Privacy

PRIVACY POLICY

MAGSAN REPRESENTACION Y DISTRIBUCION, SCP (the “Company”) is an organisation that carries out personal data processing activities and therefore assumes significant responsibility in the design and organisation of procedures aligned with legal compliance in this area.

In the exercise of these responsibilities, and in order to establish the general principles governing the processing of personal data within the Company, this Personal Data Protection Policy is approved, communicated to its employees and made available to all its stakeholders.

1. PURPOSE

This Personal Data Protection Policy is a proactive accountability measure intended to ensure compliance with applicable data protection legislation and, in this context, respect for the right to honour and privacy in the processing of personal data of all individuals who interact with the Company.

In accordance with this Policy, the principles governing data processing within the organisation are established, as well as the procedures and organisational and security measures that the persons affected by this Policy undertake to implement within their respective areas of responsibility. To this end, MAGSAN REPRESENTACION Y DISTRIBUCION, SCP will assign responsibilities to the personnel involved in data processing operations.

2. SCOPE

This Personal Data Protection Policy shall apply to the Company, its directors, officers and employees, as well as to all individuals who interact with it, including, expressly, service providers with access to data (“Data Processors”).

3. PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA

As a general principle, the Company shall strictly comply with personal data protection legislation and must be able to demonstrate such compliance (principle of “accountability”), paying particular attention to processing operations that may pose a higher risk to the rights of data subjects (principle of “risk-based approach”).

In this regard, MAGSAN REPRESENTACION Y DISTRIBUCION, SCP shall ensure compliance with the following principles:

Lawfulness, fairness, transparency and purpose limitation. Personal data processing shall always be communicated to the data subject through clauses and other procedures and shall only be considered lawful if consent has been obtained (with special attention to consent provided by minors) or if there is another valid legal basis and the purpose complies with applicable regulations.

Data minimisation. Data processed shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Accuracy. Personal data shall be accurate and, where necessary, kept up to date. All reasonable steps shall be taken to ensure that inaccurate personal data are erased or rectified without delay.

Storage limitation. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of the processing.

Integrity and confidentiality. Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by means of appropriate technical or organisational measures.

Data disclosures. The purchase or acquisition of personal data from illegitimate sources is prohibited, as well as the use of data obtained or disclosed in breach of the law or where their lawful origin is not sufficiently guaranteed.

Engagement of suppliers with access to data. Only suppliers offering sufficient guarantees to implement appropriate technical and security measures for data processing shall be selected. The corresponding data processing agreement shall be duly documented with such third parties.

International data transfers. Any processing of personal data subject to European Union regulations involving transfers outside the European Economic Area shall be carried out in strict compliance with the requirements established by applicable law.

Rights of data subjects. The Company shall facilitate the exercise of the rights of access, rectification, erasure, restriction of processing, objection and data portability, establishing the necessary internal procedures and templates to ensure compliance with applicable legal requirements.

The Company shall promote the consideration of the principles set out in this Policy in (i) the design and implementation of all work procedures, (ii) the products and services offered, (iii) all contracts and obligations entered into, and (iv) the deployment of systems and platforms enabling access by employees or third parties and/or the collection or processing of personal data.

4. EMPLOYEES’ COMMITMENT

Employees are informed of this Policy and acknowledge that personal information is a Company asset. Accordingly, they adhere to this Policy and commit to:

Attend the data protection awareness training made available by the Company.

Apply user-level security measures relevant to their position, without prejudice to any additional responsibilities assigned according to their role within MAGSAN REPRESENTACION Y DISTRIBUCION, SCP.

Use the established formats for the exercise of data subject rights and immediately inform the Company so that a response can be provided.

Inform the Company, as soon as they become aware, of any deviation from this Policy, in particular personal data security breaches, using the designated reporting format.

5. MONITORING AND REVIEW

An annual verification, assessment and review shall be carried out, or whenever significant changes occur in data processing activities, to evaluate the effectiveness of the technical and organisational measures implemented to ensure processing security.

ADDITIONAL DATA PROTECTION INFORMATION

Who is the data controller?

For what purpose do we process your personal data?

At MAGSAN REPRESENTACION Y DISTRIBUCION, SCP, we process the information provided by users in order to respond to enquiries and comments and, where appropriate, to maintain contact to inform them about our products and services.

How long will we keep your data?

Personal data shall be retained for as long as a business relationship exists and, thereafter, for the maximum period established by applicable regulations.

What is the legal basis for processing your data?

The legal basis for processing your data is the consent you provide by ticking the corresponding checkbox, which you may withdraw at any time.

Who will your data be shared with?

Your data will not be disclosed to third parties. No international data transfers are envisaged.

What are your rights when you provide us with your data?

Any person has the right to obtain confirmation as to whether MAGSAN REPRESENTACION Y DISTRIBUCION, SCP is processing personal data concerning them.

Data subjects have the right to access their personal data and to request rectification of inaccurate data or, where appropriate, erasure when the data are no longer necessary for the purposes for which they were collected.

In certain circumstances, data subjects may request restriction of processing, in which case the data will only be retained for the exercise or defence of legal claims.

In certain circumstances and for reasons relating to their particular situation, data subjects may object to the processing of their data. In such cases, MAGSAN REPRESENTACION Y DISTRIBUCION, SCP will cease processing, unless there are compelling legitimate grounds or the data are required for the establishment, exercise or defence of legal claims.

Likewise, in certain circumstances and where technically feasible, data subjects have the right to have their personal data transmitted directly to another controller at their request.

To exercise these rights, please send a written request to: C/ Coronel Sanfeliu 46, 1st Floor, 08820 El Prat de Llobregat (Barcelona), or by email to magsanscp@gmail.com, enclosing a copy of your ID document.

You may also contact the Spanish Data Protection Agency if you consider that your rights have not been adequately addressed.

MAGSAN REPRESENTACION Y DISTRIBUCION, SCP