This translation is provided as a courtesy only. In the event of any conflict between this English language version and the Spanish version of this policy, the Spanish version shall prevail.
This privacy policy applies to the data processing of users of the website.
However, it will not apply to:
> The services requested and the complaints submitted by members through the website. The policy applicable to the data processing is the one included in the membership form.
> The subscription to the Digital Magazine, the access to the Database of Resolutions of the Advertising Jury and the management of the discount on training activities organized by AUTOCONTROL. The policy applicable to the data processing is included here.
> Registration in training activities. The policy applicable to the data processing is included in the registration form for each activity.
> The data protection mediation service. The policy applicable to the processing of data derived from the mediation service is included in the conditions of this service.
> Complaints filed for conducts that may be contrary to the Provider Policy or the Anti-Corruption Guidelines. The policy applicable to the processing of data arising from these complaints is included here.
> Requests from media or journalists for professional contact purposes, so that AUTOCONTROL can maintain such contact and send press releases and similar communications. The policy applicable to data processing is the one included here.
DATA CONTROLLER
The data controller is:
AUTOCONTROL, Asociación para la Autorregulación de la Comunicación Comercial
VAT number: G81234247
Address: C/ Príncipe de Vergara 109, planta 5ª, 28002 Madrid
Telephone: +34 91 309 66 37
Email: proteccion.datos@autocontrol.es
PURPOSES AND LEGAL BASIS OF DATA PROCESSING
AUTOCONTROL will process the personal data of users of the website for the purposes identified below:
a. Regarding the registration on the website for requesting services or submitting complaints (non-members):
Purpose 1: managing the registration on the website and handling requests made by registered users (service requests or submission of complaints), as well as analyzing this information for statistical purposes.
Legal basis: for the management and handling of requests, the legal basis will be the performance of the contract with AUTOCONTROL derived from the registration and, where appropriate, from the service requests or submission of complaints (however, if the user acts on behalf of a legal person, the legal basis will be the legitimate interest of AUTOCONTROL in maintaining that relationship with the entity the user represents). For the analysis for statistical purposes, the legal basis will be the legitimate interest of AUTOCONTROL in having information about its activity that allows it to adapt and improve its operation and services, as well as, always anonymously, in publishing information about its activity and report it to other entities (members, authorities, the European Advertising Standards Alliance, etc.) for transparency purposes.
Purpose 2: sending information about the activity and services of AUTOCONTROL.
Legal basis: consent of the data subject, which may be withdrawn at any time.
b. Regarding the submission of complaints (non-registered users who are individual):
Purpose: handling the complaint submitted, as well as analyzing the information for statistical purposes.
Legal basis: for the handling of the complaint, the legal basis will be the performance of the contract with AUTOCONTROL derived from the submission of the complaint. For the analysis for statistical purposes, the legal basis will be the legitimate interest of AUTOCONTROL in having information about its activity that allows it to adapt and improve its operation and services, as well as, always anonymously, in publishing information about its activity and report it to other entities (members, authorities, the European Advertising Standards Alliance, etc.) for transparency purposes.
c. Regarding the subscription to the Newsletter (requires registration):
Purpose 1: managing the sending of the Newsletter.
Legal basis: consent of the data subject, which may be withdrawn at any time.
Purpose 2: keeping the user informed about the training activities organized by AUTOCONTROL.
Legal basis: consent of the data subject, which may be withdrawn at any time.
d. Regarding sending information on training activities:
Purpose: keeping the user informed about the training activities organized by AUTOCONTROL.
Legal basis: consent of the data subject, which may be withdrawn at any time.
e. Regarding job applications:
Purpose: handling the application, managing the recruitment procedure if necessary and taking the candidate into account in future recruitment processes.
Legal basis: consent of the data subject, which may be withdrawn at any time.
f. Regarding other queries (e.g. those sent from the different contact forms available on the website):
Purpose: handling the query, allowing, where appropriate, a more agile handling of any complaint that may be submitted in relation to the query (for example, in the case of requesting the mediation service), and analysis for statistical purposes.
Legal basis: for the handling of the query, the legal basis will the consent of the data subject, which may be withdrawn at any time; for the eventual management of a complaint, the legal basis will be the legitimate interest of AUTOCONTROL in speeding up the proceedings taking advantage of the information provided by the data subject during the consultation phase; and for analysis for statistical purposes, the legal basis will be the legitimate interest of AUTOCONTROL in having information about its activity that allows it to adapt and improve its operation and services, as well as, always anonymously, in publishing information about its activity and report it to other entities (members, authorities, etc.) for transparency purposes.
The data requested in the forms, unless expressly stated otherwise, are necessary for the purposes indicated and not providing them will mean that the corresponding request cannot be handled.
RECIPIENTS
The personal data of the data subjects will be communicated to the recipients indicated below:
a. In general:
> Providers of AUTOCONTROL, as data processors, in the framework of the relevant service provision (legal and accounting assistance, auditors, destruction of documentation/information, and IT service providers -e.g. data hosting and e-mail service- and management and statistical analysis of complaints about cross-border or behavioral advertising).
> Competent authorities and bodies, to the extent necessary for the fulfilment of legal obligations.
b. In relation to the submission of complaints:
> The counterparts in the dispute resolution procedures of the Advertising Jury and on «.es» domain names.
> The European Advertising Standards Alliance (EASA), the European Interactive Digital Advertising Alliance (EDAA) and other competent advertising self-regulatory bodies, as appropriate, in the event of a cross-border complaint within the European Economic Area or to a third country. The privacy policies of the national advertising self-regulatory bodies are available here.
> The competent administrative or judicial authorities to which, where appropriate, AUTOCONTROL sends the non-binding opinions of the Jury and the corresponding file, as provided for in the Jury Regulations. The communication of personal data will be based on the consent of the data subject.
TRANSFERS TO THIRD COUNTRIES
AUTOCONTROL has contracted IT service providers who act as data processors. Transfers to third countries associated with such services shall be carried out either on the basis of an adequacy decision of the European Commission (Article 45 of the General Data Protection Regulation) or on the basis of appropriate safeguards such as standard data protection clauses adopted by the Commission (Article 46 of the General Data Protection Regulation).
With regard to cross-border claims, if the recipient country does not belong to the European Economic Area, the transfer will also take place under an adequacy decision or standard clauses.
AUTOCONTROL provides more detailed information on these transfers at the following address: https://www.autocontrol.es/t-proteccion-de-datos/.
STORAGE PERIOD
The personal data will be stored:
a. Regarding the registration on the website: until the user requests the erasure of the data.
b. Regarding the service requests: during the provision of the service and, after this, the time necessary to meet any liabilities arising from the processing during the limitation period (in general, 6 years in relation to accounting documentation and up to 10 years for tax information).
c. Regarding the submission of complaints: during the procedure and, after this, the time necessary to meet any liabilities arising from the processing during the limitation period (generally, 5 years).
d. Regarding the subscription to the Newsletter or the request for information on training activities: until the user requests the erasure of the data or objects to receiving this information.
e. Regarding job applications: 1 year, unless the data subject requests the erasure of the data or withdraws his or her consent.
f. Regarding other queries: 1 year, unless the data subject requests the erasure of the data or withdraws his or her consent.
RIGHTS OF DATA SUBJECTS
Users of the website may exercise before AUTOCONTROL, insofar as applicable, the following rights: access to personal data, rectification, erasure, restriction of processing, objection to processing, data portability and, when processing is based on consent, the right to withdraw at any time. You can find more information about your rights here.
Duly identified users may exercise these rights by post or e-mail to the addresses indicated in the section «Data controller».
Users will also have the right to lodge a complaint with the competent data protection authority (the Spanish Data Protection Agency ―www.aepd.es―) if they consider their rights to have been infringed.