As a general principle, the company will scrupulously comply with the legislation on the protection of personal data and must be able to demonstrate it (proactive responsibility principle), paying special attention to those treatments that may pose a greater risk for the rights of those affected (principle of “risk approach”).

In relation to the aboveTania Y Liz SLwill ensure compliance with the following principles:

Legality, loyalty, transparency and limitation of the purpose. The processing of data must always be informed to the affected person, through clauses and other procedures; and it will only be considered legitimate if there is consent for the processing of data (with special attention to that paid by minors), or has another valid legitimacy and its purpose is in accordance with regulations.

Data minimization. The data treated must be adequate, relevant and limited to what is necessary in relation to the purposes of the treatment.

accuracy. The data must be accurate and, if necessary, updated. In this regard, the necessary measures will be adopted so that personal data that are inaccurate with respect to the purposes of the treatment are undefined or corrected without delay.

• Limitation of the retention period. The data will be maintained in such a way as to allow the identification of the interested parties for no longer than necessary for the purposes of the treatment.
• integrity and confidentiality. The data will be treated in such a way as to ensure adequate security of personal data, including protection against unauthorized or illicit treatment and against accidental loss, destruction or damage, through the application of appropriate technical or organizational measures.
• data transfers.It is prohibited to purchase or obtain personal data from illegitimate sources or in those cases in which said data has been collected or transferred in violation of the law or its legitimate origin is not sufficiently guaranteed.
• Hiring of suppliers with access to data. Only suppliers who offer sufficient guarantees to apply appropriate technical and security measures in the data processing will be chosen for their hiring. With these third parties the due agreement in this regard will be documented.
• international data transfers. Any processing of data of a personal nature subject to regulations of the European Union that implies a transfer of data outside the European Economic Area must be carried out with strict compliance with the requirements established in the applicable law.
• rights of those affected. The Company will facilitate the exercise of the rights of access, rectification, suppression, limitation of treatment, opposition and portability, establishing for this purpose the internal procedures, and in particular the models for their exercise that are necessary and timely, which must satisfy, by less, the applicable legal requirements in each case.

The Company will promote that the principles contained in this Personal Data Protection Policy are taken into account (i) in the design and implementation of all working procedures, (ii) in the products and services offered (iii) in all contracts and obligations that they formalize or assume and (iv) In the implementation of as many systems and platforms allow access to employees or third parties and/or the collection or processing of personal data.