Privacy Policy

(Personal Data Protection Policy – GDPR)

In compliance with Regulation (EU) 2016/679 (GDPR) and national data protection legislation, we inform you clearly and transparently about the processing of your personal data.

1. Processing of personal data

Your personal data may be subject to the following processing activities, each with its respective legal basis:

• TR04 – Advertising campaigns
  Legal basis: Law 34/1988, General Advertising Law.
• TR08 – Collection of data subjects’ opinions
  Legal basis: GDPR and national data protection legislation.
• TR03 – Personnel selection
  Legal basis: Royal Legislative Decree 3/2015 (Consolidated Text of the Employment Law).
• TG01 – Internal accounting management
  Legal basis: Royal Decree 1514/2007 (General Accounting Plan).
• TG25 – Internal tax management
  Legal basis: Law 58/2003, General Tax Law.
• TG12 – Personnel management
  Legal basis: Royal Legislative Decree 1/1994, Consolidated Text of the Social Security Law.
• TR09 – Software security measures
  Legal basis: GDPR.
• TE02 – Occupational risk prevention
  Legal basis: Law 31/1995 on Occupational Risk Prevention.
• TE07 – Document destruction
  Legal basis: GDPR.
• TV01 – Sale/Provision of services
  Legal basis: Commercial and tax legislation.
• TE03 – Transport and shipping
  Legal basis: Commercial Code.
• TR05 – Email communications
  Legal basis: Commercial Code.
• TR01 – Information requests
  Legal basis: Applicable commercial regulations.
• TR07 – Management of security incidents and breaches
  Legal basis: GDPR.
• TE04 – Internal legal management
  Legal basis: Commercial and labor regulations.
• TE01 – IT systems maintenance
  Legal basis: Commercial Code.

2. Data Controller

The data controller is:

Owner / Business Name: La Casa Ibicenca by Enrico Lugheri
Address: Carrer d’Extremadura 31, Ibiza, Islas Baleares
Phone: 697 543 640
Email: info@lacasaibicenca.es
Tax ID: X9520160T

3. Purpose of processing

Personal data will be processed exclusively for the following purposes:

• Verification of technical and organizational measures of company software.
• Sending commercial or advertising communications via email.
• Management of information requests about products and services.
• Management of potential data security breaches or incidents.
• Execution of advertising campaigns.
• Collection of user opinions.
• Personnel selection and recruitment.
• Compliance with workplace safety regulations.
• Shipping of packages and correspondence.
• Management of internal disputes and legal matters.
• Management, maintenance, and repair of IT systems.
• Employee management.
• Internal tax and accounting management.
• Compliance with legal data retention periods.
• Administrative management of clients.
• Execution of the requested sale or service.

Profiling

A commercial or usage profile may be created, but minors’ data will never be profiled.

Retention period

The data will be retained:

• for the duration of the contractual or commercial relationship;
• until the right of objection is exercised or consent is withdrawn;
• for the periods required by applicable legal regulations.

4. Legal basis for processing

We are authorized to process your personal data on the basis of:

• Explicit consent of the data subject, when required.
• Legal obligation of the data controller.
• Execution of a contract for sale or provision of services.
• Legitimate interest of the controller, assessed through a balancing test in compliance with GDPR.

5. Recipients of the data

Personal data may be communicated to:

• Tax Agency
• State Public Employment Service
• General Treasury of Social Security
• Banks and financial institutions

No transfer of data to third countries or international organizations is planned.

6. Origin of data and categories of data processed

The processed data comes from:

• Directly from the data subject

Your data will be stored in the following internal files or registers:

• FG01 Accounting management
• FG02 Personnel management
• FG15 Tax management
• FE01 IT maintenance
• FE02 Risk prevention
• FE03 Transport and shipping
• FE04 Legal matters
• FR01 Information requests
• FR03 Personnel selection
• FR04 Advertising campaigns
• FR05 Email
• FR07 Security incident management
• FR08 Data subjects’ opinions
• FR09 Software and hardware security
• FE07 Document destruction
• FP01 Clients

7. Rights of the data subject

You have the right to:

• Obtain confirmation of the existence of processing.
• Access your personal data.
• Rectify inaccurate or outdated data.
• Object to processing for reasons related to your personal situation.
• Request the deletion of data.
• Request data portability.
• Restrict processing in certain circumstances.
• Object to profiling and automated decision-making.

The exercise of rights is free and can be done by sending a written request to the controller.

You also have the right to:

• File a complaint with the Supervisory Authority (AEPD or equivalent).
• Appeal to the Judicial Authority.
• Withdraw consent as easily as it was given.

8. Data security

The controller performs a risk assessment for each processing activity, applies appropriate technical and organizational measures, and periodically verifies their effectiveness, in compliance with the principles of:

• data minimization
• purpose limitation
• integrity and confidentiality
• storage limitation

You may periodically receive evaluation questionnaires to ensure transparency and accuracy in processing.

For any doubts or clarifications, you can contact us via the email address indicated in the section dedicated to the data controller.

Best regards,
The Data Controller