Personal data processing, TRACEA

Processing of personal data supplied by the TRACEA application

Who is responsible for processing your data?

Business name: PAPELERA GUIPUZCOANA DE ZICUÑAGA, S.A.U.

Address: Barrio de Zicuñaga s/n 20120 HERNANI (GUIPUZCOA)

Tel.: 943.55.11.00

Email: protecciondatos@iberpapel.es

What is the purpose of personal data processing?

The TRACEA application has been developed for the sole purpose of allowing full traceability of all the materials we use in paper manufacturing. After the User logs in at the start of the transport route from the supplier to our plants, the User will be asked to take photographs of load status. The location coordinates will be linked to the image using the geolocation technology installed in the device in which TRACEA is downloaded.

NO PERSONAL DATA CONTAINED IN THE DEVICE in which TRACEA is installed will be accessed and it will not be necessary for the session to remain open outside working hours or following delivery of the materials to the destination.

EACH USER WILL BE RESPONSIBLE FOR LOGGING IN WHEN TRANSPORTATION BEGINS AND LOGGING OUT WHEN IT IS COMPLETED.

The only purpose of this tool is to document the route followed by the raw material from source to our plants, regardless of whether or not the data collected through TRACEA are used by third parties, as a result of any assignments that may be made, for purposes and processing in which IBERPAPEL is not the Data Controller.

The data will be kept for the period of time stipulated in prevailing legislation and in our data policy or until the rights of erasure, cancellation or objection are exercised, provide the data need not be kept to fulfil legal obligations and notwithstanding the obligation to observe legally stipulated limitation periods.

What is our legal standing for data processing?

The processing of data furnished through TRACEA requires the express consent of the data subject and is necessary to satisfy the Data Controller’s legitimate interests.

The refusal to provide any personal data deemed to be mandatory or the prevention of access to geolocation data during the provision of the service, in the terms stipulated, could be a breach of contractual conditions with third parties.

Which recipients will be provided with the data?

The only recipient of the data processed for the aforementioned purpose is the Data Controller, although the latter may contract companies specialised in activities such as warehousing, reporting, data destruction and erasure, and external IT services, which could have access to these data.

The Data Controller may communicate the personal data obtained to other Group companies so as to centralise administrative and IT processes. The data may also be communicated to auditors, lawyers, insurance companies, accounting firms and other external consultants and providers of products or services.

We continue to apply strict criteria when selecting third-party service providers in order to fulfil our data protection obligations and we pledge to enter into a data-processing agreement with each supplier.

Moreover, in the context of the provision of material transport services to which the use of TRACEA is connected, it may be necessary to assign data to third parties such as insurance companies, the Directorate General for Traffic (DGT), companies engaged in security services on public and/or private roads, national or regional law enforcement bodies, or courts and tribunals, as well as other third parties where legally stipulated or in order to file claims for breach of contract, including claims against the natural or legal persons with whom the goods transport services have been contracted or subcontracted. Such assignments may reflect the interests of both the data subject and the Data Controller.

It is understood that the user, on giving consent to this data processing, also consents to any such assignments that may be made, if applicable, due to forming part of the processing activity to which consent is given. Should other processing activities be undertaken that require the user’s express consent, this will be obtained on a timely basis.

The international assignment of personal data is not envisaged in any event.

What are your rights when providing your data?

Data subjects may exercise the following rights:

• Access to their personal data;
• Rectification of inaccurate data;
• Erasure when the data are no longer required, among other reasons;
• Objection, in which case we will stop processing the data, save for pressing, legitimate reasons or to initiate or defend against possible claims;
• Restriction of processing, on certain occasions, in which case we will only keep the data to initiate or defend against claims;
• Revocation or withdrawal of consent given at any time, without affecting the lawfulness of processing based on consent prior to withdrawal;
• Not to be subject to automated decisions;
• Portability of data to other data controllers, in which case we will keep them to initiate or defend against possible claims.

In accordance with prevailing legislation, these rights may be exercised by sending an email or letter to the address first above written. A copy of your national identity card or other identity document must be attached.

A response must be given to the exercise of these rights within one month as from receipt of the message.

Further information on these rights may also be obtained or a claim may be brought (particularly when the data subject considers that his or her rights have not been observed) at the Spanish Data Protection Agency. The necessary information may be found at: www.aepd.es

How did we obtain the data?

The personal data processed was gathered by using the information provided by the user in the TRACEA login process and the data sent automatically by the geolocation technology included in your device along the transport route.

The following personal data categories are processed:

• Identification data: The driver’s name, email address and telephone number, the vehicle’s registration number and the IP address associated with the device from which application login takes place.
• Geolocation coordinates;
• No data subject to special protection are processed.

Where can I find additional information?

Additional information may be obtained at protecciondatos@iberpapel.es.

Basic information on personal data protection