WEB PRIVACY POLICY
Data Controller
The company responsible for processing your data under this Privacy Policy is:
TALLERES PENA, S.L.
Tax ID Number (NIF): B08359705
Address: C/ Arquimedes, 18 – 08918 Badalona (Barcelona)
Email address: informat@penagrup.com
Website: penagrup.com
Telephone: +34 93 460 82 80
Registered in the Commercial Register of
At TALLERES PENA, S.L., we recognise the importance of protecting your personal information and are committed to processing it responsibly and in accordance with data protection laws.
This Privacy Policy is intended to regulate all aspects relating to the processing of data of the different users who browse or provide their personal data through the various forms located on the website.
Personal Data
Personal data is information that identifies you or makes you identifiable.
Through the website, in the designated fields provided for this purpose, we collect the personal data communicated by the user: name, surname, email address, telephone number, postal address, city, etc., as well as any other information voluntarily provided through any social network in which the user is registered. In this case, privacy will depend on the configuration established by the user and the terms and conditions of the social network itself.
A user’s visit to the website does not imply that they must provide any information relating to their personal data. However, should they provide it, the data will be processed lawfully and always subject to the principles and rights established in GDPR 2016/679 of 27 April 2016 and Organic Law 3/2018 of 5 December on Data Protection and Digital Rights.
Purpose, Duration and Legal Basis for Processing
The data provided by the user will be processed for the following purposes:
- Sending newsletters and information about TALLERES PENA, S.L. products
Under the user’s consent, we collect and process personal data in order to send information about our products and services.
This data will be retained until the user withdraws consent and for the legally established period, with a minimum duration of three years.
The legal basis for processing is the user’s consent, granted by selecting the acceptance box for our Privacy Policy before subscribing to the newsletter through the corresponding form on the website.
The user may withdraw consent at any time without affecting the lawfulness of processing based on consent prior to its withdrawal.
- Improving the browsing experience on the website
This data will be retained until the user withdraws consent by deleting cookies and for the legally established period, with a minimum duration of three years.
The legal basis for processing is the user’s consent when accepting cookies.
The user may withdraw consent at any time without affecting the lawfulness of processing based on consent prior to its withdrawal.
- Registering as a “registered user”
This allows the user to access a private service area and receive information about our activities, including commercial communications regarding updates to our services by any electronic means.
This data will be retained until the user requests deregistration and for the legally established period, with a minimum duration of three years.
The legal basis for processing is the user’s consent when registering through the registration form and accepting the Privacy Policy before submitting the request.
The user may withdraw consent at any time without affecting the lawfulness of processing based on consent prior to its withdrawal.
- Managing communications submitted through the whistleblowing channel (Report2Box)
We will process personal data (where the communication is not anonymous) and information provided by the interested party in order to manage and resolve reports submitted through the whistleblowing channel available on the website.
The legal basis for processing is the performance of a task carried out in the public interest and compliance with a legal obligation.
Data will be retained only for the period strictly necessary to determine whether an investigation should be initiated regarding the reported facts.
In any case, after three months from the entry of the data, if the report has not progressed, the information may only be retained in anonymised form as evidence of the functioning of the system.
If the report results in an investigation, the data will be deleted and blocked within the internal whistleblowing system and retained for a period not exceeding ten years.
The data may continue to be processed by the competent authority or body in the event of an investigation.
Data will only be disclosed to third parties when necessary for disciplinary measures or legal proceedings, without prejudice to reporting criminal or administrative offences to the competent authorities.
Disclosure of Personal Data and International Transfers
Your data will not be disclosed or transferred to third parties except where legally required or to service providers acting as data processors on behalf of the Controller.
Our servers are located within the European Union and, as a general rule, we contract service providers located within the European Economic Area (EEA) or in countries recognised as providing an adequate level of data protection.
If it becomes necessary to use service providers requiring the transfer of personal data outside the European Union or to countries not recognised as providing an adequate level of protection, we will ensure the security and legitimacy of processing through adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules or any other mechanism approved by the supervisory authority.
Updating Data
It is important that users inform us of any changes to their personal data so that we can keep it updated. Otherwise, we cannot be held responsible for its accuracy.
The user guarantees that the personal data provided is truthful, accurate and up to date, and undertakes to communicate any changes.
Third-Party Data
If the user provides personal data belonging to third parties for any purpose to TALLERES PENA, S.L., the user guarantees that such data has been obtained lawfully, that the affected individuals have been informed and have consented to the communication of their data, and that the information provided is accurate and truthful.
Mandatory Nature of Requested Information
All forms on our website indicate mandatory fields with an asterisk (*).
If the user does not complete these fields or does not accept the Privacy Policy, the information cannot be submitted.
Use of Passwords
To access the Private Area, the USER must log in using the email address and password created during registration, in accordance with the complexity requirements established on the website.
Users are responsible for maintaining the confidentiality and security of any identifiers and passwords selected during registration and undertake not to transfer them to third parties or allow access by unauthorised persons.
Users must immediately notify the Controller of any event that may result in improper use of identifiers or passwords, such as theft, loss or unauthorised access, in order to proceed with their immediate cancellation.
Rights of Data Subjects
You have the right to access your personal data and obtain confirmation regarding its processing, as well as a copy of the personal data being processed.
You have the right to update your data, request rectification of inaccurate data, or request its deletion when it is no longer necessary for the purposes for which it was collected.
You may request restriction of processing, object to processing, withdraw consent and exercise your right to data portability.
Likewise, you have the right not to be subject to decisions based solely on automated processing.
You may exercise your rights by contacting us at:
C/ Arquimedes, 18 – 08918 Badalona (Barcelona)
E-mail: pena@penagrup.com
If you believe your rights have not been adequately respected, you have the right to lodge a complaint with the Spanish Data Protection Agency at:
www.aepd.es
Processing of Data of Minors
Any person providing data through the forms on this website and accepting its processing declares that they are over 14 years of age.
Access to and use of the website by persons under this age is prohibited.
If at any time the Controller becomes aware that a person under 14 years of age has provided personal data, such data will be deleted immediately.
Parents or legal guardians may contact TALLERES PENA, S.L. to block access accounts created by minors who have registered using false information.
Social Media
The purpose of tools such as Facebook, Twitter, Instagram and other social networks is to provide visibility and dissemination of the activities carried out by our organisation.
These platforms store personal data on their own servers and are governed by their respective privacy policies.
Users are advised to review the terms of use and privacy policies of each social network when registering and configure their privacy settings accordingly.
The Controller reserves the right to remove any content published by third parties that violates the law, encourages unlawful conduct or contains messages that undermine the dignity of individuals or institutions.
Likewise, the Controller reserves the right to block or report the profiles responsible for such content.
Cookies
A cookie is a small file that is downloaded and stored on a user’s device when accessing a website.
Cookies allow the website to store and retrieve information about a user’s browsing habits or device and, depending on the information they contain and how the device is used, may be used to recognise the user.
Users may prevent the installation of cookies by selecting the appropriate settings in their browser.
For further information, please refer to our Cookie Policy.