Data Protection Rights

Data protection regulations establish a series of rights available to all individuals. Napau Sistemas, S.L., to facilitate their exercise, informs you of the different rights, their content, procedures, deadlines, and provides the forms you may use to exercise them.

Common to all rights:

• Their exercise is free of charge, unless the requests are manifestly unfounded or excessive.
• Requests must be responded to within one month, although, taking into account the complexity and number of requests, the deadline may be extended by an additional two months.
• In all our clauses and Records of Processing Activities, we specify the means for exercising rights.
• You may exercise your rights directly or through your legal or voluntary representative (voluntary representation form).
• The processor may respond to your request on behalf of the controller if both have established this in the contract or legal instrument binding them.
• As a general rule, the age for exercising rights is fourteen years, although in matters such as health it will be sixteen years.
• Regarding deceased persons, those related to the deceased by family or factual ties, as well as their heirs, may exercise their rights of access, rectification, and erasure, unless the deceased had expressly prohibited it or a law establishes otherwise.

How do I exercise data protection rights?

• Written request to the data controller, Napau Sistemas, S.L. (forms are provided below) by any legally admissible means.
• Identification (photocopy of ID card or passport or other valid document to identify the person).
• If acting through a representative, copy of the representation and identification of the representative (photocopy of ID card or passport or other valid document to identify the person).
• Right being exercised, and to the extent possible, specification of your request.
• Address for notification purposes, date, and signature.
• Documents (if necessary) justifying the exercise of rights.

Content of Rights:

Right of Access

This means that any person has the right to contact Napau Sistemas, S.L. to find out, first of all, whether or not we are processing their personal data and, if so, to obtain the following information:

• A copy of their personal data that we are processing.
• The purposes for which we are processing their data.
• The recipients or categories of recipients to whom the personal data were or will be disclosed, in particular recipients in third countries or international organizations.
• The envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period.
• The existence of the right to request rectification or erasure of their personal data, restriction of processing of their personal data, or to object to such processing.
• The right to lodge a complaint with the Spanish Data Protection Agency or with the Council for Transparency and Data Protection of Andalusia (if the activity is subject to administrative law).
• When not obtained directly from the data subject, to identify the source.
• If automated decisions exist, including profiling, information about the logic applied, the significance, and the consequences of such processing.
• When data are transferred to a third country or an international organization, you will be informed of the appropriate safeguards under which the transfers are made.

The right of access includes providing a copy of the personal data being processed; however, if more than one copy is requested, a reasonable fee based on administrative costs may be charged. This right to obtain a copy cannot adversely affect the rights and freedoms of others.

Right of Access Form

Right of Rectification

This means that any person whose data Napau Sistemas, S.L. processes may obtain rectification of their data. In the request you make, you must indicate the data you want rectified, and when necessary, attach documentation justifying their inaccuracy or incomplete nature. Rectification must be carried out without delay and within a maximum period of one month.

Right of Rectification Form

Right of Erasure (right to be forgotten)

Any person whose data Napau Sistemas, S.L. processes may exercise this right whenever these circumstances apply:

• If the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• If the processing of personal data was based on consent, and consent is withdrawn, with no other legal basis legitimizing it.
• If the right of objection has been exercised and it was based on refusal to process data for direct marketing, or was based on the legal basis of legitimate interest or performance of a task in the public interest.
• If the processing of personal data was unlawful.
• If the personal data must be erased to comply with a legal obligation established in Union or Member State law.
• If the data were obtained in relation to the offer of information society services, as set out in the General Data Protection Regulation.

Like all rights, it is not unlimited; this right has the following limits: exercise of freedom of expression and information, compliance with a legal obligation, performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, for reasons of public interest in the field of public health, for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, or for the establishment, exercise, or defense of legal claims.

Right of Erasure Form (right to be forgotten)

Right of Objection

This means that those persons whose personal data Napau Sistemas, S.L. processes may object to such processing in two cases:

• When they are subject to processing based on a task in the public interest or on legitimate interest, including profiling. This right will be granted unless compelling legitimate grounds are demonstrated that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
• When the processing has direct marketing as its purpose, including profiling. Once this right is granted, the personal data will no longer be processed for this purpose.

Right of Objection Form

Right to Restriction of Processing

This may be exercised by those persons whose data Napau Sistemas, S.L. processes, in two forms:

• Request suspension of processing of their data:
  1. When the accuracy of the data has been contested, during the period in which it is being verified.
  2. When the right of objection has been exercised based on legitimate interest or task in the public interest, while it is being verified whether it applies or not.
• Request retention of their data:
  1. When the processing is unlawful and you object to the erasure of the data, requesting restriction instead.
  2. When the data are no longer necessary for the purpose of processing, but the data subject needs them for the establishment, exercise, or defense of legal claims.

The fact that the processing of personal data is restricted must be clearly recorded in the information systems of Napau Sistemas, S.L.

Right to Restriction of Processing Form

Right to Data Portability

Whenever technically feasible, any person whose data Napau Sistemas, S.L. processes, based on consent or in the context of performance of a contract, may request, provided the processing is carried out by automated means, that the data be sent to them or to the new controller, in a structured, commonly used, machine-readable, and interoperable format. This right does not apply when processing is necessary for the performance of a task in the public interest or in the exercise of official authority.

Right to Data Portability Form

Right not to be subject to automated individual decisions

Every person whose data Napau Sistemas, S.L. processes has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless it is provided for in regulations that will establish counterbalancing measures for this obligation. They may also give their consent for this, or it may be necessary for the performance of a contract, but in these two cases, they may request human intervention, may express their point of view, and may contest the decision.

Right not to be subject to automated individual decisions Form