INFORMATION AND CONSENT FOR THE PROCESSING OF PERSONAL DATA FOR CUSTOMERS AND SUPPLIERS

Smash Hub ®, as the “Data Controller” of your personal data, pursuant to and for the purposes of the European Regulation on the protection of personal data known as the GDPR (General Data Protection Regulation EU 679/2016), informs you that said regulation provides for the protection of your Personal Data, which will be processed in compliance with the principles of lawfulness, fairness, transparency, and protection of your rights, ensuring adequate security and retention thereof.

1. PURPOSE OF THE PROCESSING

The Data Controller will process your identifying personal data, hereinafter referred to as “data” (e.g. first name, last name, tax code, NIF, email address, phone number, etc.) provided by you during the contracting phase of the services offered.

2. PURPOSES OF THE PROCESSING

Your data will be processed with your express consent (in accordance with Articles 6 and 7 of the aforementioned GDPR) for the following service purposes: – responding to your requests for information; – entering into contracts relating to the services of the Data Controller; – fulfilling pre-contractual, contractual, and tax obligations arising from existing relationships with you; – complying with obligations provided by law, EU regulations, or orders from Authorities (e.g. in matters of anti-money laundering); – exercising the rights of the Data Controller (e.g. right of defense in court in the event of contractual breach); – sending username and password for access to the products supplied by us.

3. ACCESS TO DATA AND ITS DISCLOSURE

Your data may be accessible, for the purposes indicated in point 2, to the following recipients: a) employees and collaborators of the Data Controller in their capacity as authorized persons and/or external data processors and/or system administrators; b) third parties (external professionals and consultants, such as for example the tax advisor), solely for the purpose of credit protection and better management of our rights related to each commercial relationship. Without your express consent (art. 6 letters b) and c) of the GDPR), the Data Controller may disclose your data for the purposes indicated in point 2 to supervisory bodies, judicial authorities, and all other entities for whom disclosure is mandatory by law in order to comply with said purposes. These entities will process the data as external Data Controllers. Data management and storage will take place on servers located within the European Union and will not be transferred outside of it.

4. MANDATORY NATURE OF DATA PROVISION

The provision of data for the purposes indicated in point 2.A is mandatory, as it is required by legal and contractual obligations. Any refusal to provide such data, or any lack of authorization for its processing, may prevent the Data Controller from proceeding with the requested contractual relationships.

5. DATA RETENTION PERIODS

Without prejudice to the five-year or ten-year retention periods for documents and data of a civil, accounting, and tax nature provided for by current regulations, the remaining data will be retained for 6 years from the end of the service provision/supply of the service/product, in accordance with art. 24 of European Law 167/2017 (Data Retention), unless deletion is requested by you.

6. RIGHTS OF THE DATA SUBJECT

Except in cases of legal obligations, public interest, or exercise of public powers, you have the right, at any time, to withdraw consent to the processing of data, without affecting the lawfulness of processing based on consent prior to withdrawal. Article 15 of the GDPR grants you, as the data subject, the exercise of specific rights, including the right to obtain from the Data Controller confirmation as to whether or not personal data concerning you exists and access to such data in intelligible form; the right to know the origin of the data, the purposes and methods of processing, the logic applied, the identifying details of the Data Controller and of the parties to whom the data may be disclosed; the right to obtain the updating, rectification and/or integration of data, its deletion, anonymization, or blocking if processed in violation of the law; the right to object, for legitimate reasons, to the processing of your data. The GDPR also provides for the right to be forgotten (art. 17), restriction of processing (art. 18), data portability (art. 20), and non-automated human processing (art. 22). The exercise of rights is not subject to formalities and is free of charge.

7. MINORS

The Services/Products offered by the Data Controller are reserved for legally capable persons, according to applicable national regulations, to enter into contractual obligations. In order to prevent unauthorized access to its services, the Data Controller adopts verification measures to protect its legitimate interest, such as checking tax codes and/or other verifications, when necessary for certain Services/Products, including verification of the accuracy of identifying data and identity documents issued by the competent authorities.

8. RESPONSE TIMES TO REQUESTS

In the event that you request information relating to your data, the Data Controller will respond as soon as possible — unless this proves impossible or involves a disproportionate organizational burden — and in any case within a period not exceeding 30 days from the request. Any inability or delay in satisfying your requests will be duly justified.

9. COMPLAINTS AND REMEDIES

If you believe that any of the rights indicated in point 6 have been violated, you may file a complaint with the Spanish Data Protection Agency or with the competent authority (following the procedures published on its website), or lodge an administrative or judicial appeal.

10. DATA CONTROLLER

Data Controller: Av. Familia de Betancourt y Molina, 34, 38400 Puerto de la Cruz, Santa Cruz de Tenerife, to whom you may address any request, application, or information, including the exercise of the rights mentioned in point 7. Email: info@smashhub.es