Privacy policy

1. Entity information

1.1. Responsible entity
Komsai BCN SLU is the entity responsible for the processing of the personal data described in this Privacy Policy.

Our identification and contact details are:

• Legal name: Komsai BCN SLU
• Tax identification number (NIF): B21720248
• Postal address: Via Augusta 123, 08006 Barcelona, Spain
• General contact email: info@komsai.com
• Contact email for data protection rights: dpo@komsai.com

These details identify the entity to which you may direct questions about this policy or requests concerning the processing of your personal information.

1.2. Contact channels
For general questions about how we handle your personal information, you may contact us at info@komsai.com. For requests to exercise your data protection rights, you may contact us at dpo@komsai.com or write to our postal address. Further information about submitting a request is provided in Section 6 of this policy.

2. Purpose of data processing

2.1. Processing related to requested services
Komsai processes the information you provide in order to deliver the services you request. When personal information is provided in connection with a service, the purpose of processing that information is linked to the delivery of that service. The relevant request provides the context for understanding why the information has been provided and what it is intended to be used for. The fact that you provide information to Komsai does not, in itself, mean that it may be used for any purpose. Your personal data will be used only for the intended purpose for which it was provided.

2.2. Processing related to information requests
We also process the information you provide when you ask us to send information or respond to an enquiry. In these circumstances, the purpose of processing is to address the information you have requested. This includes using the information you provide to understand the subject of your enquiry and respond to it. A request for information and a request for a service may involve different purposes. In each case, the relevant purpose is determined by what you have asked Komsai to provide.

2.3. Limitation to the intended purpose
The personal information covered by this policy is used for the purpose associated with your request. Information provided for one particular request will not be treated as permission to use that information for unrelated purposes. The intended use remains connected to the reason for which the information was originally supplied. The provisions on retention in Section 3 should be understood in this context: the continuing need to retain information depends on whether it remains necessary for its original purpose, together with any applicable legal retention requirements. If you would like clarification about why your personal information is being processed, you may contact us using the details in this policy. Please identify the service, enquiry or request to which your question relates so that the relevant processing can be understood.

3. Data retention

3.1. General retention criteria
The information you provide will be retained while it remains necessary for its original purpose and as long as you have not requested that we cease processing it, subject to any legal obligation requiring continued retention. Retention is therefore connected to the purpose for which the information was provided. The relevant consideration is whether the information is still needed to deliver the requested service or supply the requested information. This policy does not establish a single fixed retention period for all information. Instead, it describes the criteria governing retention: the original purpose, the continuing need for the information, any request you make concerning its processing, and any applicable legal obligation.

3.2. Information that is no longer needed
Once personal information is no longer necessary for its original purpose, it will be securely deleted unless a legal obligation requires it to be retained for a longer period. The completion of a particular request and the existence of a legal retention obligation are separate considerations. Information may no longer be needed for the original request while still being subject to a requirement that prevents its deletion at that time. The exception for legal retention does not change the purpose for which the information was originally provided. It explains why certain information may need to remain retained after that original purpose has ended.

3.3. Requests to cease processing or delete information
You may contact us to request that we stop processing your personal information or to exercise your right to deletion. A request to cease processing concerns the continued use of your information. A request for deletion concerns the removal of that information. Depending on the circumstances, you may wish to request one or both. These requests are subject to the conditions applicable to the relevant right and to any legal obligation requiring information to be retained. A request for deletion does not override a legal requirement to preserve particular information. If your request concerns a specific service, enquiry or set of personal data, please identify it clearly. This helps establish the scope of the processing or retention to which your request relates.

4. Data sharing

4.1. General rule
Your personal data will not be shared with third parties except where there is a legal obligation to do so. This rule applies to the information covered by this Privacy Policy. The exception concerns circumstances in which disclosure is required by law. Providing information to Komsai for a requested service or enquiry does not, by itself, authorise the sharing of that information with third parties.

4.2. Legally required disclosure
Where a legal obligation applies, Komsai may be required to disclose the relevant information to a competent authority or another recipient legally entitled to receive it. Such disclosure is distinct from using information to fulfil your original request. Its basis is the applicable legal obligation requiring the information to be provided. If you have questions about this section, you may contact us at info@komsai.com. Please explain the information or processing to which your question relates.

5. Your rights concerning your personal data

You have the right to obtain information about whether Komsai BCN SLU is processing personal data concerning you. You may also exercise the rights described below where the applicable conditions are met. These rights concern different aspects of the processing of your information: knowing what data is held, correcting it, requesting its deletion, receiving it in a portable format, objecting to its processing, or requesting restrictions on its use. The availability and scope of each right depend on the circumstances and the conditions established by applicable data protection law. The descriptions below explain the purpose of each right and the type of request it concerns.

5.1. Right of access
You may request confirmation of whether Komsai is processing personal data concerning you and obtain information about the personal data we hold about you. The purpose of access is to allow you to understand whether your information is being processed and what information is involved. It may also help you identify whether you wish to exercise another right, such as requesting the correction of inaccurate information. An access request may concern your personal information generally or a particular service, enquiry or interaction. Where your request relates to a specific matter, identifying that matter can help clarify the information you are asking about. Access is distinct from rectification or deletion. Requesting information about your data does not, in itself, constitute a request to change or remove it.

5.2. Right to rectification
You may request the correction of personal information that is inaccurate or incomplete. This right concerns the accuracy and completeness of the information being processed. If you believe that information we hold about you contains an error, you may identify the relevant information and explain what needs to be corrected. Where information is incomplete, you may explain what is missing and the completion you are requesting. Your request should distinguish between the information currently held and the information you believe should replace or supplement it. Rectification concerns correcting information. If your intention is to have information removed rather than corrected, you should indicate that you are requesting deletion.

5.3. Right to deletion
You may request the deletion of your personal data when it is no longer necessary for its original purpose or, where applicable, when you withdraw your consent. This right allows you to ask for the removal of information in circumstances where the conditions for deletion are met. You may identify particular information you wish to have deleted or explain that your request concerns the information associated with a specific service or enquiry. The right to deletion is subject to applicable conditions and legal retention obligations. Certain information may need to be retained where the law requires it, even when you have requested its removal. The provisions in Section 3 explain how the original purpose and legal retention requirements relate to the deletion of information.

5.4. Right to data portability
Where the applicable conditions are met, you may request to receive your personal data in a structured, commonly used and machine-readable format. The purpose of portability is to make the relevant information available in a format suitable for use beyond the context in which it was originally provided. This right differs from a general request for access. Access concerns obtaining information about the personal data being processed, while portability concerns receiving eligible data in the specified type of format. The right applies in the circumstances established by applicable data protection law. If you wish to exercise it, please identify the information or service to which your request relates and clearly state that you are requesting data portability.

5.5. Right to object
You may object to the processing of your personal data under the conditions provided by applicable data protection law. An objection concerns the processing of information rather than necessarily the accuracy of the information itself. You may therefore wish to object even when the data being processed is correct. When submitting an objection, please identify the processing to which you object and explain the circumstances relevant to your request. This helps distinguish your objection from a request for access, rectification, deletion or restriction. The application of this right depends on the relevant processing and the conditions established by law. An objection and a request for deletion are distinct rights and should be identified separately if you intend to exercise both.

5.6. Right to restriction of processing
You may request the restriction of the processing of your personal data in specific circumstances. Restriction concerns limiting the processing of information. It is different from rectification, which concerns changing inaccurate or incomplete information, and from deletion, which concerns removing information. If you wish to request restriction, please explain which information or processing your request concerns and the circumstances that give rise to it. The application of this right is subject to the relevant legal conditions. A request for restriction should therefore clearly identify the limitation you are seeking so that the scope of the request can be understood.

6. How to exercise your rights

6.1. Where to submit a request
You may submit a request concerning your data protection rights through either of the following channels:

• By email: dpo@komsai.com
• By postal mail: Komsai BCN SLU, Via Augusta 123, 08006 Barcelona, Spain

These channels may be used to request access, rectification, deletion, data portability, restriction of processing, or to object to processing.

6.2. Describing your request
Please clearly indicate the right you wish to exercise and the personal information or processing to which your request relates. To help define the scope of your request, you may include: the service, enquiry or request associated with the information; the personal data or processing you are asking about; the correction, deletion, restriction or other action you are requesting; and any relevant explanation needed to understand the request. You do not need to combine different requests into a single category. If you wish to exercise more than one right, please identify each one and explain what you are requesting in relation to it. For example, asking to access information and asking to correct information are separate requests, even when they concern the same personal data.

6.3. Verification of identity
Where necessary to verify your identity, we may request additional identification information. This may include a copy of your identity document or an equivalent identification document. The purpose of verification is to establish that the request concerns your own personal information and that information is not disclosed, changed or removed in response to a request from someone whose identity has not been established. The identification information requested should be appropriate to that purpose. Providing a clear description of the relevant service or enquiry may also help identify the information to which your request relates.

6.4. Questions about the appropriate right
If you are unsure which right corresponds to your concern, you may describe the issue and the outcome you are requesting. For example, you may explain that you want to know what information is held, correct an error, request the removal of information, or ask that a particular use of your information stop. For general questions about this policy, you may also contact info@komsai.com.

7. Filing a complaint

If you believe that your data protection rights have not been fully satisfied, you have the right to submit a complaint to the national supervisory authority. In Spain, the relevant authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD). Its contact details are:

• Postal address: C/ Jorge Juan, 6, 28001 Madrid, Spain
• Website: www.aepd.es

The Agency’s website provides information about data protection rights and the procedures available for submitting a complaint. You may also contact Komsai to explain your concern or request clarification about the processing of your personal information. If your concern relates to a previous request, identifying that request and the matter you consider unresolved can help explain the issue. Contacting Komsai does not affect your right to submit a complaint to the supervisory authority.

8. Contact us

If you have questions about this Privacy Policy or concerns about how your personal information is handled, you may contact us using the details below.

General enquiries about personal data processing: info@komsai.com
Requests to exercise data protection rights: dpo@komsai.com
Postal correspondence: Komsai BCN SLU, Via Augusta 123, 08006 Barcelona, Spain

• info@komsai.com
• dpo@komsai.com