulation, exercise or defense of claims.
for the protection of the rights of the individual or legal entity
for reasons of public interest of the EU or Member States.
Once the data is limited, the interested party will be informed justifying his decision (Annex RESPONSE TO THE EXERCISE OF RIGHTS) as well as the limitation carried out. It will also be reported when the limitation to treatment is lifted.
Right to suppression / right to be forgotten
The art. 17 of Regulation (EU) 2016/679 indicates that the interested party will have the right to obtain without undue delay from the data controller the deletion of personal data concerning him.
The interested party can request the right to rectify their data by means of the application form that is included in the APPLICATION FOR SUPPRESSION / RIGHT TO OBLIGATION.
The company proceeds to suppress the processing of data of the interested party when any of the following circumstances occur:
personal data are no longer necessary in relation to the purposes for which
They were collected.
the interested party withdraws the consent on which the treatment is based and is not based on
another legal basis.
the interested party opposes the treatment (right of opposition).
personal data have been treated illicitly.
personal data are deleted for the fulfillment of a legal obligation that applies to the data controller.
personal data have been obtained in relation to the direct offer to children of services
of the information society.
The company does not proceed to accept the requests of suppression of the interested party when the treatment is necessary in the following cases:
to exercise the right to freedom of expression and information.
for the fulfillment of a legal obligation that requires the treatment of data imposed by EU law or the Member States that applies to the controller or for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the person in charge.
for reasons of public interest in the field of public health.
for purposes of archiving in the public interest, scientific or historical research or statistical purposes. for the formulation, exercise or defense of claims.
The company informs without delay of the character of the request or rejection of the right requested by the interested party, as well as the suppression carried out. Model Annex RESPONSE TO THE EXERCISE OF RIGHTS.
Right of opposition
The right of opposition is regulated in art. 21 of Regulation (EU) 2016/679. We can say that it is the right of the interested party to oppose, at any time, for legitimate and well-founded reasons related to his / her particular situation, to the fact that the personal data that concerns him / her is the object of a treatment.
In order to meet the right of opposition of any interested party, LEWIS MCNEICE provides an appropriate application form, a model included in the Annex OPPOSITION APPLICATION.
When the interested party exercises the right of opposition, LEWIS MCNEICE will stop treating said personal data, performing an analysis in order to consider whether or not the right of the interested party prevails over the legitimate interests of the company. For this purpose, the situation, the reasons and the documentation provided by the interested party will be analyzed in detail.
If there are legitimate reasons to justify the treatment (for example, for the formulation, exercise or defense of claims), the data will continue to be processed, even if the interested party's request is met, and it can be dismissed.
Portability right
The art. 20 of Regulation (EU) 2016/679, reflects that users have a new right, the right to portability. This right complements the right of access, since it allows interested parties to obtain the data that has been provided in a structured, commonly used and machine-readable format.
The right to portability also implies that the personal data of the interested party may be transmitted directly from one entity or company to another, without the need to be delivered to the interested party, provided that this is technically possible.
The Regulation thus opens the possibility not only of obtaining the data and reusing them, but also of transmitting them to another service provider. Therefore, the interested party will have the option of requesting their data or transmitting them directly from one entity to another.
The company guarantees the exercise of the right to portability of the interested party through an appropriate application model, model included in the APPLICATION OF PORTABILITY.
Once the right has been requested, the interested party is informed of all the personal data that are incumbent on him and that he has provided, provided that the treatment is based on the consent or is necessary for the execution of a contract and it is carried out by automated means.
It also facilitates that the interested parties receive the data in a structured format of common use and of mechanical and interoperable reading, whenever the technology allows it.
The company does not apply the right to portability to the data that the interested party has provided on third parties or on the data that has been provided through third parties.
LEWIS MCNEICE with CIF X2354490A registered office in AVDA DE LOS CASTROS, locality SANTANDER CP 39005. Cantabria province of Spain is responsible for the processing of personal data that it carries out.
LEWIS MCNEICE applies the principle of active responsibility in the processing of your personal data, maintaining a constant update and a promotion of the continuous improvement of the data protection system. Maintains all documentation and records available to the control authority and those in charge of the treatment, providing the evidences that demonstrate its firm commitment to the protection of personal data.
LEWIS MCNEICE guarantees:
Respect for the freedoms and fundamental rights of natural persons
that data is treated in a lawful, fair and transparent way
that the data processed is accurate, adequate, relevant and limited in relation to the purposes for which they are collected
that the purposes for which they are collected are explicit and legitimate and that they are not treated
in a manner incompatible with those purposes.
that the data will not be kept beyond the time necessary for the purposes for which they were collected
- the appropriate technical and organizational measures to guarantee a level of security appropriate to the risk.
In those data treatments that entail a high risk for the rights and freedoms of people, LEWIS MCNEICE will carry out an impact evaluation as set out in this manual.
Also, if you have to designate a data protection representative for advice, supervision and cooperation between the company and the control authority, it will be determined in accordance with art. 37 of Regulation (EU) 2016/679 and as established in this manual.
RIGHTS OF INTERESTED PARTIES
Procedure for the exercise and obligations for the person in charge.
In general, Regulation (EU) 2016/679 requires those responsible to facilitate the exercise of their rights by those concerned. This mandate assumes that the procedures and forms for this must be visible, accessible and simple. Regulation (EU) 2016/679 does not establish a specific way for the exercise of rights, but it does require those responsible to enable the submission of applications by electronic means, especially when the treatment is carried out by these means.
LEWIS MCNEICE guarantees that the exercise of these rights is free for the interested party, provided that the requests are not manifestly unfounded or excessive, especially by repetitive ones, corresponding to the person in charge of the company demonstrating the unfounded or excessive nature of the requests, being able in these cases the person in charge will charge a fee that compensates the administrative costs of attending the request or refuses to act.
The interested party will be informed about the actions derived from his request within the period of one month, which may be extended two more months in the case of particularly complex requests. That extension of the term is notified within the first month. If the person in charge decides not to comply with the request, he must inform of this, motivating his refusal, within a period of one month from its presentation.
All reasonable measures are taken to verify the identity of those exercising the rights recognized in Regulation (EU) 2016/679, through the requirement of a national identity document or equivalent document proving the identity of the interested party. Likewise, it maintains a REGISTRY OF EXERCISES OF RIGHTS (see annex) where all the exercises of the rights requested by the interested parties are collected and maintained.
For the exercise of rights through applications, the company provides the interested parties wishing to exercise their rights the corresponding models included in the annexes and specified in the following points:
Right of rectification
The right of rectification is set out in Article 16 of Regulation (EU) 2016/679, by which the interested party will have the right to obtain, without undue delay, the rectifier of the inaccurate personal data concerning him. Taking into account the purposes of the treatment, the interested party shall have the right to complete incomplete personal data, including by means of an additional declaration.
In the event that the data of the interested party are incomplete or inaccurate, the company guarantees the update thereof without undue delay.
The interested party can request the right to rectify their data by means of the application form that is included in the Annex DATA RECTIFICATION APPLICATION.
Once the data has been rectified, the company will inform the interested party about the rectification carried out (Annex RESPONSE TO THE EXERCISE OF RIGHTS)
Right to limitation of treatment
The right to limitation of treatment is regulated in art. 18 of Regulation (EU) 2016/679 and establishes the right to limited data at the request of the interested party.
The interested party can request the right to limit their data by means of the application form that is included in the Annex REQUEST FOR LIMITATION OF DATA PROCESSING.
The company in response may proceed to limit the processing of data of the interested party if any of the following circumstances:
When the interested party challenges its accuracy, the treatment is limited for the time necessary to verify the accuracy of the data.
when the processing of the data is illegal but the interested party is opposed to the deletion of their data
when the data is no longer necessary for the purposes of the company but is necessary for the interested party (claims, etc ...)
when the interested party opposes the treatment while verifying if the legitimate interests of the company prevail over those of the interested party
For the limitation of the data, the company will follow any of the following methods:
It will temporarily transfer the selected data to another treatment system. It will prevent user access to the selected personal data.
It will temporarily remove the published data from an internet site.
It will clearly indicate in the system (automated file) that the data that is intended to be treated is limited in its treatment.
In the cases in which the company proceeds to the limitation of the treatment, the data of the affected one can only be object of treatment:
for its conservation.
with the consent of the interested party.
for the formulation, exercise or defense of claims.
for the protection of the rights of the individual or legal entity
for reasons of public interest of the EU or Member States.
Once the data is limited, the interested party will be informed justifying his decision (Annex RESPONSE TO THE EXERCISE OF RIGHTS) as well as the limitation carried out. It will also be reported when the limitation to treatment is lifted.
Right to suppression / right to be forgotten
The art. 17 of Regulation (EU) 2016/679 indicates that the interested party will have the right to obtain without undue delay from the data controller the deletion of personal data concerning him.
The interested party can request the right to rectify their data by means of the application form that is included in the APPLICATION FOR SUPPRESSION / RIGHT TO OBLIGATION.
The company proceeds to suppress the processing of data of the interested party when any of the following circumstances occur:
personal data are no longer necessary in relation to the purposes for which
They were collected.
the interested party withdraws the consent on which the treatment is based and is not based on
another legal basis.
the interested party opposes the treatment (right of opposition).
personal data have been treated illicitly.
personal data are deleted for the fulfillment of a legal obligation that applies to the data controller.
personal data have been obtained in relation to the direct offer to children of services
of the information society.
The company does not proceed to accept the requests of suppression of the interested party when the treatment is necessary in the following cases:
to exercise the right to freedom of expression and information.
for the fulfillment of a legal obligation that requires the treatment of data imposed by EU law or the Member States that applies to the controller or for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the person in charge.
for reasons of public interest in the field of public health.
for purposes of archiving in the public interest, scientific or historical research or statistical purposes. for the formulation, exercise or defense of claims.
The company informs without delay of the character of the request or rejection of the right requested by the interested party, as well as the suppression carried out. Model Annex RESPONSE TO THE EXERCISE OF RIGHTS.
Right of opposition
The right of opposition is regulated in art. 21 of Regulation (EU) 2016/679. We can say that it is the right of the interested party to oppose, at any time, for legitimate and well-founded reasons related to his / her particular situation, to the fact that the personal data that concerns him / her is the object of a treatment.
In order to meet the right of opposition of any interested party, LEWIS MCNEICE provides an appropriate application form, a model included in the Annex OPPOSITION APPLICATION.
When the interested party exercises the right of opposition, LEWIS MCNEICE will stop treating said personal data, performing an analysis in order to consider whether or not the right of the interested party prevails over the legitimate interests of the company. For this purpose, the situation, the reasons and the documentation provided by the interested party will be analyzed in detail.
If there are legitimate reasons to justify the treatment (for example, for the formulation, exercise or defense of claims), the data will continue to be processed, even if the interested party's request is met, and it can be dismissed.
Portability right
The art. 20 of Regulation (EU) 2016/679, reflects that users have a new right, the right to portability. This right complements the right of access, since it allows interested parties to obtain the data that has been provided in a structured, commonly used and machine-readable format.
The right to portability also implies that the personal data of the interested party may be transmitted directly from one entity or company to another, without the need to be delivered to the interested party, provided that this is technically possible.
The Regulation thus opens the possibility not only of obtaining the data and reusing them, but also of transmitting them to another service provider. Therefore, the interested party will have the option of requesting their data or transmitting them directly from one entity to another.
The company guarantees the exercise of the right to portability of the interested party through an appropriate application model, model included in the APPLICATION OF PORTABILITY.
Once the right has been requested, the interested party is informed of all the personal data that are incumbent on him and that he has provided, provided that the treatment is based on the consent or is necessary for the execution of a contract and it is carried out by automated means.
It also facilitates that the interested parties receive the data in a structured format of common use and of mechanical and interoperable reading, whenever the technology allows it.
The company does not apply the right to portability to the data that the interested party has provided on third parties or on the data that has been provided through third parties.
