Porronet informs users of the website about its policy regarding the processing and protection of personal data of users and clients that may be collected through browsing, purchasing products, or subscribing to services via its website. In this sense, Porronet guarantees compliance with the current legislation on the protection of personal data, as stipulated by Organic Law 15/1999 of December 13 on the Protection of Personal Data and by Royal Decree 1720/2007 of December 21, which approves the Development Regulation of the LOPD, as well as by the General Regulation on Data Protection (GDPR) (EU) 2016/679.

SECURITY MEASURES

In accordance with the current legislation on data protection, we inform users that, at Porronet, technical and organizational measures have been implemented in accordance with the aforementioned regulations. The personal data collected in the forms are only processed by Porronet staff or by the Data Controllers established here. Appropriate security measures have been adopted for the data provided, and all available means and technical measures have been installed to prevent loss, misuse, alteration, unauthorized access, and theft of the data you provide to us.

ACCURACY OF DATA

The Client or User declares that all data provided is true and correct and undertakes to keep it updated, informing Porronet of any changes. The user is responsible for the veracity of their data and will be solely responsible for any conflict or dispute that may arise from its falsity. It is important that, in order for us to keep personal data up to date, the user informs Porronet of any changes. Otherwise, we cannot guarantee its veracity.

EXERCISE OF RIGHTS

The LOPD and the GDPR grant interested parties the possibility of exercising a number of rights related to the processing of their personal data. As long as the user's data is processed by Porronet, they can exercise their rights. To do this, the user must contact us, providing documents proving their identity (DNI or passport), by email at sac@porronet.es, or by mail to the address indicated in our legal notice. This communication must include the following information: User's name and surname, request, address, and contact details.

The exercise of rights must be carried out by the user themselves. However, it can be exercised by an authorized person as a legal representative. In this case, documentation proving this representation of the interested party must be provided.

The user can request the exercise of the following rights:

• Right to request access to personal data.
• Right to request their rectification (if they are incorrect) or deletion.
• Right to request the limitation of their processing, in which case they will only be retained by Porronet for the exercise or defense of claims.
• Right to object to processing: Porronet will cease processing their data, unless legitimate reasons or the exercise or defense of possible claims require their processing.
• Right to data portability: if you wish for your data to be processed by another company, Porronet will facilitate the portability of your data to the new controller.

In case consent is given for a specific purpose, the user has the right to withdraw this consent at any time, without affecting the legality of the processing based on the consent prior to its withdrawal.

If a user believes there is a problem with how Porronet manages their data, they can address their complaints to the Security Officer or the competent data protection authority, which is the Spanish Agency for Data Protection for Spain.

DATA RETENTION

Aggregated data will be retained without a deletion period. Regarding Client data, the duration of retention of personal data will vary depending on the service the Client subscribes to. In any case, it will be the minimum necessary, which may be maintained up to:

• 4 years: Law on Offenses and Sanctions in Social Matters (obligations regarding affiliation, registrations, terminations, contributions, payment of salaries…); Arts. 66 and following of the General Tax Law (accounting books…)
• 5 years: Art. 1964 Civil Code (personal actions without special time limit)
• 6 years: Art. 30 Commercial Code (accounting books, invoices…)
• 10 years: Art. 25 Law on the Prevention of Money Laundering and the Financing of Terrorism.

Users of mailing lists or those added by Porronet to pages or profiles on social networks will be retained until the user withdraws their consent.

Candidate data (CV), if applicable: If the candidate is not selected, Porronet may retain their CV for a maximum of two years to include it in future offers, unless the candidate opposes this.

OBTAINING AND PROCESSING DATA

Porronet has the duty to inform users of its website about the collection of personal data that may be carried out, either by sending emails or by completing the forms included on the website. In this sense, Porronet will be considered the Data Controller of the data collected by the means described above.

Porronet also informs users that the purpose of processing the collected data is to respond to user requests, to include in the contact agenda, to provide products or services, and to manage the business relationship. The operations, management, and technical procedures carried out in an automated or non-automated manner allowing the collection, storage, modification, transfer, and other actions on personal data are considered as Processing of personal data.

Porronet provides users with a series of electronic mechanisms for the collection and processing of their personal data, for the purposes outlined above. The personal data provided electronically, whether by email, through the contact forms on this website, or online subscriptions, will be used for the commercial and administrative management of the company's clients and users. This data will be processed by servers managed by Custom Professional hosting, which is also the provider of email services, and will be considered the Data Processor.

In accordance with the LSSI-CE, Porronet undertakes not to send commercial communications without identifying them as such. For these purposes, information sent to clients for the maintenance of the existing contractual relationship will not be considered commercial communication.

In any case, only the data necessary to provide the subscribed service or to adequately respond to the user's information request will be collected.