Additional information on data protection

The data controller is:

Entity: AXARBUILDING, S.L.U.
Tax ID: B92574946
Address: Calle Romero Pozo, 19 3 Izq.29700 Vélez-Málaga (Málaga)
Phone: (+34) 653 901 144
Email: info@javiergamez.com

Data Protection Officer

The data controller does not have a Data Protection Officer.

Purposes and legal basis of the processing

a) In general

The data controller processes personal data provided by its clients and/or users for the following purposes:

Purpose: Contact the data subject, address information requests received, carry out administrative, commercial, accounting, and tax management of the company, as well as send commercial communications about our professional services by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or other equivalent electronic means, provided that the data subject has consented to the processing of their personal data for this purpose.
Legal basis for this processing: Execution of a contract in which the data subject is a party or for the application, at the request of the data subject, of pre-contractual measures. Legitimate interest. The consent of the data subject, which can be withdrawn at any time.

b) Website electronic forms

The data controller processes personal data provided by clients and/or users through the electronic data collection forms on the website for the following purposes:

Regarding the “Contact Form” (those that can be sent through the email accounts listed on the website):

Purpose: Contact the data subject, address information requests received, respond to inquiries, and send commercial communications about our professional services by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or other equivalent electronic means, provided that the data subject has consented to the processing of their personal data for this purpose.
Legal basis for this processing: The consent of the data subject, which can be withdrawn at any time.

When the requested data in the electronic forms are necessary, the data controller will indicate their mandatory nature at the time of data collection from clients and/or users, and not providing them may result in the corresponding request not being fulfilled.

What type of data do we process?

For the purposes described in the previous section, the data controller processes the set of client data, which can be divided into the following sources and categories:

a) Data provided directly by the client and/or user: Data provided directly by the client and/or user, either at the time of requesting the service through the completion of electronic data collection forms or on paper forms provided for this purpose, such as information requests throughout the contractual relationship through various means, such as information requests. The client and/or user is responsible for their accuracy and updating.
Identifying Data (name and surname, NIF, NIE, passport, postal address, email address, telephone, mobile, manual, handwritten or digitized signature, social media profiles, IP addresses, username, and password)
Economic Data (banking details)

Data obtained from sources other than the client and/or user: Data obtained from sources other than the client and/or user, either with their consent or by any other legal authorization (legitimate interest, compliance with a legal obligation, etc.).
c) Data derived from the development of the business relationship: Data provided indirectly by the client and/or user resulting from the provision of the contracted service and the maintenance of this activity. This category includes traffic data, browsing data through the public website or access to the private area, or other similar data.

Records of processing activities

We inform you that the personal data obtained from the client and/or user as a result of completing the electronic data collection forms on the website are part of the Records of Processing Activities (RPA) of the data controller, which will be periodically updated in accordance with the provisions of the GDPR EU 2016/679 and the LOPDGDD 3/2018.

Recipients

Personal data of the data subjects will be communicated to the recipients indicated below:

a) In general:
Service providers of the data controller as data processors, within the framework of the corresponding provision of services (lawyers, accounting and tax consultants, consultants, service providers, and information technology service providers – website hosting and email service).
Authorities and competent organizations to the extent necessary to comply with legal obligations.
b) Regarding the “Contact Form” (those that can be sent through the email accounts listed on the website):
No data will be transferred to third parties, except when required by legal obligations.

Transfer to third countries

No transfer of data to third countries without adequate protection is foreseen.

Retention periods

Personal data will be kept:

a) In general:
The data will be retained until you request its deletion, and in any case, for the years necessary to comply with legal obligations.
b) Regarding the “Contact Form” (those that can be sent through the email accounts listed on the website):
Personal data will be retained until the end of the relationship between the data controller and the client and/or user, unless the client and/or user requests their deletion in advance, or until the data subject withdraws the consent granted at any time, without affecting the lawfulness of the processing based on the consent given prior to its withdrawal.

In this regard, the data subject is reminded that they should inform the data controller, as the recipient of the personal data, of any rectification or deletion of the data of their representatives, authorized persons, and other contacts.

Once the relationship has ended, to the extent that the personal data of the data subjects are relevant for the liability of the data controller towards clients and/or users, that data will be kept, duly blocked, at the disposal of the competent judicial authorities or public administrations, for the purpose of enforcing the liabilities arising from the processing, for the prescription period of such liabilities.

Rights of data subjects

Clients and/or users of the website may exercise, to the extent applicable, the following rights with the data controller: access to personal data, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection to processing, and not to be subject to automated individual decisions. When the processing is based on consent, clients and/or users have the right to withdraw their consent at any time.

Clients and/or users may exercise these rights by submitting a written and signed request to the data controller at the postal address: Calle Romero Pozo, 19 3 Izq.29700 Vélez-Málaga (Málaga) or by sending an email to info@javiergamez.com. In both cases, the data subject must provide a valid proof of identity, such as a photocopy of their ID card or equivalent document, and clearly indicate the right they wish to exercise.

Clients and/or users also have the right to lodge a complaint with the competent supervisory authority (Spanish Data Protection Agency) if they believe that the processing does not comply with the current regulations or that their rights regarding the protection of their personal data have been violated, especially if they have not obtained satisfaction in the exercise of their rights, through the website https://www.aepd.es.

These rights will be addressed by the data controller within 1 month, which may be extended to 2 months if the complexity of the request or the number of requests received so requires. This is without prejudice to the obligation to retain certain data under legal terms and until any liabilities arising from possible processing or, where applicable, from a contractual relationship are prescribed.

In addition to the above, and in relation to data protection regulations, users who request it have the possibility to arrange the destination of their data after their death.

Sending commercial communications

In compliance with the provisions of the second final provision of Law 9/2014, of May 9, on Telecommunications, which amends Law 34/2002, of July 11, on Information Society Services and Electronic Commerce, commercial communications made electronically must be clearly identifiable as such, and the natural or legal person on behalf of whom they are made must also be clearly identifiable, without prejudice to the provisions of the regulations issued by the Autonomous Communities with exclusive competence in consumer affairs.

The client and/or user who provides their contact information to the data controller by clicking on the “SEND” button of the electronic data collection forms on the website and affirmatively checks the two consent boxes, “I accept the processing of my data according to the purposes indicated in the basic information on data protection” and “I give my consent to receive commercial communications about your products”, expressly authorizes and gives their express, free, and unequivocal consent to the data controller to process their personal data for the purpose of sending commercial communications about our products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or other equivalent electronic communication means.

The legal basis that legitimizes this processing is the consent of the data subject, which can be revoked at any time.

In compliance with the provisions of articles 21 and 22 of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce, the user may object to the processing of their data for promotional purposes and revoke the consent given for receiving commercial communications via email by simply notifying their will to the PROVIDER through a simple and free procedure, consisting of sending an email to the email address info@javiergamez.com, indicating in the subject of the message “UNSUBSCRIBE” or “DO NOT SEND”.

The provided data will be kept for as long as the commercial relationship is maintained or for the years necessary to comply with legal obligations.

Social media policy

In this case, the data controller is considered responsible for the processing of the data of its users, including followers, subscribers, fans, or simply individuals who make comments or inquiries through these channels.

In this regard, the data controller may use this profile to inform its users of news that it considers appropriate for the purposes of the services offered, or it may also share information or articles of current interest published by other users of social media.

Under no circumstances will personal information of users be used without their consent for purposes other than those expected on the mentioned social network, and the consent of the user will be requested if necessary.

Accuracy of data provided by data subjects

The client and/or user is responsible for ensuring that the information provided through the electronic forms made available on the website or by sending emails to the different accounts under the domain javiergamez.com is accurate. They are responsible for the accuracy of all the data they communicate and must keep it updated to reflect a real situation. The client and/or user will be responsible for false or inaccurate information they provide and for any damages, inconveniences, or problems that may arise for the data controller or third parties.

 
Security Measures

The DATA CONTROLLER guarantees that appropriate technical and organizational policies have been implemented on the WEBSITE to apply the security measures established by the GDPR EU 2016/679 and the LOPDGDD 3/2018 in order to protect the rights and freedoms of the clients and/or users. The necessary information has been communicated to them so that they can exercise their rights.

To protect individual rights, especially in relation to automated processing, and with the intention of being transparent with clients and/or users, the DATA CONTROLLER has established a policy that includes all such processing, the purposes pursued by them, their legitimacy, and the available instruments for clients and/or users to exercise their rights.

The WEBSITE is created using the WordPress content management system and Elementor Pro. It has the iThemes Security Pro plugin installed and an active SSL encryption certificate for the entire domain, allowing users to securely submit their personal data through existing electronic data collection forms.

The WEBSITE is hosted on servers provided by CoriaWebHosting, Apartado de Correos Nº 5, – 41100 Coria del Río, Sevilla (Spain), with the assigned IP address within the Spanish range.

All information will be stored and managed with due confidentiality, applying the necessary computer security measures to prevent unauthorized access or use, manipulation, deterioration, or loss of data.

However, the client and/or user should be aware that the security of computer systems is never absolute. When personal data is provided over the Internet, such information may be collected without consent and processed by unauthorized third parties. The DATA CONTROLLER declines any responsibility for the consequences that such acts may have for the user if they voluntarily disclose the information.

Acceptance and Consent

The client and/or user declares that they have been informed of the conditions regarding the protection of personal data and accepts and consents to the automated processing of such data by the DATA CONTROLLER in the manner and for the purposes indicated in this Privacy Policy. Certain services provided on the WEBSITE may have specific provisions regarding the protection of personal data in their particular conditions.

Changes to this Privacy Policy

The DATA CONTROLLER reserves the right to modify this Privacy Policy to adapt it to legislative, jurisprudential, interpretive developments by the Spanish Data Protection Agency, as well as industry practices.

In such cases, the DATA CONTROLLER will announce the introduced changes on the websites with reasonable notice before their implementation.

This privacy policy may be supplemented by the Legal Notice, Cookie Policy, and General Terms and Conditions of Contracting that may be applicable to certain products or services if accessing them involves specific provisions regarding the protection of personal data.