PRIVACY POLICY

Our data protection policy is established and communicated in accordance with the applicable regulations, particularly in relation to Regulation (EU) 2016/679 of the European Parliament and of the Council, concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, which repeals Directive 95/46/EC (hereinafter, GDPR), and Spanish Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

This privacy policy is common and applicable to the company CODESH MADRID, S.L.

Technical and organizational measures have been adopted to ensure the confidentiality, security, and proper handling of personal data, preventing their alteration, loss, unauthorized processing, or access, in accordance with the applicable regulations. These measures are continuously reviewed to address legislative or corporate developments.

This policy may change over time due to possible legislative updates or management reasons. Any such changes will be reflected immediately on the website.

The company handles data of individuals acting in a professional capacity, as well as data of individuals in their private sphere. This policy accounts for both types of data processing. The company may act as either the DATA CONTROLLER or the DATA PROCESSOR, and this policy covers both roles.

WHO IS THE DATA CONTROLLER?

CODESH MADRID, S.L., with tax ID B19874452, registered address at Edificio Ciudad de Sevilla, Calle Dublín 1, Oficina 1L, Las Rozas de Madrid (Madrid), Spain – Email: customerservice@codeshofficial.com

PURPOSE AND DATA RETENTION

We process the information provided by our clients and other interested parties for the following purposes:

a) CONTRACTUAL PURPOSES: Regarding partners, suppliers, collaborators, and employees, to manage the rights and obligations derived from the contractual relationship.

b) PURPOSES BASED ON CONSENT: For communications regarding the organization’s activities and initiatives. The company will inform and obtain consent where necessary for the commercial use of data.

c) REGULATORY PURPOSES: To comply with legal and/or regulatory obligations.

d) LEGITIMATE INTERESTS: Under the scope of Article 19 of Spanish Law 3/2018 and Article 6.1(f) of Regulation EU 2016/679.

We process data as a DATA CONTROLLER when collected and processed by us.

We process data as a DATA PROCESSOR when processing data on behalf of a third-party controller.

DATA RETENTION

Personal data will generally be retained:

a) For as long as necessary to fulfill the purposes for which they were collected or for the duration of the contractual relationship, including any required retention to comply with applicable legal obligations.

b) Until a data subject requests erasure.

Data will be blocked upon the occurrence of the earliest of the two above conditions and will be kept exclusively available to judges, courts, the public prosecutor, or competent authorities for any liabilities derived from the processing, during their statutory limitation periods. After that, the data will be deleted.

No profiling is carried out.

LAWFUL BASIS FOR PROCESSING

As a DATA CONTROLLER, the legal bases for data processing include:

a) The contractual relationship and execution of the signed agreement.

b) Explicit consent, where applicable.

c) Compliance with legal obligations.

d) Legitimate interest as per Article 19 of the LOPDGDD  (Organic Law on Data Protection and Guarantee of Digital Rights).

As a DATA PROCESSOR, it is the responsibility of the contracting entity (the DATA CONTROLLER) to determine the legal basis and processing model.

DATA RECIPIENTS

Data may be shared with our collaborators providing services as subcontractors, legal firms, and other processors, as well as public authorities and agencies when required.

Data processing agreements are signed with collaborators, as required by the GDPR.

INTERNATIONAL DATA TRANSFERS

The company does not generally carry out international data transfers. In any case where personal data is transferred outside the EEA, the company will implement appropriate measures to ensure adequate protection.

USER RIGHTS

a) Anyone has the right to obtain confirmation about whether we are processing their personal data.

b) Data subjects have the right to access their personal data and request rectification or erasure when the data is no longer necessary.

c) Under Article 18 GDPR, data subjects may request restriction of processing, in which case data will be retained solely for legal claims.

d) Data subjects may object to processing for marketing purposes, including profiling. The company will stop processing unless there are compelling legitimate grounds or legal claims.

e) Under the right to data portability, data subjects may receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

EXERCISING GDPR RIGHTS

Requests should be submitted in writing to the contact details provided above.

USER RESPONSIBILITY

The user guarantees that the personal data provided is truthful and agrees to inform the company of any changes. The user confirms the accuracy of the information provided and is solely responsible for any inaccuracies and any harm this may cause to CODESH MADRID, S.L., as the website owner.

COMPLAINTS TO THE SPANISH DATA PROTECTION AGENCY

If you believe that your request has not been properly addressed, you may file a complaint with the Spanish Data Protection Agency. More information is available at www.agpd.es.

CATEGORIES OF DATA PROCESSED

What categories of data do we process?

a) Identification and contact details.

b) Professional role or activity-related data.

c) Economic and payment data.

We generally do not process special categories of data under Articles 9 and 10 of the GDPR. If we ever do, explicit consent will be obtained, and the provisions of those articles will be followed.

The data collected is necessary for the purposes outlined and is treated confidentially according to the company’s privacy and security policies.

DATA ORIGIN

As a DATA CONTROLLER, personal data originates from information you provide when requesting services, using our website, or otherwise interacting with us.

As a DATA PROCESSOR, personal data is provided by the DATA CONTROLLER or collected during service delivery on their behalf.