PRIVACY AND DATA PROTECTION

We inform you that access to certain content or services will require providing personal data. Users guarantee the truthfulness, accuracy, and authenticity of their data. MAM OBJECTS SOCIEDAD LIMITADA will preserve the confidentiality and security of your personal data and will process it automatically according to its nature or purpose, under the terms indicated in the Data Protection Policy section.

It is important, given the European data protection regulation (EU Regulation 2016/679 of the European Parliament and Council), to read the Basic Information. You should also know that providing your data does not attribute, confirm, annul, legitimise, or perfect any contractual relationship with our company.

BASIC INFORMATION

Principles relating to processing

Your personal data will be processed:

• In a lawful, fair and transparent manner in relation to the data subject.
• Collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes; archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered incompatible with the initial purposes.
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accurate and, where necessary, kept up to date; every reasonable step will be taken to ensure that personal data that are inaccurate are erased or rectified without delay.
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Language

The applicable language for this Privacy Policy is Spanish. Therefore, in the event of any contradiction in any of the versions provided in other languages, the Spanish version shall prevail. Regarding the interpretation of contracts, specific reference shall be made to Articles 1281 et seq. of the Spanish Civil Code.

DATA COLLECTED BY THE CIASAT APPLICATION

The Ciasat mobile application may collect the following personal data depending on the permissions you grant and the features you use:

Account data

• Email address: required to log in and manage your user account.
• Login credentials: encrypted password used exclusively for authentication.

Location data

• Precise location (GPS): used to display your current position on the map and centre the map view on your exact coordinates.
• Approximate location (network/WiFi): used as a supplement when the GPS signal is unavailable.
• Background location (iOS): used to provide real-time position updates even when the application is not in use. Requires explicit user permission.

You may withdraw these permissions at any time from your device settings.

Camera and photo gallery (iOS)

• Camera: to take photographs (e.g., profile picture). Only activated when you use this feature.
• Photo gallery: to select images from your device.

Push notifications

• Device token: anonymous identifier required to send push notifications via Firebase Cloud Messaging. You can manage notifications from your device settings.

Usage and diagnostic data

• Error reports (crash logs): collected via Firebase Crashlytics to identify and resolve technical issues. They do not contain personally identifiable information.

The application uses the following third-party services that may process some of the aforementioned data: Google Firebase (Cloud Messaging, Crashlytics) and Google Maps Platform.

PURPOSES

• Manage IT services for clients within the scope of our corporate purpose.
• Address your requests, invoice these services, manage withdrawals and refunds within the legal deadlines provided for in Law 34/2002, of 11 July, on information society services and electronic commerce, Royal Legislative Decree 1/2007, of 16 November, approving the consolidated text of the General Law for the Defence of Consumers and Users and other complementary laws.
• Send you advertising and promotions related to our corporate purpose according to your areas of interest, by any means whether postal, electronic, or through landline or mobile telephone. As well as inviting you to events organised by the company, both in-person and online.

REGULATORY COMPLIANCE

We reserve the right to store and retain information provided by you, including the services used, information that includes account information and personal data to comply with applicable laws, when necessary for providing evidence in arbitrations or courts, keeping them blocked and pseudonymised to guarantee their security, secrecy and confidentiality.

LAWFULNESS

We will not process data without explicit consent for each of the purposes, only when:

• It is necessary for the performance of a contract to which the data subject is party or for the implementation at their request of pre-contractual measures.
• It is necessary for compliance with a legal obligation applicable to the controller.
• Processing is necessary to protect the vital interests of the data subject or another natural person.
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

To this end, we will ensure the existence of adequate safeguards, which may include encryption or pseudonymisation of data, so that the user's identity is protected.

DATA PROTECTION OFFICER

For any request concerning your fundamental rights described in Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU), which establish that everyone has the right to the protection of personal data concerning them, Article 12 of the Universal Declaration of Human Rights, Article 17 of the International Covenant on Civil and Political Rights adopted by the United Nations General Assembly, Article 11 of the American Convention on Human Rights, also called the Pact of San José, Costa Rica, and those described in Articles 14 to 29 of the Spanish Constitution. You may contact: info@erictel.com – legal@censorconsulting.es

LEGITIMATION

Consent, contractual relationship and legitimate interest.

LEGAL BASIS

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights, Law 34/2002 of 11 July on information society services and electronic commerce. Royal Legislative Decree 1/2007 of 16 November approving the consolidated text of the General Law for the Defence of Consumers and Users and other complementary laws.

RECIPIENTS

We transfer data to third parties, such as: hosting operators, operators managing computer programmes to provide the services, operators managing the website; others maintaining our computer applications that enable the ordinary management of our services, essential for the management of our activity. In the context of the Ciasat application, we use Google Firebase (Cloud Messaging and Crashlytics) and Google Maps Platform as service providers.

DURATION

The data provided will be kept for a period of 5 years from the last contract, unless you have previously requested its blocking or deletion, or as prescribed by tax legislation. Tax data will be kept for 5 years by legal prescription. Location data is processed in real time and is not stored on the device beyond the active session.

DATA QUALITY

All data requested through the website is mandatory, as it is necessary for the provision of an optimal service to the user. Should not all the data be provided, the provider does not guarantee the provision of the requested services.

The user shall be solely responsible for the truthfulness and currency of the data provided through the various forms on the website.

PROFILING

We do not process your personal data automatically for profiling on the website, except for statistics that do not compromise any fundamental rights of the data subjects.

Some of the services we provide collect geolocation data; in these cases, the users of such services have been informed of the scope and the time periods for which such data is stored. The Ciasat application uses device location exclusively to display the user's position on the map and provide the contracted location services, not for automated profiling.

ADDITIONAL INFORMATION

You may at any time request additional information about your personal data ("second layer"), at the same address we provide for you to exercise your rights.

MINORS

Our services are not directed at minors or incapacitated persons. We understand that they have the authorisation and consent of their parents, guardians or legal representatives. The use of these services shall be under their responsibility, whether by negligence or fault, which could result in non-contractual liability.

DIGITAL WILL

Persons linked to the deceased for family or de facto reasons, as well as their heirs, may contact the data controller in order to access such content and give the instructions they deem appropriate regarding its use, destination or deletion, provided they are direct relatives and vital interests are at stake, for which a form must be completed and the request made in writing, proving identity.

The aforementioned persons may not access the deceased's content, nor request its modification or deletion, when the deceased person expressly prohibited it or as established by law.

INTERNATIONAL DATA TRANSFERS

In some cases, to provide you with a better service, we may carry out international data transfers governed by the provisions of Regulation (EU) 2016/679 and with the various legal bases provided therein:

• With your explicit consent, maintaining all legal guarantees to protect your privacy, with maximum security and maintaining data secrecy and confidentiality.
• Through standard contractual clauses defined in Article 46.2.c) of Regulation (EU) 2016/679, which shall be subject to the prior opinion of the European Data Protection Board provided for in Article 64 of the Regulation.
• Binding corporate rules in accordance with the provisions of Article 47 of Regulation (EU) 2016/679.
• International data transfers to countries or international organisations that do not have an adequacy decision approved by the Commission or that are not covered by any of the guarantees provided for in the preceding article and in Article 46.2 of Regulation (EU) 2016/679 shall require prior authorisation from the Spanish Data Protection Agency.

The Ciasat application uses Google services (Firebase, Google Maps) that may involve international data transfers. These transfers are covered by adequate safeguards provided for in the GDPR and the EU-US Data Privacy Framework.

RIGHTS

You may exercise your rights of access, rectification, cancellation and/or opposition, as well as the right to limitation of purpose and portability. You may contact us at our email address: info@erictel.com; or at our postal address by contacting the File Controller of our company. To do so, it will be necessary to provide personal data and supporting documents, together with your request.

For this purpose, it is necessary that you, or a legally authorised person, provide the following documents:

• Photocopy of ID card/passport
• Sufficient identification and representation.
• Explanation and purpose of the claim.
• Address for sending communications, or email, to contact you as soon as possible.

COMPLEMENTARY INFORMATION

You have the right to obtain confirmation as to how our company is processing your personal data. Therefore, you have the right to access your personal data, rectify inaccurate data or request its deletion when the data is no longer necessary for the purposes for which it was collected, at any time, in a simple and free manner.

You may also UNSUBSCRIBE from receiving promotional messages, in compliance with LSSICE 34/2002. To do so, you must provide the following data:

• Company name and details of its representative.
• Postal and email address where you wish to receive communications.
• Clear request, which need not be justified.

RIGHTS

You may always contact the supervisory authority, in this case the Spanish Data Protection Agency (AEPD), if you believe your requests have not been addressed: www.aepd.es

SECURITY MEASURES

The data you provide will be processed confidentially. The Data Controller has adopted all technical and organisational measures and all levels of protection necessary to guarantee the security of the processing of data and prevent its alteration, loss, theft, processing or unauthorised access, in accordance with the state of the technology and nature of the stored data.

Likewise, it is also guaranteed that the processing and recording in files, programmes, systems or equipment, premises and centres comply with the requirements and conditions of integrity and security established in the applicable regulations.

CODE OF CONDUCT

MAM OBJECTS SOCIEDAD LIMITADA undertakes that the contents of its services:

• Shall not induce or promote sexual, racial or religious discrimination or any other violation of fundamental rights and public freedoms recognised by the Spanish Constitution or EU regulations. They shall not induce or incite illegal actions.
• Shall not lead to erroneous conclusions as a result of their inaccuracy, ambiguity, exaggeration, omission or similar.
• Shall not induce an unacceptable state of anxiety or fear, or take advantage of or exploit the user's economic, employment or personal situation.
• Shall not induce or incite any person to engage in dangerous risk practices or practices that threaten health or psychological balance.
• Shall not infringe the legal or regulatory provisions on the secrecy of communications, intellectual property, the right to honour and personal or family privacy, or any other provision applicable to the nature of the service.
• Shall not contain false information.
• Services that incorporate requests for information or personal data, including name, address or other data, with the fixed or mobile telephone number considered as such, must be adequate, relevant and not excessive in relation to the purpose for which they are collected.

Users have the right to:

• Receive objective, prior, accurate and complete information about the conditions of provision of the products offered to them.
• Receive services under the conditions offered or agreed with the company or the provider.
• Obtain documents accrediting the terms of the contract and invoices for the products paid, issued in accordance with current regulations.
• File any claims they consider pertinent and promptly obtain the official form to file such claims and appropriate guidance on how to complete it.
• Request and obtain the actions of the arbitration bodies regulated by applicable legislation.
• Request and receive the assistance of the authorities when necessary for the defence of their rights as users, regardless of their origin and destination and without prejudice to the powers of other bodies and authorities.