Data protection

This policy sets out APINA S.A.'s commitment to protecting the personal data processed in the course of its activity, in accordance with the GDPR (EU 2016/679) and the LOPDGDD (3/2018).

1. Processing principles

• Lawfulness, fairness and transparency towards the data subject.
• Purpose limitation: data is collected for specified, explicit and legitimate purposes.
• Minimisation: only adequate and necessary data is processed.
• Accuracy, integrity and confidentiality of the information.
• Storage limitation.

2. Security measures

APINA S.A. applies appropriate technical and organisational measures to ensure a level of security suited to the risk, including access control, the confidentiality of authorised staff and the protection of information systems against unauthorised access, loss or alteration of data.

3. Data processors

When a third party accesses personal data to provide a service to APINA S.A., a data-processing agreement is signed that guarantees compliance with the regulations and the confidentiality of the information.

4. International transfers

As a general rule, no international data transfers are carried out. Should any occur, the appropriate safeguards provided for in the GDPR will be adopted (adequacy decisions, standard contractual clauses or other applicable safeguards).

5. Retention and deletion

Data is kept for the time necessary to fulfil the purpose for which it was collected and to address legal liabilities. Once those periods have elapsed, it is securely deleted.

6. Exercising rights

Data subjects may exercise their rights of access, rectification, erasure, restriction, objection and portability, as well as withdraw the consent given, by writing to info@apina.com. If they consider it necessary, they may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).