PRIVACY POLICY

The personal data that you provide us with by any of the means provided for this purpose will be processed in accordance with the following privacy policy. In relation to the collection of data, we inform you that, in the event that it is not necessary to provide all the data requested, those fields that must be completed will be identified with an asterisk, the rest being completely voluntary.

1.1.- IDENTITY AND THE CONTACT DETAILS OF THE CONTROLLER

Controller: Grupo Cosmos XXI, S.L. (the Controller).

Address: Carretera aoiz – km 19,5 · 31420, Urroz-villa (Navarra)

Tax Identification number: B31949696

E-mail: rgpdgc@gcosmos.com

DPO: dpd@gcosmos.com

 

1.2.- PERSONAL DATA PROCESSING.

Below, we inform you about the data processing included in this privacy policy, indicating both the legal basis of the General Data Protection Regulation (hereinafter, GDPR) and the specific retention period of the data, to which must be added the time necessary to comply with legal obligations and meet the possible liabilities that may arise for the Data Controller in relation to compliance with the purpose for which the data were collected:

CONCERNING OUR RELATIONSHIP WITH YOU
Purposes of the processing Legal basis (GDPR) Retention period

Requests for information or queries: We will use your data to deal with requests for information, queries or complaints that you might send us, with the scope that they require. As well as for the drafting of proposals for services and/or collaboration.

 

6.1.a) GDPR. The data subject has given consent to the processing.

6.1.b) GDPR.Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

For as long as it takes to deal with the request and/or complaint.
Management of registered customers: We will use your data to control and manage your customer relationship, manage your interaction with us and process your requests and incidents.

Also, we will use your data for the administrative management of the relationship which may involve the attention of incidents and order collection management.

6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party.

As long as the contractual relationship remains in force and the Controller is entitled to the processing.
Service provision: We will use your data to manage and process orders for products or services you have contracted with us.

6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party.

As long as the contractual relationship remains in force and the Controller is entitled to the processing.
Parameterization through the private area: The Controller will process your data to apply the filters and decisions you send us through the private area (type of newsletters you wish to receive; newsletter; interests…). This treatment refers exclusively to the direct preferences that you transfer to us through the parameterization options that your private area allows. 6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party. As long as the contractual relationship remains in force and the Controller is entitled to the processing.
Classification based on the analysis of your browsing habits: We will process the data generated by your visit and/or interaction on our websites in order to classify you and present you with content of interest to you. 6.1.a) GDPR. The data subject has given consent to the processing. As long as you do not object and the Controller is entitled to the data processing.
Newsletter and commercial communications: In the event that you have a previous contractual relationship with us, unless you object, we will use the personal data you provided us with to send you commercial communications related to the products or services previously purchased by you.

Also, when you request us or consent to receive our newsletter or commercial communications, we will use your data to send you those types of communications related to our products or services and the companies of the Group to which the Controller belongs, based on your user profile.

Art. 6.1.f) GDPR. Processing is necessary for the purposes of the legitimate interests pursued by the Controller based on article 21.1 of Law 34/2002.

6.1.a) GDPR. The data subject has given consent to the processing.

De acuerdo con el tipo de cookies, expresado en la correspondiente política.
Individuals acting on behalf of legal entities: We will use your data to manage and attend to such representation situation. Art. 6.1.f) GDPR. Processing is necessary for the purposes of the legitimate interests pursued by the Controller based on Article 19 of Organic Law 3/2018. As long as the contractual relationship with the legal entity represented remains in force and the Controller is entitled to process the data.
Manage your participation in events and / or training or promotional activities: In the event that you register as a participant in any of the actions (courses, events…) we will process your data to manage your participation in them, and register you as a participant, your participation being subject to the legal conditions of the specific action. 6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party. As long as the contractual relationship remains in force and the Controller is entitled to the processing.
In the case of events with public access, capture and use of your image to illustrate news or reviews about the event. 6.1.a) GDPR. The data subject has given consent to the processing. As long as you do not object and the Controller is entitled to the data processing.
Human resources: Job bank and selection processes We manage a job bank and, in this sense, when you send us your CV, the Controller will add your data to our job bank to cover possible vacancies, collaborations, internships or scholarships.

When you apply for a specific application, your application will be analysed in relation to it and, where appropriate, if you fit the profile, we will contact you, if not, and only if you give us express consent we will add your personal data to our job bank.

6.1.a) GDPR. The data subject has given consent to the processing.

6.1.b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

REGULATORY COMPLIANCE-RELATED
Purposes of the processing Legal basis (GDPR) Retention period
Processing of the exercise of the rights of the data subject: In the event that, as a data subject, you exercise any of your rights in relation to your personal data, we will use the information you provide to evaluate your request and respond to it. Art. 6.1.c) Processing is necessary for compliance with a legal obligation to which the controller is subject based on Articles 15 to 22 of the GDPR and 12 to 18 of Organic Law 3/2018. As long as it is necessary to comply with the legal obligations to which the controller is subject.
Compliance with legal obligations related to the products and/or services offered to the data subjects. We will use your data to comply with the legal requirements applicable to the relationship that binds us to you. Art. 6.1.c) Processing is necessary for compliance with a legal obligation to which the controller is subject. As long as it is necessary to comply with the legal obligations to which the controller is subject.
COOKIES
If you have agreed to receive cookies when you visit this website, the cookie policy of the website, accessible via the following link, will apply to you.

In the event that you are requested at any time to consent the processing of your data for a purpose that requires your consent, your failure to grant your consent (or its subsequent withdrawal) will not have any consequences for you in any case. Nor will your opposition to the processing of your data for purposes based on legitimate interest have any kind of consequence.

 

1.3.-CATEGORIES OF PERSONAL DATA WE MAY COLLECT ABOUT YOU.
Through the various means of contact (email, telephone…), and the forms enabled on our website, identification and contact data will be collected, such as name, surname, email address, telephone number, etc. In a specific form, you can send us additional information (e.g., reason for the inquiry, additional information, cv…).

Finally, depending on your preferences with cookies, the configuration of your device when accessing the page or the communications that we send you, we may record your browsing on our website obtaining information about your behaviour and interests and we may also know the opening of commercial communications.

1.4.- RECIPIENTS

In general, unless legally obliged to do so, your data will not be communicated or transferred to any third party without your prior express consent. In any case, some communications and/or transfers of data to third parties may be imposed by certain regulations or to meet obligations to the Public Administrations in cases where this is required in accordance with the legislation in force at any given time.
Other communications and/or transfers will be a necessary consequence of the provision of the requested service, management of the event or as a result of your express consent to the communication. Below, we list those purposes for which it may be necessary to communicate your data to third parties:
– Co-organization of events, training or promotional activities. In the case of organizing events with other entities, we inform you that your data will be processed not only by the Controller, but also by the organization or organizations identified in the conditions that regulate such specific action.
– Commercial communications from sponsors and/or third-party recipients. In the event that you expressly consent by ticking the box provided for this purpose, we will communicate your data to the organisations identified at the time of data collection so that they can use the personal data for the purpose for which you have consented.

– Enjoyment of prizes for which an entity other than the Data Controller is responsible. In this case, the winner’s details will be communicated to the company responsible for managing the prize, so that the winner can receive the prize and/or coordinate with the company providing the prize so that the winner can enjoy the prize.

– Sending communications and newsletters, measuring your activity, forms and surveys. In this case, your data will be communicated to the company that owns the technological solution used for this purpose, so that it can carry out the sending and measuring functions that have been entrusted to it.

– Hosting of the website. The data hosted on our website will be communicated to the company that provides us with the web hosting service.

In addition to external organizations, to the extent that the Controller is part of a corporate group, your data may be transmitted among the organizations of such group for administrative and management efficiency purposes. We indicate below the organizations that make up the group with which your data may be shared:

1.5.- EMPRESAS DEL GRUPO

Company name Tax identification number Registered office Contact DPO
Logística y Acabados S.L. B20998902 Polígono Industrial S/n · 31430, Aoiz (Navarra)

rgpdgc@gcosmos.com

dpd@gcosmos.com
Alcalá Industrial S.A.U. A28033066
Cosmos Bizkaia, S.L.U. B71171557
Estampaciones Guipúzcoa, S.A.U. A20666475
Navarra de Estampación e Inyección S.A.U. A31540503

Finally, we inform you that we use the following third-party services that involve international data transfers, such as:

  • Web analytics service called “Google Analytics” provided by Google (Google Ireland Limited) which according to the terms and conditions of the provider, involves international data transfers outside the EU economic area, and according to the provider’s statement, comply with the applicable legal framework through the Standard Contractual Clauses established by the European Commission.

In any case, we would like to inform you that we make every effort to ensure that all our collaborators or suppliers who may have access to your data comply with the requirements established in the GDPR and offer adequate guarantees.

1.4.- DATA SUBJECT RIGHTS.
With respect to the personal data collected for processing, you have the possibility of exercising your rights of access, rectification, deletion and portability. Likewise, in certain circumstances, you will have the right to request the limitation of or opposition to the processing of your data, in which case the Data Controller will cease to process them and will only keep them in the event that there is a regulatory obligation to do so or until the prescription of any actions that may arise. For any queries or to exercise your rights, you can contact us by providing proof of your identity by emailing rgpdgc@gcosmos.com or by any of the contact methods indicated in the heading of this data protection policy. You can also contact our Data Protection Officer at the following e-mail address: dpd@gcosmos.com.
Finally, you may also contact the supervisory authority when you consider it appropriate to lodge a complaint (for example, in the country where you have your habitual residence, your place of work or where you consider that the alleged infringement has taken place). For the appropriate purposes, we inform you that in Spain the Supervisory Authority is the Spanish Data Protection Agency, and you can exercise your rights through the forms that this entity has set up for this purpose and which are available at its electronic office.
If you would like more information on the aforementioned rights, we invite you to read on or visit the infographic prepared by the Spanish Data Protection Agency.
You may address your complaint or exercise your rights through any of the contact channels indicated in the “Identity and the contact details of the Controller” section of this policy.

LEGAL NOTICE

2.1.-IDENTITY OF THE OWNER.

In accordance with the provisions of Article 10 of Law 34/2002, of 11 July, on Information society services and electronic commerce, we hereby inform you that the owner of this website is the company Grupo Cosmos XXI, S.L., located at Carretera aoiz – km 19,5 · 31420, Urroz-Villa (Navarra), with tax identification number B31949696 and registered at Navarra in volume 1383, sheet 216, page NA-27380.


2.2.-CONTACT DETAILS OF THE OWNER.

If you have any questions, you can contact Grupo Cosmos XXI, S.L. by sending your request to the e-mail address rgpdgc@gcosmos.com. You can also contact our DPO at dpd@gcosmos.com


2.3.-BUSINESS GROUP TO WHICH THE OWNER BELONGS.

The business group to which the owner belongs is comprised of the following organizations:

Company name Tax identification number Registered office Contact DPO
Logística y Acabados S.L. B20998902 Polígono Industrial S/n · 31430, Aoiz (Navarra)

rgpdgc@gcosmos.com

dpd@gcosmos.com
Alcalá Industrial S.A.U. A28033066
Cosmos Bizkaia, S.L.U. B71171557
Estampaciones Guipúzcoa, S.A.U. A20666475
Navarra de Estampación e Inyección S.A.U. A31540503