Privacy Policy

Data Controllers

Data Controller: FIGRUPO MARINAS S.L.
NIF: B15997794
Address: Paseo Marítimo Alcalde Francisco Vázquez, S/N, 15001, A Coruña
E-mail for exercising rights: marina@marinacoruna.es
Data Protection Officer: NorQuality Consultores, S.L.
E-mail: protecciondedatos@norquality.es

Purposes and legal bases

In addition to the basic information on data protection provided through each of the data collection channels, the following provides additional information regarding the purposes, legal bases and other information relating to the following files or processing activities:

Customers: Personal data will be processed for the purpose of providing the contracted service or product, as well as managing invoicing, collections, payments, delivery or shipment of products, accounting, tax and administrative management, including maintaining the commercial relationship. The lawfulness of the processing is based on Art. 6.1.b. GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.
Potential customers: Personal data will be processed to provide quotations/offers for products or services and to respond to requests for information in accordance with the customer’s requirements. The lawfulness of the processing is based on Art. 6.1.a. GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.
Professional contacts: Data will be processed for the maintenance of the professional or commercial relationship between our organisation and the entity (natural or legal person) to which the persons concerned belong. This includes identifying the contact person, managing communications necessary for the development of the relationship, coordinating activities, responding to enquiries, as well as professional contact through the means provided. The lawfulness of the processing is based on Art. 6.1.f. GDPR: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”, in accordance with the provisions implementing Art. 19 of the LOPDGDD.
Suppliers: Data will be processed for the proper management and monitoring of suppliers and the provision of contracted services, purchased products or receipt, shipment and enquiries. Management of commercial reports, delivery notes and payment of supplier invoices. Accounting, tax and administrative management. Maintenance of the commercial relationship. The lawfulness of the processing is based on Art. 6.1.b. GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.
Applications: If CVs are received, they will be reviewed to determine whether the profile matches any of our job positions.

The lawfulness of the processing is based on Art. 6.1.a. GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.

Contact: Contact details will be used to manage your request or enquiry. The lawfulness of the processing is based on Art. 6.1.a. GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.
Video surveillance: Personal data will be processed for the purpose of preserving the security of facilities, property and persons. The lawfulness of the processing is based on Art. 6.1.f. GDPR: “processing is necessary for the purposes of the legitimate interests pursued by the controller” and on Art. 22.1 of the LOPDGDD: “Natural or legal persons, public or private, may process images through camera or video surveillance systems for the purpose of preserving the security of persons and property, as well as their facilities”.
Website users: Personal data collected as a result of visiting our website will be processed for the following purposes:
- Contact section for submitting enquiries, complaints, suggestions or claims
- Analysis of browsing habits through analytical cookies (see the Cookie Policy published on the website).

The lawfulness of the processing, where your data is received as a result of using the contact form or submitting CVs, is based on Art. 6.1.a. GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.

Social media: Data will be processed for the dissemination of activities/events organised by the company, to display our services/products and/or employees in the performance of their activities through the public social media profiles associated with FIGRUPO MARINAS S.L.

The lawfulness of the processing is based on Art. 6.1.a GDPR: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.

Rights Management: Personal data will be processed for the management, analysis and response to data protection rights exercised by data subjects within the framework of the applicable regulations. The lawfulness of the processing is based on Art. 6.1.c. GDPR: “processing is necessary for compliance with a legal obligation to which the controller is subject”.
Regulation 2016/679 of the European Parliament and of the Council.
Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.
Data transfers or disclosures

For the management of certain services offered by the entity, it is necessary to allow certain data to be accessed by third-party service providers contracted for this purpose. In this regard, the entity enters into the respective necessary data processing agreements and has provided precise instructions to the different service providers or data processors in order to ensure the security and integrity of the data to which they have access as a result of the provision of the contracted service.

Outside the cases mentioned above, your personal data will not be disclosed to third parties, except where legally provided for.

Data retention period

In addition to the basic information on data protection provided through each of the data collection channels, the following provides additional information regarding the purposes and legal bases of the following files or processing activities:

Customers: data will be retained until the end of the contractual relationship and will remain, duly blocked, for the limitation periods applicable to any liabilities that may arise (6 years).
Potential customers: data will be retained for 1 year.
Suppliers: data will be retained for as long as necessary to fulfil the purpose for which it was collected.
Professional contacts: data will be retained until the end of the professional relationship with the data subject.
Personnel: data will be retained for the legally established retention periods.
Applications: data will be retained for 1 year.
Video surveillance: data will be retained for 30 days.
Website users: data will be retained while their request is being processed (contact).
Social media: data will be retained while the consent granted by the data subject remains valid, without prejudice to their right to withdraw it at any time.
Rights management: data will be retained for the time necessary to fulfil the purpose for which it was collected and to determine any potential liabilities that may arise from such purpose and from the processing of the data.

Profiling and international data transfers

No automated profiles will be created. The company uses tools such as Microsoft 365, which may involve potential international transfers of data outside the European Economic Area. These transfers are always carried out on the basis of adequacy decisions that provide a level of data protection equivalent to that guaranteed by EU legislation.

In the absence of an adequacy decision, transfers will be carried out through the signing of Standard Contractual Clauses approved by the European Commission, which guarantee an adequate level of protection of personal data.

Likewise, the company will implement appropriate technical and organisational measures to guarantee the security of the personal data transferred, with the aim of ensuring its confidentiality, integrity and availability, minimising the potential risks that may arise from processing in those third countries.

Withdrawal of consent

In cases where the processing of personal data is based on consent, data subjects are informed of their right to withdraw their consent at any time, in a simple and free manner, by means of a written request addressed to the address of the Data Controller or via marina@marinacoruna.es. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal.

Rights of data subjects

Data protection regulations grant a series of rights to data subjects or data owners. These rights are as follows:

Right of access: right to obtain information on whether their personal data is being processed, the purpose of the processing being carried out, the categories of data concerned, the recipients or categories of recipients, the retention period and the origin of such data.
Right to rectification: right to obtain the rectification of inaccurate or incomplete personal data.
Right to object: right to object to a specific processing activity based on the consent provided.
Right to erasure: right to obtain the erasure of data in the following cases:
- When the data is no longer necessary for the purpose for which it was collected
- When the data subject withdraws their consent
- When the data subject objects to the processing
- When the data must be erased in compliance with a legal obligation
- When the data has been obtained through an information society service based on the provisions of Art. 8, section 1 of the European Data Protection Regulation.
Right to restriction of processing: right to obtain restriction of the processing of data when any of the following circumstances applies:
- When the data subject contests the accuracy of the personal data, for a period enabling the company to verify its accuracy.
- When the processing is unlawful and the data subject objects to the erasure of the data.
- When the company no longer needs the data for the purposes for which it was collected, but the data subject requires it for the establishment, exercise or defence of claims.
- When the data subject has objected to the processing while it is being verified whether the legitimate grounds of the company override those of the data subject.
Right to data portability: right to receive, where the processing is carried out by automated means, their personal data in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another Data Controller, provided that the processing is based on consent or carried out within the framework of the performance of a contract.
- This right, by its very nature, does not apply when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.
Right not to be subject to automated individual decision-making: right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them.

This right shall not apply when:

It is necessary for the entering into or performance of a contract between you and the Data Controller
The processing of your data is based on your prior consent

*In these first two cases, the Data Controller must guarantee the data subject’s right to obtain human intervention, express their point of view and contest the decision.

It is authorised by Union or Member State law and appropriate measures are established to safeguard the rights and freedoms and legitimate interests of the data subject.

*In turn, these exceptions shall not apply to special categories of data (Art. 9.1), unless Article 9.2(a) or (g) applies and the appropriate measures referred to in the previous paragraph have been taken.

Data subjects may exercise the aforementioned rights by contacting the entity in writing, sent to marina@marinacoruna.es, indicating in the Subject line the right they wish to exercise, or, if preferred, by sending their request to the company’s postal address: Paseo Marítimo Alcalde Francisco Vázquez, S/N, 15001, A Coruña. The entity will respond to your request as soon as possible and taking into account the deadlines established in data protection regulations.

FIGRUPO MARINAS S.L. has appointed a Data Protection Officer, who can be contacted at protecciondedatos@norquality.es.

If you consider that your rights have not been duly addressed, you have the right to lodge a complaint with the Spanish Data Protection Agency www.aepd.es

Security

The security measures adopted by the entity are those required in accordance with the provisions of Article 32 of the GDPR. In this regard, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the entity has established appropriate technical and organisational measures to ensure a level of security appropriate to the existing risk.

In any event, the entity has implemented sufficient mechanisms to:

Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
Restore the availability of and access to personal data quickly in the event of a physical or technical incident.
Regularly verify, assess and evaluate the effectiveness of the technical and organisational measures implemented to ensure the security of the processing.
Pseudonymise and encrypt personal data, where applicable.
Limit and control access to personal data.

Cookies

A cookie is a file or device that is downloaded onto users’ terminal equipment for the purpose of storing data that may be updated and retrieved by the entity responsible for its installation. In other words, it is a file that is downloaded onto your computer when accessing certain websites. For more information, please consult our Cookie Policy.