PRIVACY POLICY

QUIMICA DE MUNGUIA SA must ensure that the personal data of the data subject collected on the website are processed according to the principles related to processing: Processed lawfully, fairly, and transparently in relation to the data subject (“lawfulness, fairness, and transparency”).
Collected for specific, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes (“purpose limitation”).
Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”).
Accurate and, where necessary, kept up to date, taking every reasonable step to ensure that inaccurate personal data are erased or rectified without delay with regard to the purposes for which they are processed (“accuracy”).
Stored in a form that permits identification of the data subjects for no longer than is necessary for the purposes for which the personal data are processed (“storage limitation”).
Processed in a manner that ensures appropriate security of the personal data through the use of appropriate technical or organizational measures (“integrity and confidentiality”).
Thus, QUIMICA DE MUNGUIA SA will be responsible for complying with the aforementioned provisions and must be able to demonstrate compliance (“accountability”).
Similarly, the processing carried out by the entity will only be lawful if it meets at least one of the following conditions (“lawfulness of processing”): the data subject has given consent to the processing of their personal data for one or more specific purposes; the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; the processing is necessary for compliance with a legal obligation to which the controller is subject;
the processing is necessary to protect the vital interests of the data subject or of another natural person; the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, especially where the data subject is a child. This legitimate basis shall not apply to processing carried out by public authorities in the performance of their duties. Where the processing is based on the data subject’s consent, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data.

If the data subject’s consent is given in the context of a written declaration that also concerns other matters, the request for consent must be presented in a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.
The data subject has the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of the processing based on consent before its withdrawal.
Before giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw consent as to give it.
QUIMICA DE MUNGUIA SA must include in the forms used to collect personal data the information necessary to comply with the duty to inform as required by Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR).
In this regard, and in order to comply with the applicable and current data protection regulations, when QUIMICA DE MUNGUIA SA collects personal data directly from a data subject, it must:
1. Provide the identity and contact details of the Data Controller and, where applicable, its representative, the contact details of the Data Protection Officer, if applicable, and the purposes for which the personal data are processed, as well as the legal basis for processing.
2. Specify the legitimate interests of the controller or a third party where processing is necessary for the satisfaction of those interests, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
3. Provide the recipients or categories of recipients of the personal data, and, where applicable, the controller’s intention to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision by the Commission.
4. Indicate the period for which the personal data will be stored or the criteria used to determine that period.
5. Inform the data subject of the right to request access to and rectification or erasure of personal data (the “right to be forgotten”), the restriction of processing or the right to object to processing, as well as the right to data portability.
6. Inform the data subject of the possibility to withdraw consent at any time without affecting the lawfulness of processing based on consent prior to its withdrawal. Furthermore, inform the data subject of the right to lodge a complaint with a Supervisory Authority.
7. Specify whether the provision of personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract, and whether the data subject is obliged to provide the personal data and the possible consequences of failure to provide such data.
8. Inform the data subject of the existence of automated decision-making, including profiling, and, at least in such cases, provide meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
When QUIMICA DE MUNGUIA SA does not collect personal data directly from the data subject, it must provide the information described in the previous paragraph, as well as the categories of personal data being processed, the source from which they originate, and, where applicable, whether they originate from publicly accessible sources.
QUIMICA DE MUNGUIA SA must include in the forms or documents used for the collection of personal data, including those available on the website owned by QUIMICA DE MUNGUIA SA, the information necessary to comply with the duty to inform as required by Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR), and, where necessary, include the consent given by the data subject.
In order to meet the requirement for more detailed information to be provided to the data subject whose personal data will be processed, the possibility of presenting the information using a layered or multi-level approach is provided. This information must be provided in clear, simple, and concise language, transparent, intelligible, and easily accessible.
Article 11 of Organic Law 3/2018, of December 5, on Personal Data Protection and Guarantee of Digital Rights (hereinafter LOPDGDD), regulates the basic information required in the first layer.
The layered approach consists of: Presenting Basic Information (1st layer): this involves providing a summary of basic information at the first level, in the same medium and at the same time the data are collected.
Referral to Additional Information (2nd layer): this involves presenting detailed and comprehensive information in a suitable medium, structured, concise, and precise. The method of presenting this additional information will depend on the characteristics of the medium used for notification; it can be presented in paper format or electronically.

Basic website information

Basic Information About Data Protection – Online product purchase management

Controller

QUIMICA DE MUNGUIA SA

Purpose

Data collection, recording, and processing for the purpose of managing the payment and shipment of products.

Rights

Access, rectify, and erase data, as well as other rights, as explained in the additional information.

Additional information

You can consult additional and detailed information about Data Protection

Data protection

In accordance with current and applicable personal data protection regulations, we inform you that your data will be incorporated into the processing system owned by QUIMICA DE MUNGUIA SA, with NIF A48109003 and registered office at CL DERIO BIDEA (BO ZABALONDO AUSOTEGUI 4) 51,48100 MUNGIA(BIZKAIA). Below we provide the most notable aspects of the processing carried out

PROCESSING CARRIED OUT

Commercial actions web form

Purpose: Data collection, recording, and processing for the purpose of responding to your inquiries and/or requests, as well as for advertising and commercial prospecting.
Retention period: as long as the consent given remains valid, unless there is a legal obligation.
Legitimate basis: The consent of the data subject.
Data type:
Basic data: Name and surname, Email address

Newsletter

Purpose: Managing the subscription to the newsletter to send the corresponding mailings.
Retention period: as long as the consent given remains valid.
Legitimate basis: The consent of the data subject.

Data type:

Basic data: Name and surname, Email address

Website user management

Purpose: Data collection, recording, and processing of the user’s data.
Retention period: as long as the consent given remains valid, unless there is a legal obligation.
Legitimate basis: The consent of the data subject.

Data type:

Basic data: Name and surname, Email address

Cookie installation

Purpose: Management and installation of cookies.
Retention period: as long as the consent given remains valid.
Legitimate basis: The consent of the data subject.

Data type:

Basic data: Email address, IP Address

Web form management

Data type: Email address, IP Address
Purpose: To address your inquiries and/or requests.
Retention period: as long as the consent given remains valid.
Legitimate basis: The consent of the data subject.

Data type:

Basic data: Name and surname, Email address, IP Address

Data subject rights

QUIMICA DE MUNGUIA SA informs Users that they may exercise their rights of access,
rectification, restriction, erasure, portability, objection to the processing of their personal data,
and the right not to be subject to automated decisions, including profiling, before the
Controller, as well as withdraw the consent provided.

  • Right of Access: The user’s right to obtain confirmation as to whether or not their data is being processed and, if so, the specific personal data being processed and the legal information of the processing (purposes, legal basis, retention periods, transfers, data origin, etc.).
  • Right of Rectification: The data subject’s right to have inaccurate or incomplete data corrected. Regarding the website, this can only be satisfied in relation to information under the control of the website, for example, deleting comments posted on the page, images, or web content containing the user’s personal data.
  • Right to Restrict Processing: The right to restrict the purposes of the original processing by the controller in certain circumstances.
  • Right to Erasure: The right to have the user’s personal data erased, except as provided in the GDPR (freedom of expression and information, legal obligations, claims, etc.).
  • Right to Data Portability: The right to receive the personal data provided by the user, in a structured, commonly used, and machine-readable format, and to transmit it to another controller when the processing is based on consent or the execution of a contract and is carried out by automated means.
  • Right to Object: The user’s right to object to the processing of their personal data or to have the processing of their data by the website ceased, when the processing is based on legitimate interest or public interest, or in the case of direct marketing activities.
  • Right not to be subject to automated decision-making, including profiling: When the processing is not necessary for the performance or execution of a contract, or authorized by European Union or Member State law, or based on consent, the user has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.
  • Right to Withdraw Consent: For any processing based on consent, you have the right to withdraw it, at any time, free of charge.

To exercise any of the rights regarding data protection described above, you must follow these instructions:
Submit a written request to the address CL DERIO BIDEA (BO ZABALONDO AUSOTEGUI 4) 51,48100 MUNGIA(BIZKAIA) (attn: QUIMICA DE MUNGUIA SA) or via email at c.barrientos@quimunsa.com.
The request submitted by the personal data holder (data subject) seeking to exercise their rights must consider the following:

  • They must be reliably identified, and if there is any doubt regarding the identity of the applicant, they will be asked to rectify the request (e.g., requesting more information, such as a DNI number, the DNI document, the email address provided, etc.).
  • The request may be made by the data subject’s representative, either legal or voluntary, when properly identified and authorized by the data subject (through an express authorization from the data subject to exercise the personal rights regulated in data protection laws).
  • State the specific right(s) you wish to exercise. If no specific processing is mentioned, a response will be provided regarding all processing affecting the user’s personal data. If requesting information on specific processing, only the information on that processing will be provided. If the request is made by phone, they will be informed to submit it in writing, and instructions on how to do so and where to send it will be provided. Information will never be provided over the phone.
  • Provide a postal or electronic address for notifications.
  • Submit supporting documents for the request, where necessary.
  • The applicant must use any means that can demonstrate the sending and receipt of the request.

Finally, we inform you that you have the right to file a complaint with the Spanish Data Protection Agency if you become aware of or believe that an event may constitute a breach of the applicable data protection regulations.

QUIMICA DE MUNGUIA SA undertakes to adopt the necessary technical and organizational measures, in accordance with the level of risks associated with the processing carried out by the entity and indicated in the terms and conditions of use, to ensure the integrity, confidentiality, and availability of personal data.