Introduction

The General Data Protection Regulation (GDPR) is the legal framework that regulates the processing of personal data in Europe since May 25, 2018. Unlike Directive 95/46/EC which it repeals, the GDPR is directly applicable in the Union and does not need to be transposed into national legislation. For this reason, it will favor the harmonization of legal regimes regarding personal data protection in Europe and, even better, it has a principle of extraterritoriality that, in certain circumstances, allows it to extend its scope of application beyond European borders.

If your organization processes personal data, it is highly likely that the provisions of the GDPR apply to you and that, consequently, you are subject to obligations that you must comply with. The same applies to FUSTIBUS S.COOP.GALEGA, which, depending on its situation, will have different obligations: as a processor or as a data controller.

Data Controller

FUSTIBUS S.COOP.GALEGA is considered the "data controller" when it determines the purposes and means of its personal data processing.

This occurs when FUSTIBUS collects data for billing purposes, collection management, improvement of service quality and performance, sales operations, commercial management... For this reason, we provide you with all the information regarding the guarantees applied to ensure the protection of such personal data:

• Limit data collection to what is strictly necessary. When contracting a service, users are only asked to enter the data necessary for FUSTIBUS to provide billing services or comply with its own legal obligations regarding data retention.
• Not use personal data for purposes other than those for which it was initially collected.
• Retain personal data for a limited and proportional period. For example, data processed for the purpose of managing the relationship between the client and FUSTIBUS (name, surname, postal address, email, etc.) will be retained by FUSTIBUS S.COOP.GALEGA for the duration of the contract and 36 months thereafter.
• Not transfer such data to third parties other than companies associated with FUSTIBUS that intervene in the scope of contract execution.
• Apply appropriate technical and organizational measures to ensure a high level of security.

Data Subject Rights

• Access: right to obtain confirmation as to whether we are processing your personal data or not, to know which ones, what they are used for, how long they will be kept, their origin and whether they have been or will be communicated to a third party.
• Rectification: right to request the rectification of inaccurate data and to have incomplete personal data completed.
• Erasure: right to request the deletion of personal data when it is inadequate, excessive or no longer necessary for the purposes for which it was collected, including the right to be forgotten.
• Objection: right to object, in certain circumstances, to the processing of your personal data or to request that processing be ceased.
• Restriction of Processing: right to request, in legally established circumstances, that your data not be processed beyond mere storage.
• Portability: right to receive personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller, where technically feasible.

Where can you exercise your rights?

The exercise of rights must be done in writing, addressed to Calle Condesa Casa Barcena 11 or by email to hola@fustibus.com. FUSTIBUS S.COOP.GALEGA provides you with templates for exercising rights that can be obtained at the address or through the email indicated above.

For more information: www.agpd.es.

Do you have the right to file a complaint with the Supervisory Authority?

If your rights have not been respected, you may file a complaint in writing to the Spanish Data Protection Agency located at Calle Jorge Juan, 6-28001-Madrid or use the electronic headquarters: https://sedeagpd.gob.es. In both cases, you must attach the relevant documentation.