Privacy Policy

Data Protection Policy under the LOPD and RGPD

We inform you in accordance with the provisions of the GDPR of April 27, 2016 that MARÍA TERESA PINILLOS CORDÓN collects and processes your personal data, applying the technical and organizational measures that guarantee its confidentiality, in order to manage the relationship that binds you. You give your consent and authorization for such treatment. We will keep your personal data only for the time essential to manage our relationship. You may exercise the rights of access, rectification, deletion, limitation, portability and opposition by contacting MARÍA TERESA PINILLOS CORDÓN at C/ PARLAMENTO 2, VILLAMEDIANA DE IREGUA, 26142, LA RIOJA.

For more information about the security procedures of your data, or to cancel your subscription, contact us by sending an email to ventas@crystaldreams.es and by calling +34659898187

The contact information handled by each company belongs to individuals. Therefore, it is important to know that these individuals have a series of rights:

1. Right of access

   Right to access, to know what data you have, how your personal data has been obtained and to indicate whether said data has been transferred to other companies.

   Regarding the manner in which access should be facilitated, art. 15.3 and recital 63 indicate that a copy of the data being processed must be made available in a simple manner or with ease at reasonable intervals, so that the interested party can verify and know the lawfulness of the processing. Specific mention is made in said recital to health-related data included in clinical records, which must contain information on diagnoses, examination results, evaluations by physicians and any treatments or interventions carried out.

   This person may exercise this right in any way (an official document is not necessary); it is necessary that they submit a copy of their ID or identification document along with the application.

2. Right of rectification

   Right to correct/rectify the information you have about him/her if it is incorrect, with the need to prove that the data is erroneous.

   The right to rectification is regulated in Article 16 of the EU GDPR, as the right of the interested party to request from the data controller the rectification of their data when they are inaccurate. In response to this request, the controller must satisfy this right without undue delay. This right is included in identical terms in Recital (65).

   Taking into account the purposes for which the data have been processed, the interested party shall have the right to have personal data completed where they are incomplete, in particular by means of providing a statement.

3. Right to erasure or right to be forgotten

   The right to erasure, the right to be forgotten, is the name given by the Regulation to the traditional right of cancellation, which is regulated by the GDPR and its implementing Regulations.

   The right to be forgotten is presented as the consequence of the right that citizens have to request, and obtain from those responsible, that personal data be deleted when, among other cases, these are no longer necessary for the purpose for which they were collected, when consent has been withdrawn or when they have been collected illegally. It refers to the right to obtain, without undue delay from the data controller, the deletion of personal data concerning him or her when any of the following circumstances occur:

   • When personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
   • When the interested party withdraws the consent on which the treatment is based and this is not based on another legal basis.
   • When the interested party objects to the processing and no other legitimate reasons for the processing prevail.
   • When personal data has been processed unlawfully.
   • When personal data must be erased for compliance with a legal obligation established in Union or Member State law to which the data controller is subject.
   • When personal data has been obtained in relation to the offer of information society services directed at minors.

   The data controller shall be obliged to delete personal data without undue delay if a request for a right to deletion is made in the circumstances specified in the GDPR.

   It is not considered an autonomous right or one that is separate from the classic ARCO rights, but rather the consequence of the application of the right to erase personal data.

   • Those responsible for currently applying this jurisprudence do not have to introduce any changes to their practices.
   • Controllers who have made personal data public shall take technical measures to inform other controllers of the data subject's request to erase his or her personal information.

4. Right to object

   The right to object, we can say that it is the right of the interested party to oppose, at any time, for reasons related to his or her particular situation, that personal data concerning him or her be subject to processing.

   In the event of exercising the right to object, the data controller will stop processing the personal data. However, this is not an absolute right of the interested party, so in some cases a weighting will be required in order to determine whether the interested party's right prevails or not.

   If the interested party objects to the processing of personal data for direct marketing purposes, the personal data will no longer be processed for such purposes. Therefore, in these cases, no consideration will be required.

5. Right to limitation

   The right to limit the processing of personal data is another of the new rights included in the GDPR as a right of the interested party that may be requested from the data controller.

   The GDPR, in its definitions, includes the limitation of processing: “the marking of stored personal data with the aim of limiting their processing in the future”. This is a precautionary measure that reduces the processing of personal data to storage.

   This means that, at the request of the interested party, the processing operations that would apply in each case will not be applied to his or her personal data.

   Limitation of processing is a right of interested parties that should not be confused with data blocking, which exists in Spanish legislation.

   The same time periods and procedures apply to this right as to the other rights provided for in the GDPR.

   As a consequence of this regulation, the common practice of deleting data when exercising other rights, such as the right to access, is prevented, since it would prevent the exercise of the right to limit processing.

   The cases in which the interested party will have the right to obtain from the data controller the limitation of data processing are assessed by the law and are:

   • When the interested party challenges the accuracy of the personal data, for a period that enables the controller to verify the accuracy of the same.
   • When the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use.
   • When the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims.
   • When the interested party has opposed the treatment by exercising his right to object, while verifying whether the legitimate reasons of the controller prevail over those of the interested party.

   During the duration of the limitation, the controller may only process the affected data , beyond its conservation:

   • With the consent of the interested party
   • For the formulation, exercise or defense of claims
   • To protect the rights of another natural or legal person
   • For reasons of important public interest of the Union or of the Member State concerned

   The right to restriction of processing modifies, in a certain way, the right to object, for which, in many cases, the data has not been collected with your consent (there may be a legitimate or public interest) or the data processing is carried out for advertising purposes).

6. Portability

   The right to portability is one of the new rights regulated by the GDPR, as an autonomous and independent right, although some authors have seen it as a mere concretization of the principle of consent and it has been seen as an advanced form of the right of access, as the AEPD itself points out.

   This right further strengthens the data subject's control over his or her own data. In order to achieve greater effectiveness, controllers will be encouraged to create interoperable formats that allow data portability.

   The right to data portability implies that the personal data of the interested party are transmitted directly from one controller to another , without the need for them to be transmitted first to the interested party, provided that this is technically feasible. It is an advanced form of the right of access whereby the copy provided to the interested party must be offered in a structured, commonly used and machine-readable format . In other words, it is a “kind of freezing of the data” while certain circumstances of the same are verified and the responsible party cannot cancel or process said data.

   This possibility that we will have to be able to “download all our information” and take it to another platform to be able to continue with our digital life or even, the obligation of the person responsible so that not only the possibility of downloading is given but it is directly transmitted between platforms without the person responsible for the platform being able to refuse it. This right can only be exercised:

   • When technically possible.
   • When the treatment is carried out by automated means
   • When the treatment is based on consent or a contract
   • When the interested party requests it regarding the data that he has provided to the controller and that concerns him, including data derived from the interested party's own activity

   The deadline for exercising rights under the data protection regulation is one month from receipt of the request.

   This period may be extended by a further two months if necessary, taking into account the complexity and number of requests. The controller must inform the data subject of any such extension within one month of receipt of the request, stating the reasons for the delay.