I. PERSONAL DATA PROTECTION POLICY
MI CANESU BEBE S.L. (the "Company") is an Organization in which personal data processing activities take place, which gives it an important responsibility
in the design and organization of procedures so that they are aligned with legal compliance in this matter. In the exercise of these responsibilities and in order to establish the general principles that should govern the processing of personal data in the Company, it approves this Personal Data Protection Policy, which notifies its Employees and makes available of all its stakeholders.
1. Purpose
The Personal Data Protection Policy is a Productive Responsibility measure whose purpose is to ensure compliance with the applicable legislation in this matter
and in relation to it, respect for the right to honor and privacy in the treatment of personal data of all people who are related to The Company.
In development of the provisions of this Personal Data Protection Policy, the Principles that govern the data processing in the organization and, consequently, the procedures, and the organizational and security measures that the people affected by this Policy undertake to implement in their area of responsibility.
To this end, the Management will assign the responsibilities to the personnel who participate in the data processing operations.
2. Scope of application
This Personal Data Protection Policy will be applicable to the Company, its administrators, managers and employees, as well as to all persons related to it,
with the express inclusion of service providers. service with access to data ("Processors")
3. Principles of personal data processing
As a general principle, The Company will scrupulously comply with the legislation on the protection of personal data and must be able to demonstrate it (Principle of
"proactive responsibility"), paying special attention to those treatments that may pose a greater risk to the rights of those affected (Principle of "risk approach").
In relation to the foregoing MI CANESU BEBE S.L. will ensure compliance with the following Principles:
- Legality, loyalty, transparency and limitation of purpose. Data processing must always be informed to the affected party, through clauses and other procedures; and it will only be considered legitimate if there is consent for the data processing (with special attention to that provided by minors), or it has another valid legitimation and the purpose of the same is in accordance with the Regulations.
- Data minimization. The data processed must be adequate, pertinent and limited to what is necessary in relation to the purposes of the treatment.
- Accuracy. The data must be exact and, if necessary, updated. In this regard, the necessary measures will be adopted to delete or rectify without delay any personal data that is inaccurate with respect to the purposes of the treatment.
- Limitation of the conservation period. The data will be kept in a way that allows the identification of the interested parties for no longer than necessary for the purposes of the treatment.
- Integrity and Confidentiality. The data will be processed in such a way that adequate security of personal data is guaranteed, including protection against unauthorized or illegal treatment and against its loss, destruction or accidental damage, through the application of appropriate technical or organizational measures.< /li>
- Data transfers. It is prohibited to purchase or obtain personal data from illegitimate sources or in those cases in which said data has been collected or transferred in violation of the law or its legitimate origin is not sufficiently guaranteed.
- Contracting providers with access to data. Only providers that offer sufficient guarantees to apply appropriate technical and security measures in data processing will be chosen for contracting. The due Agreement in this regard will be documented with these third parties.
- International data transfers. All processing of personal data subject to European Union regulations that implies a transfer of data outside the European Economic Area must be carried out in strict compliance with the requirements established in the applicable law.
- Rights of those affected. The Company will provide those affected with the exercise of the rights of access, rectification, deletion,
