Privacy Policy

 

Through this privacy notice, XALLAS ELECTRICIDAD Y ALEACIONES SA hereinafter "XEAL", informs users of the Websitehttps://www.xeal.es and any of the subdomains dependent on this (the "Website" or the "Web") in compliance with Regulation (EU) 2016 of the European Parliament and of the Council of 27 April 2016 (RGPD) as well as in the Organic Law on Data Protection and Guarantee of Digital Rights 3/2018 of December 5, 2018 , relating to the protection of data of natural persons, to the treatment of such data and to the free circulation of the same (LOPDGDD) as well as, other regulation of application, of its policy of protection of personal data with the purpose that these decide of express, free and voluntary form, to facilitate to "XEAL" the personal data that are required to them on the occasion of the request of information for the hiring of the different products and services that are offered on the part of "XEAL".

All data provided by the user/interested party will be processed according to the characteristics detailed below.

INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA

  • Identification of the responsible party: XALLAS ELECTRICIDAD Y ALEACIONES SA NIF/CIF: A80420516
  • Registered office: CALLE VELÁZQUEZ, NUM. 11, PLANTA 1, PUERTA IZQ, 28001 MADRID
  • User or interested party: The person who provides us with his or her data and consents to the processing of such data.
  • E-mail communication contacto@xeal.es

DATA REQUIRED FOR CERTAIN TREATMENTS

The provision of data by users through the registration form or contact form, as well as while browsing the website is voluntary, although failure to provide certain data may result in the impossibility of access to certain services provided by "XEAL".

In all cases, Users shall be responsible for the veracity, accuracy, validity and authenticity of the personal data provided. "XEAL" reserves the right to exclude from the services or the refusal to give them to those users who have facilitated false information or whose behavior has failed to comply with the legislation in force or the legal texts of "XEAL" , without prejudice to all other actions that proceed by Law. 

INFORMATION COLLECTED FROM USERS

"XEAL" treats the following personal data of users:

  • Identification data, e.g. name and surname.
  • Contact information, such as e-mail address or telephone number.

PURPOSE AND LEGITIMACY OF THE TREATMENT

"XEAL" wants to treat all the data received in a lawful manner and for this it must support the processing of your data on a sufficient legal basis. In accordance with the above, below we indicate for which purposes "XEAL" treats the data and what is the legal basis on which each of them is based:

  • To respond to requests made by the interested party. "XEAL" considers that it has a legitimate interest to perform such data processing in that it allows it to improve its services and user experience.
  • To respond to orders related to products/services. This treatment of information is necessary in order that "XEAL" could give his services and carry out the execution of the contract between "XEAL" and the users who have contracted the services of this one. In case the user does not facilitate some of these information, "XEAL" would not be in disposition of being able to give some of his services.
  • Maintenance of the relationship that may be established. This treatment of information is necessary in order that "XEAL" could give his services and carry out the execution of the contract between "XEAL" and the users who have contracted the services of this one. In case the user does not facilitate some of these information, "XEAL" would not be in disposition of being able to give some of his services.
  • Management, administration, information, provision and improvement of services that are decided to hire. "XEAL" considers that it has a legitimate interest to perform such data processing in that it allows it to improve its services and user experience.
  • Commercial communications regarding our goods and services. These communications will be made only and exclusively after obtaining the consent of the user.
  • Newsletters, blogs and bulletins. This subscription to bulletins, blogs and newsletters will be made only and exclusively after obtaining the consent of the user.

Users may revoke the consent granted, as indicated above, at any time as detailed later in this document.

The personal data provided will be kept for the period specified in the consent, as long as the business relationship is maintained, the interested party does not request their deletion or they are necessary for the purposes of processing. The data will not be destroyed when there is a legal provision that extinguishes their conservation. In this case, the data will be blocked, and will only be kept at the disposal of the Public Administrations, Judges and Courts, for the attention of possible liabilities arising from the processing, during the term of prescription of these.

At present, no automated decisions, including profiling, are made on the basis of your personal data. In the event that such automated decisions are to be made in the future, your prior consent will be obtained.

RECIPIENTS, DATA ASSIGNMENT AND TRANSFER

Your data will not be transferred to countries outside the European Union unless it is necessary to the purposes and provide specific advance authorization. 

RIGHT OF THE INTERESTED PARTIES

You may exercise the following rights at any time by writing to "XEAL" at the postal address CALLE VELAZQUEZ, NUM. 11, PLANTA 1, PUERTA IZQ, 28001 MADRID, or at the following email address: contacto@xeal.es

The application must contain the name, surname(s) and documentation proving the identity of the interested party or his/her legal representative, as well as a document proving the representation, specific details of the request, address for notification purposes, date and signature of the applicant and documents proving the request made. Corrections must be made to any applications that fail to meet the specified requirements. 

The rights of data subjects are: access, rectification, limitation of processing, portability, opposition and deletion; their definition is as follows:

Right of access:

The data subject shall have the right to obtain from the controller confirmation as to whether or not his/her personal data are being processed and, if so, the right of access to the personal data and to the following information:

  1. a) the processing purposes
  2. (b) the categories of personal data to be processed
  3. (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
  4. d) if possible, the expected term of retention of the personal data or, if this is not possible, the criteria used to determine this term
  5. i) the existence of the right to request the data controller to rectify or erase personal data or the restriction of the processing of personal data concerning the data subject, or to object to such processing
  6. (f) the right to lodge a complaint with a supervisory body
  7. g) where the personal data have not been obtained from the data subject, any available information regarding their origin
  8. h) the existence of automated decisions, including profiling, as referred to in Article 22(1) and (4) of the GDPR and at least, in such cases, meaningful information about the logic applied and the significance and expected consequences of the processing for the data subject.

Where personal data are transferred to a third country or to an international organization, the data subject shall have the right to be informed of the appropriate safeguards under Article 46 GDPR relating to the transfer of data. The controller shall provide a copy of the personal data undergoing processing free of charge.

The data controller may charge, for any other copy requested by the data subject, a reasonable fee based on administrative costs. Where the data subject submits the request by electronic means, and unless the data subject requests otherwise, the information will be provided in a commonly used electronic format.

Right of rectification:

The data subject shall have the right to obtain from the controller without undue delay the rectification of his/her inaccurate personal data. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, even by means of an additional declaration.

Right of suppression:

The data subject shall have the right to obtain without undue delay from the controller the erasure of personal data concerning him/her, and the controller shall be obliged to erase personal data without undue delay if any of the following circumstances apply:

  1. a) Personal data that is no longer necessary in relation to the purposes for which it was collected or otherwise processed
  2. b) The data subject withdraws the consent on which the processing is based pursuant to Article 6 RGPD paragraph 1(a) or Article 9(2)(a) and the consent is not based on any other legal basis.
  3. c) The data subject objects to the processing pursuant to Article 21(1) GDPR and no other legitimate grounds for processing prevail, or the data subject objects to the processing pursuant to Article 21(2).
  4. d) Personal data have been unlawfully processed.
  5. (i) The personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the controller
  6. f) The personal data have been obtained in connection with the provision of information society services referred to in Article 8 RGPD, paragraph 1.

Where the controller has made public the personal data for which the data subject has exercised his/her right to erasure, the controller shall, taking into account the technology available and the cost of its implementation, take reasonable steps to inform third parties who are processing this information of the request for erasure of the data, as well as of any link to this data or to any copy or replica of this data.

This right will be limited by other rights such as the right to freedom of expression and information, by the fulfillment of a legal obligation, or when there are reasons of public interest.

Right to limitation of processing:

The data subject shall have the right to obtain from the data controller the limitation of data processing when any of the following conditions are met:

  1. a) the data subject contests the accuracy of the personal data, for a period of time that allows the data controller to verify the accuracy of the data
  2. b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use
  3. c) the controller no longer needs the personal data for the purposes of the processing, but the data subject needs the data for the formulation, exercise or defence of claims
  4. d) the data subject has objected to the processing pursuant to Article 21 RGPD, paragraph 1, while it is verified whether the legitimate reasons of the data controller prevail over those of the data subject

Where the processing of personal data has been restricted pursuant to paragraph 1, such data may only be processed, with the exception of their storage, with the consent of the data subject or for the purpose of formulating, exercising or defending claims, or for the purpose of protecting the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a particular Member State.

Any data subject who has obtained limited processing in accordance with paragraph 1 shall be informed by the controller prior to the lifting of this restriction.

 Right of opposition:

The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her on the basis of Article 6 GDPR, paragraph 1 (i) or (f), including profiling on the basis of these provisions.

The controller will stop processing the personal data, unless he/she can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the formulation, exercise or defense of claims.

Where the purpose of the processing of personal data is direct marketing, the data subject shall have the right to object at any time to the processing of personal data concerning him/her, including profiling insofar as it is related to such marketing.

When the data subject objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

Where personal data are processed for scientific or historical research or statistical purposes in accordance with Article 89(1), the data subject shall have the right, on grounds relating to his or her particular situation, to object to the processing of personal data concerning him or her, except where processing is necessary for the performance of a task carried out for reasons of public interest.

Right to data portability:

The data subject shall have the right to receive personal data concerning him/her, which he/she has provided to a controller, in a structured, commonly used and machine-readable format, and to transmit it to another controller without being prevented from doing so by the controller to whom he/she has provided it, when:

  1. a) The processing is based on consent pursuant to Article 6 RGPD, paragraph 1, letter a), or Article 9 RGPD, paragraph 2, letter a), or on a contract pursuant to Article 6, paragraph 1, letter b), and
  2. b) The processing is carried out by automated means.
  3. When exercising his/her right to data portability in accordance with paragraph 1, the data subject shall have the right to have personal data transmitted directly from data controller to data controller where technically feasible.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. Said right shall not apply to processing which is necessary for the performance of a task carried out in or in the exercise of official authority vested in the controller.

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out pursuant to Articles 16, 17(1) and 18 to each of the recipients to whom the personal data have been disclosed, unless this is impossible or would require a disproportionate effort. The data controller shall inform the data subject about these recipients, if he/she so requests.

REVOCATION OF CONSENT

The interested party who has given his/her consent to the processing of his/her personal data may also withdraw it with the same ease, simply by communicating his/her intention to revoke it by sending an email to contacto@xeal.es. The withdrawal of consent does not imply the unlawfulness of the processing previously carried out.

The data subject shall have the right to lodge a complaint with the competent supervisory authority. In Spain, this is the Spanish Data Protection Agency

If the personal data may be further processed for different purposes, the data controller shall duly inform the data subject.

SECURITY MEASURES

"XEAL" declares that it has adapted the company to the RGPD and LOPDGDD, adopting all technical, organizational and legal measures necessary to ensure the security of the data and prevent their alteration, loss, treatment or unauthorized access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed, whether from human action or the physical or natural environment.

As Data Controller, "XEAL"  only responds of those obtained directly from its website.

Since the page may contain  links to other websites that may be of interest to users, "XEAL" does not assume any responsibility for these links and the information that they could gather, since it can neither control their use or provide guarantees of compliance with suitable privacy policies. It is the exclusive responsibility of Users accessing the contents of said websites to read the terms and conditions of use in the corresponding privacy policies. 

If you have any questions, concerns or recommendations regarding our Privacy Policy, please contact us by e-mail at the following address: contacto@xeal.es.

"XEAL" © All rights reserved.