From the La Crep we understand that it is essential to maintain a transparent relationship with you, therefore, below, we present our Privacy Policy, so that at all times you are properly informed about how we collect and securely treat any information you provide us.

Your data will be processed in accordance with current legislation and, in particular, in accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Also with regard to the Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

A careful reading of our Privacy Policy will provide you with the necessary information to know how we will use the data you provide us. 

WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

If you, or an authorized person, have provided us with your data, we inform you that these data will be treated in accordance with the provisions of the current regulations on personal data protection.

It is possible that there are other persons responsible for the processing that we carry out, in that case we will always inform who is responsible for the processing of the same, as well as their identification data .

From La Crep we are committed to the fulfillment of the obligation of secrecy of personal data and its duty to protect them. For this purpose, we adopt the necessary measures to avoid its alteration, loss, treatment or unauthorized access in accordance with the provisions of the Regulation.

WHAT PERSONAL DATA DO WE PROCESS?

The personal data we process are:

• Those you choose to voluntarily provide us with
• Data derived from your communications with us.
• The information corresponding to your own navigation in the case of Online Services, (IP address or information derived from cookies or similar devices (you can see our Cookies Policy on the web).
• Information that is available in publicly accessible sources, to which we can legitimately have access.
• The data arising from the contractual or pre-contractual relationship you have with us, including your image, always informing you in this case of the possibility of capturing it.
• Those provided to us by third parties about you, where there is a legitimate basis for doing so or where we have obtained your consent to do so.
• The data of third parties that you provide to us, subject to the consent of the third party in question.

They will always be the minimum and essential data to perform the management that you do with us, and which we report in the section of purposes for which we treat data of this privacy policy.

HOW DO WE HANDLE THE DATA?

At La Crep we always treat your personal data in strict compliance with current legislation. In addition, we inform you that we have the appropriate technical and organizational measures in place to ensure an optimal level of security, guaranteeing that only authorized persons will have access, that we will keep them intact, avoiding any intentional or accidental loss, and that we have reinforced our data processing systems and services.

The operations, management and technical procedures that we perform in an automated or non-automated way and that make possible the collection, storage, modification, transfer and other actions on personal data, are considered personal data processing.

In addition, we inform you that the data is processed jointly by the group entities listed in point 1 of this privacy policy.

WHAT IS THE LEGITIMACY OF THE TREATMENT?

The basis for the legitimacy of the processing of Personal Data shall be the one resulting from the contractual or pre-contractual relationship, the employment relationship or any other that is required for the processing of data, such as express consent or a legal obligation for the data controller.

HOW DO WE MANAGE ELECTRONIC COMMUNICATIONS?

In accordance with the provisions of Law 34/2002 of July 11, 2002, on Information Society Services and Electronic Commerce, and Directive 2002/58/EC, we inform you that you may receive communications and information of a commercial nature through this electronic communication system (e-mails, automated response messages from forms and other communication systems) when you have given us your consent or when they are commercial communications regarding products or services similar to those previously provided by the party responsible for the processing of your data.

In the event that you do not wish to receive communications and information of this nature, you can notify us by this same means indicating in the subject “BAJA COMUNICACIONES COMERCIALES” so that your personal data will be removed from our database. Your request will be acted upon within 1 month of submission. In the event that we do not receive an express reply from you, we will understand that you accept and authorize our entity to continue sending the aforementioned communications.

In the case of receiving such communications by these means, we inform you that the messages are addressed exclusively to the addressee and may contain privileged or confidential information. If you are not the intended recipient, we notify you that unauthorized use, disclosure and/or copying is prohibited under applicable law.

HOW LONG DO WE KEEP YOUR DATA?

The personal data relating to natural persons that from La Crep we collect by any means, will be kept as long as the interested party does not request its deletion. Likewise, they will be kept as long as the relationship that originated the processing of the data is maintained, respecting in any case the legal terms of conservation. At the end of this period, the personal data will be deleted from all the systems of the companies that make up The Crep

WILL YOUR DATA BE COMMUNICATED TO THIRD PARTIES?

There will be no assignment, transmission or transfer of personal data, except for those that we inform you, other than as a result of a legal obligation. If we are requested by the Public Administration or the Autonomous Institutions within the scope of the functions expressly attributed to them by law, your data will be transmitted to us.

If there is an assignment, transmission or transfer of personal data outside the above cases, you will be previously informed so that, if necessary, you can give us your consent.

But in order to organize ourselves correctly, to have good operations and procedures that guarantee good management, from La Crep it may be necessary to hire the services of consultants, professionals, or other service companies to process data under our instructions. This processing on behalf of third parties is regulated in a contract in writing or in some other legally admissible form that allows us to prove its conclusion and content, expressly specifying that the data processor will process the data according to our instructions and will not apply or use them for a purpose other than that stated in the contract, nor communicate them, not even for storage, to other persons.

WHAT ARE YOUR RIGHTS?

Data protection regulations give you the following rights:

• Right to revoke any consent previously given. 
• Right of access: To know what type of data is being processed and the characteristics of the processing carried out. 
• Right of rectification: To be able to request the modification of inaccurate or untrue data. 
• Right of portability: To be able to obtain a copy in interoperable format of the data being processed. 
• Right to the limitation of the treatment in the cases that he/she considers that it is not necessary. 
• Right of cancellation: To request the cessation of data processing and its deletion when its conservation is no longer necessary.

If you would like more information regarding the processing of your data, rectify any inaccurate data, oppose and/or limit any processing that you consider unnecessary, or request cancellation of the processing when the data is no longer necessary, you can write to La Crep a ElduAyen nº9, 36300 Baiona, Pontevedra

• This communication must include the following information: Name and surname of the user, the request, the address and supporting data. 
• The exercise of rights must be made by the user himself. However, they may be executed by a person authorized as legal representative of the authorized person. In this case, documentation must be provided to prove the interested party’s representation. 

Likewise, we would like to inform you that you can withdraw the consent given without affecting the lawfulness of the processing already carried out, by sending your request to the same address indicated in the previous paragraph. In this case, you must attach a copy of your ID card or document proving your identity to your application.

We would also like to remind you that you have the right to file a complaint with the Spanish Data Protection Agency (AEPD), if you consider that your rights have been infringed Data Protection C/ Jorge Juan, 6 28001-Madrid – FAX: 914483680- TELF: 901 100 099- E-mail: ciudadano@agpd.es 

WHAT IS THE PURPOSE AND BASIS OF LEGITIMACY FOR DATA PROCESSING AND HOW LONG WILL THE DATA BE KEPT?

The purposes of the data processing carried out by any or all of the Data Controllers listed at  above are detailed below.

TREATMENT ACTIVITY	PURPOSE OF TREATMENT	BASIS OF LEGITIMACY	CONSERVATION PERIOD
Labor management	Personnel management for the formalization of an employment contract, file control, payroll management, etc.	Contractual relationship	5 years from the end of the contract
Tax and accounting management	Processing necessary for compliance with tax and accounting obligations	Contractual relationship Legal obligation for the responsible party Overriding legitimate interests of the responsible party or third parties	5 years from the end of the contract Time required to meet legal obligations
Contact management	Data processing in order to be able to maintain communications with the interested parties	Contractual relationship Overriding legitimate interests of the controller or of third parties Express consent of the data subject	5 years from the end of the contract Until cancellation and/or opposition by the holder Until the relevant loss of use
Prevention of occupational hazards	Compliance with current legislation on occupational risk prevention and health surveillance.	Contractual relationship Legal obligation for the responsible party	Until the end of the contractual relationship The period legally established by specific regulations
Video surveillance	Capture of images by the video surveillance system and/or alarm system with image capture, to protect the entity’s assets.	Overriding legitimate interests of the responsible party or third parties	1 month
Job candidate management	Personnel selection and filling of positions through resume management, personal interviews and assessment tests.	Vital interests of the person concerned or of other persons Express consent of the person concerned	Maximum 2 years
Organization of events and activities	Management and coordination of activities and events related to the entity’s activities. Attendance and participant control.	Contractual relationship Express consent of the person concerned	Until cancellation and/or opposition by the owner The time required to meet legal obligations
Informative communication and notifications	Dissemination of activities and notifications of relevant information related to the entity’s activity.	Overriding legitimate interests of the data controller or third parties Express consent of the data subject	Until cancellation and/or objection by the holder
Multimedia management	Processing of images and/or videos for dissemination in the media and social networks and promotion of activities	Express consent of the person concerned	Until cancellation and/or opposition by the owner Until the relevant loss of its use
Customer management	Processing of data necessary for the maintenance of the commercial/contractual relationship with customers, invoicing, after-sales service, sending promotions and advertising and customer loyalty.	Contractual relationship Commercial relationship	5 years from the end of the contract The period legally established by the specific regulations.
Labor control	Control of employee attendance at work (vacations, absenteeism, working day record).	Contractual relationship Legal obligation for the responsible party Overriding legitimate interests of the responsible party or third parties	Until the end of the contractual relationship
Supplier management	Analysis, valuation, contracting, order management and management of payments to suppliers	Contractual relationship	5 years from the end of the contract The period legally established by the specific regulations.
Management of group companies	Management and maintenance of group companies	Contractual relationship	The time required to meet legal obligations
Order management	Management and traceability of orders placed through the manager’s various distribution channels	Contractual relationship Commercial relationship	Until the end of the contractual relationship
Management of potential customers	To be able to carry out the necessary communications with potential clients and/or other interested parties, send estimates, prices, product costs and other information requested prior to establishing a contractual relationship.	Business relationship	Until the relevant loss of use
Reservation management	Identification data necessary for the management of the reservation	Express consent of the person concerned	The time required to meet legal obligations
HACCP Management	Compliance with current HACCP regulations.	Legal obligation for the responsible party	5 years from the end of the contract
Organization of contests and sweepstakes	Treatment of the identification and contact data of customers to inform them if they have won the sweepstakes organized by the responsible and deliver the raffle.	Express consent of the person concerned	Until cancellation and/or opposition by the owner The time required to meet legal obligations
Sending advertising	Sending commercial information, notifications about acts and events of interest, offers, information about products and services, to customers and/or potential customers.	Express consent of the person concerned	Until cancellation and/or opposition by the owner Until the relevant loss of its use
E-commerce	Elaboration and management of orders and purchases made through web platforms.	Contractual relationship Commercial relationship	5 years from the end of the contract The period legally established by the specific regulations.