PRIVACY POLICY

This Privacy Policy regulates the collection and processing by EQUIMODAL SL of the personal data that you, as a user of our website, provide to us.

We recommend that you read this Privacy Policy carefully before providing us with your data.

Data controller	EQUIMODAL SL Pol. Ind. Malpica, c/E, Nave 12, 50016, Zaragoza (España). 976 465 131 info@equimodal.com
Type of personal data processed	Identifying and contact data (full name, DNI (Documento Nacional de Identidad – National Identity Document), e-mail address, company). · Internet-browsing data (IP address, visits to websites, date and time of entering and leaving the website). For more information on the matter, please see our Cookie Policy. Any other information contained in files used in EQUIMODAL’s Whistle-Blower’s Channel.
Purpose of processing	Managing information and / or contact requests, the whistle-blower’s channel, and exercising data-protection rights on request from users. Communicating with users for the purpose of managing the contractual or commercial relationship. Drawing up statistics and carrying out analyses in respect of customers.
Legitimacy	The user’s explicit consent given through the contact forms, the whistle-blower’s channel, and the use of cookies. Legitimate interest in respect of receiving and answering electronic messages containing enquiries or through telephonic communication. Executing the commercial and / or contractual relationship, if our services are contracted. In addition, we hereby inform you that your social-network data may be processed through the corporate profiles on which EQUIMODAL keeps a profile available, all on the basis of the terms and conditions set out in each social network.
Data recipients and international transfers	Not carried out.
Storage period	For as long as the data subject does not request the deletion of her / his data, for the periods needed to comply with contractual and legal obligations, and for the periods during which the data must be available to the competent Authorities.
Exercising rights	compliance@equimodal.com If the exercise of your rights is not dealt with, you can complain to the Agencia Española de Protección de Datos (Spanish Data-Protection Agency) (www.aepd.es/es).
Special data categories	Not processed.
Data-protection officer	Appointing one is not compulsory.

We at EQUIMODAL are concerned for the privacy of our website users, complying at all times with current national and European legislation covering the protection of personal data (especially Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 and Organic Law 3/2018 of 5 December on protecting personal data and guaranteeing digital rights).

The principles that EQUIMODAL follows in matters of data protection are:

• Lawfulness and fairness. We shall always seek your consent to process your personal data for one or more specific purposes of which you shall be notified before you send your data, unless processing your personal data is based on some other legitimate reason in accordance with applicable current legislation.

• Minimisation. We only ask users for data that is strictly necessary for the purposes of processing.

• Limitation on the storage period. We store data for the time needed based on the purpose of processing, and we give information on the period of storage in each case. We review and update personal databases, deleting inactive records and those that are no longer necessary because the purpose of processing has been fulfilled.

• Confidentiality. We apply appropriate technical and organisational security measures for processing personal data, ensuring confidentiality and minimising the risk of unauthorised access or improper use by third parties.

Revoking consent

The user can revoke her / his consent at any time, and EQUIMODAL shall not be able to continue processing personal data sent to it for processing in accordance with your consent. To that end, you can send an e-mail message to compliance@equimodal.com, giving “Cancellation or Revocation of consent to process my data” in the subject line, and, in the content, the type of data processed and whether you request deletion in relation to all processing or in a specific manner. That request is free of charge. Revocation shall not affect data that have already been processed.

As regards sending commercial communications by electronic means, users can revoke their consent and ask to be removed from the distribution lists of compliance@equimodal.com using the procedure indicated, with the word “Removal” in the subject line of the e-mail message sent and / or through the link included at the end of each communication received.

Accuracy of data

The user is liable for ensuring that the personal data that she / he provides to EQUIMODAL using any form on this website are truthful, with respect to any direct or indirect loss or damage that may arise against EQUIMODAL as webmaster of this website or against a third party, if the user completes any form using false data or data relating to third parties without the latter’s prior consent, thus causing deception, damage, or loss.

So that we can ensure that the user’s data are up to date and accurate, we ask her / him to inform us of any change in the data provided.

Consent from minors

Any person or any age is authorised to browse this website.

However, a user who provides her / his personal data must be over 14 years old. If that is not the case, the data must be provided by the user’s parent or legal guardian.

EQUIMODAL reserves the right to ask for a copy of the user’s DNI or equivalent document to verify her / his legitimacy should there be reasonable suspicion that the user may be a minor.

EQUIMODAL recommends that parents, representatives, or legal guardians should supervise or take appropriate precautions when minors browse the internet, and set up filters on the information and content to which minors may or may not have access.

Communicating and assigning your data

EQUIMODAL shall pass on users’ data in the following cases:

to fulfil a legal obligation when the transfer is permitted / required by current regulations, or when required by competent authorities;
when the user gives informed consent to companies linked to EQUIMODAL for the efficient management of the service requested;
as part of a sale, merger, or change of control, or in order to prepare for any of those circumstances. Any other entity that buys all or part of the company shall be entitled to continue using your data, but only as described in this Privacy Policy, unless accepted otherwise.

International data transfers

EQUIMODAL has no plans to make international transfers of the personal data provided.

EQUIMODAL tries to use tools of which the serves are preferably located in Spain, or, failing that, in a European Union Member State, or in a state that complies with European law based on the guidance and recommendations of the Agencia Española de Protección de Datos, the European Commission, and the reference EU agreements in matters of international data transfers.

For how long do we store your data?

We store your personal data for the period necessary to provide you with our services, provided that you do not revoke your consent to processing or request deletion of your data, and during the time necessary to comply with the legal obligations that EQUIMODAL must observe.

That includes the data given to us by the user, or the data generated by or inferred from the user’s use of EQUIMODAL.

In any case, we hereby inform you that EQUIMODAL has put in place internal data-cleaning policies intended to check the storage periods of personal data that it may hold. Accordingly, those data may be deleted when they cease to be necessary and / or appropriate for the purpose for which they were collected, or they may be stored in an aggregate or depersonalised format.

Safety measures applicable to processing personal data

In order to protect users’ personal data, EQUIMODAL itself ensures and checks its data processors, pursuant to the technical and organisational measures appropriate to the state of the art for protecting personal data, taking account of the scope, context, and purposes of processing, as well as the variable risks of probability and seriousness for the rights and freedoms of data subjects, and trying to be in a position to ensure the confidentiality, integrity, availability, and resilience of processing systems and services.

In particular, EQUIMODAL has implemented an Encryption and Authentication Protocol (SHA-256 RSA with RSA encryption (1.2.840.113549.1.1.11)), which ensures that personal data that we consult are transmitted to us on our servers through a secure SSL (Secure Socket Layer) connection to protect them against third parties.

Our policies and procedures relating to information security are regularly revised and updated with the aim of satisfying the requirements of our business, technological changes, and regulatory requirements.

• We implement technical and organisational measures to store and transfer information securely, in order to protect it against attacks and accidental loss as well as unauthorised access, use, destruction, or disclosure.

• We have a strategy for assessing privacy and security risks as well as the impact on privacy, and a disaster and business-continuity contingency recovery plan designed to safeguard the continuity of our services and to protect information processed through EQUIMODAL.

• We apply appropriate restrictions on access to personal information.

• We require our suppliers who are data processors to hold accreditation for security checks that are appropriate for processing personal data that they carry out in each case.

• We require our workers and contractors to undergo ongoing training in the field of information security and in other relevant areas, since they have access to personal information and other sensitive data.

EQUIMODAL declares that it is able to act swiftly and effectively to restore availability and access in respect of personal data, should it identify the occurrence of a physical or technical incident. For that purpose, it keeps an internal incident record, and it carries out the necessary management and control activities in relation to back-up copies that ensure information recovery should a security incident occur.

Similarly, EQUIMODAL declares that it stores users’ personal data on secure servers that are protected against the commonest types of attacks and that are located in Spain.

Giving notification of security breaches relating to personal data

If the security of personal data is breached, unless it is improbable that the said breach constitutes a risk to the rights and freedoms of physical persons, EQUIMODAL shall notify the Agencia Española de Protección de Datos no more than 72 hours after receiving confirmation of the incident, describing the nature of the breach, the possible consequences that may arise from it, the measures taken or proposed to remedy the security breach, and, if possible, identifying the categories and the approximate number of data subjects and data affected.

Similarly, EQUIMODAL shall give data subjects notice as soon as possible when it is probable that the security breach relating to personal data carries a high risk for the rights and freedoms of physical persons, describing such possible consequences as may arise from it as well as the measures taken or proposed to remedy the security breach.

Exercising rights

The user can, at any time, withdraw her / his consent and / or exercise her / his rights of access, rectification, deletion, limitation, objection, and portability contained in European regulations relating to protecting personal data by sending an e-mail message to compliance@equimodal.com.

What do those rights consist of?

The right of access gives the user legitimate grounds for obtaining information on what personal data are being processed, the purpose of processing, the data categories processed, the storage period or criteria, the recipients or categories of recipients, whether profiles are drawn up, the significant information of the logic applied and the forecast consequences of processing, exercising

the rights of rectification or deletion of personal data and of limitation on or objection to processing, and the right to complain to the control Authority.

The user does not need to give justification to exercise it, unless she / he has done so in the previous six months.

If you exercise your right of access, EQUIMODAL is legally required to answer the access request within one month of receiving the request by providing a copy of the personal data that is the subject of processing or by allowing you remote access to those data. EQUIMODAL shall also provide any other additional copy requested by the data subject, subject to payment of the fee arising from the administrative costs related to issuing the additional copy.

EQUIMODAL can refuse access and, if appropriate, seek the protective oversight of the Agencia Española de Protección de Datos on the basis that the said right of access was exercised in the previous six months, or because it is set out in or prevented by a national or EU regulation.

The right of rectification gives the user legitimate grounds for requiring EQUIMODAL to rectify the data that she / he understands to be inaccurate or incomplete. To that end, the user must give us an indication of the data referred to and of the correction that must be made, and must provide supporting documentation. In such a case, EQUIMODAL shall have to make the correction as soon as possible, and, in any case, within one month of receiving your request. That period can be extended by a further two months if necessary, taking account of the complexity and of the number of requests. EQUIMODAL shall inform the data subject of the extension within the first month following the request.

The right of deletion (or “the right to be forgotten”) means that the user is entitled to seek deletion of data when processing is unlawful; when the data subject has withdrawn her / his consent; when the user has exercised the right of objection and there are no other lawful motives for processing; if the data are no longer necessary for the purposes for which they were collected or processed; or if the data must be deleted to fulfil a legal obligation that applies to EQUIMODAL.

The data subject shall not be entitled to have EQUIMODAL delete her / his data when processing is necessary to exercise the freedom of expression and information; to fulfil a legal obligation; to make, exercise, or defend claims; by reason of public interest based on current legislation; for reasons of public health; or for the purposes of historical, statistical, or scientific research.

EQUIMODAL shall answer your request as soon as possible, and, in any case, within one month of receiving your request. That period can be extended by a further two months if necessary, taking account of the complexity and of the number of requests. EQUIMODAL shall inform the data subject of the extension within the first month following the request.

The right to objection means that the user is entitled to have her / his personal data not subjected to processing, or that processing shall be stopped in cases when it is based on direct marketing; on drawing up profiles; when the interests or the rights and freedoms of the data subject take precedence, especially if she / he is a child, over the legitimate interest of EQUIMODAL or of third parties; or historical, statistical, or scientific research, except if processing is necessary for reasons of public interest.

The right to limitation on processing means that the user is entitled to decide which personal data she / he does not to be processed in the future, with the user being able to exercise that right after having previously challenged the accuracy of those data; when processing is unlawful and, instead of exercising the right to have those data deleted, the user decides to limit them for future processing; or when the user considers that EQUIMODAL no longer needs the personal data for the authorised purposes of processing, whereas the user needs them to make, exercise, or defend claims.

If processing is limited, the restriction can be lifted if the data subject gives her / his consent; if there is a possibility that processing may affect the rights of another physical or legal person; if it is justified by legal proceedings; or if there is a significant reason based on public interest and derived from current legislation.

The right to portability means that the user is entitled to receive the personal data provided to EQUIMODAL or to have EQUIMODAL send them to another responsible person, in a structured format that is in common use and that is mechanically readable, provided that processing is done by automated means and is based on consent given on a particular day by the user for one or more specific purposes, or for performing a contract to which the user was a party.

The right to portability shall not apply when transmission is technically impossible; when it can have a negative effect on the rights and freedoms of third parties; or when processing is carried out for a public-interest mission based on current legislation.

Policy on cookies

EQUIMODAL uses cookies to carry out specific functions that are considered essential for the proper functioning and viewing of the website, and, in some cases, for authorising content and collecting analytical and usage data.

To obtain those analyses, this website can store specific information in the server’s logs automatically by using cookies or other mechanisms, such as local storage or browser-session storage, which gather non-personal data on use and browsing relating to the use that the user makes of this website.

You can obtain more detailed information in our Policy on Cookies.

Applicable legislation and jurisdiction

In the event of disputes, claims, or complaints directed at EQUIMODAL and relating to this website or to the activities carried out on it, Spanish legislation shall apply, and the parties expressly submit to it, with the Zaragoza Courts being competent to resolve conflicts arising from or relating to the use thereof.

If EQUIMODAL should be required to make any type of claim, it shall do so before the competent court of the user’s domicile, or in Zaragoza if the case involves legal persons or non-consumer professionals.

If you access this website from a location outside Spain, you shall be liable for complying with all applicable local and international laws.

Modification of the Privacy Policy

EQUIMODAL can modify this Privacy Policy at any time, if it considers such a step to be necessary for legal reasons, for technical reasons, or because of changes in the nature and provision of the website, there being no obligation to notify the user or make her / him aware of those modifications, it being deemed sufficient for them to be published on the website itself.

Any modification shall take effect for users who may make use of this website after that modification. Continuing to use this website after publication of any change shall be considered acceptance thereof. For that reason, at the end of this Privacy Policy, the date of their latest update shall always be published, so the changes made shall be effective from that date.

If the user does not agree with the updates to our Privacy Policy, she / he can withdraw from them by not providing her / his personal data in the website’s contact forms, or by exercising her / his rights as previously specified.