Data Protection Policy

Who is the data controller for personal data?

The controller of personal data is CookinGirona SCCL (hereinafter CookinGirona), with tax ID (CIF) F55222707 and registered office at Carrer Joaquim Pla i Cargol, núm. 1, 2n, Girona (postcode 17004), telephone 972 68 55 00, e-mail address info @ cookingirona.com and website www.cooking.cat.

For what purposes do we process data?

At CookinGirona we process personal data for the following purposes.

Contact.

To respond to enquiries from people who contact us by e-mail or by telephone. We process these data with the consent of the person who has contacted us.

Services for clients and members.

To register new clients and members and any additional data that may be generated as a result of the contractual relationship with them. During the contracting process, the essential data are requested, which must include bank details (current account or credit card number); these will be disclosed to the banks that manage the collection of payments (who may use them solely for this purpose). The provision of services entails other processing operations, such as entering the data in the accounts, invoicing or reporting to the tax authorities.

Information about our products and services.

While a contractual relationship with its clients and members exists, CookinGirona uses their contact details to communicate information relating to that relationship, which may occasionally include references to our products or services, whether of a general nature or more specifically related to the client’s characteristics and needs.

Management of our suppliers’ data.

We record and process the data of the suppliers from whom we obtain services or goods. These may be the data of self-employed individuals or of representatives of legal entities. We obtain only the data essential to maintain the business relationship, use them solely for this purpose and make use of them as appropriate to this type of relationship.

What is the legal basis for processing the data?

The data processing operations we carry out have different legal bases, depending on the nature of each processing operation.

Performance of a pre-contractual relationship. This applies to the data of potential clients, members or suppliers with whom we have dealings prior to the formalisation of a contractual relationship, such as the preparation or review of quotations.

Performance of a contract. This applies to our relationships with our clients, members and suppliers and all the actions and uses that these relationships entail.

Compliance with legal obligations. The disclosure of data to the tax authorities is required by the regulations governing commercial relationships. Data may also have to be disclosed to judicial bodies or to the law enforcement authorities, likewise in compliance with legal provisions requiring cooperation with these public bodies.

On the basis of consent. When we send information about our products or services, we process the recipients’ contact details with their authorisation or explicit consent.

To whom are the data disclosed?

As a general rule, we only disclose data to public administrations or authorities, and always in compliance with legal obligations. When invoices are issued to clients, data may be disclosed to banks. In justified cases, we will disclose data to the law enforcement authorities or to the competent judicial bodies. No data are transferred outside the European Union (international transfers).

In addition, for certain tasks we use the services of companies or individuals who provide us with their experience and expertise. On some occasions these external companies need to access personal data for which we are responsible. This is not, strictly speaking, a disclosure of data but rather processing carried out on our behalf by a data processor. We only contract services from companies that guarantee compliance with data protection legislation. Their confidentiality obligations are formalised at the time of contracting, and their performance is monitored. This may be the case for data hosting services, IT support services or legal, accounting or tax advisory services.

How long do we keep the data?

We comply with the legal obligation to keep the data retention period to a minimum. For this reason, data are kept only for the time necessary and justified by the purpose for which they were obtained. In certain cases, such as data contained in accounting and invoicing documentation, tax legislation requires them to be kept until the related liabilities have become time-barred. Data processed on the basis of the data subject’s consent are kept until that person withdraws their consent.

What rights do individuals have in relation to the data we process?

As provided for in the General Data Protection Regulation, the individuals whose data we process have the following rights:

To know whether their data are being processed. First of all, anyone has the right to know whether we process their data, regardless of whether there has been a prior relationship.

To be informed at the time of collection. When personal data are obtained from the data subject, at the time of providing them the data subject must be given clear information about the purposes for which they will be used, the identity of the data controller and any other aspects arising from this processing.

Right of access. A very broad right which includes knowing precisely which personal data are being processed, the purpose for which they are processed and any disclosures to other parties that will be made (where applicable), as well as the right to obtain a copy or to know the envisaged retention period.

To request rectification. This is the right to have any inaccurate data that we process rectified.

To request erasure. In certain circumstances there is the right to request the erasure of data when, among other reasons, they are no longer necessary for the purposes for which they were collected and which justified their processing.

To request restriction of processing. Also in certain circumstances, the right to request restriction of the processing of data is recognised. In this case, the data will no longer be processed and will only be kept for the exercise or defence of legal claims, in accordance with the General Data Protection Regulation.

Right to data portability. In the cases provided for in the legislation, the right is recognised to obtain one’s own personal data in a structured, commonly used and machine-readable format, and to transmit them to another data controller if the data subject so decides.

To object to processing. A person may invoke grounds relating to their particular situation, which will result in their data no longer being processed to the extent that this could cause them harm, except on legitimate grounds or for the exercise or defence of legal claims.

Not to receive commercial communications. We will immediately act on requests to stop sending commercial information to persons who had previously authorised us to do so.

How can these rights be exercised or defended?

The rights listed above may be exercised by sending a written request to CookinGirona SCCL at the postal address Carrer Joaquim Pla i Cargol, 1, 2n, Girona (postcode 17004) or by sending an e-mail to info @ cookingirona.com, stating in all cases “Personal data protection”.

If you have not received a satisfactory response when exercising your rights, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), using the forms or other channels available on its website www.aepd.es.