DATA CONTROLLER

Gili Group 98 S.L., with Tax ID (CIF) B25247313, registered office at Ctra. Balaguer-Agramunt, Km. 7.3, 25616, Montgai (Lleida), telephone 973 430 129 and email giligroup@giligroup.com

PURPOSE

Processing Activity Purpose Legal Basis Recipients Retention Period
Contact and Enquiry Management To respond to requests for information, enquiries or incidents submitted via forms, email or telephone. Art. 6(1)(b) GDPR (pre-contractual measures) and, where applicable, Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). No disclosures are expected unless required by law. For the time necessary to respond to the enquiry and thereafter for the applicable statutory limitation periods.
Customer Management To manage the contractual relationship, provide services, issue invoices and offer customer support. Art. 6(1)(b) GDPR (performance of a contract). Public authorities, financial institutions and professional advisers where necessary or legally required. For the duration of the contractual relationship and thereafter for the applicable statutory retention periods.
User/Customer Registration and Access To manage user registration, authentication, access to the private area and account administration. Art. 6(1)(b) GDPR (performance of a contract). No disclosures are expected except where required by law or to technology service providers acting as data processors. While the account remains active and, after its deletion, for the applicable statutory retention periods.
Technical Support To manage technical incidents, maintenance and user assistance. Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest). Technology service providers acting as data processors. For the time necessary to resolve the incident and for the corresponding legal retention periods.
Recruitment To manage recruitment processes and assess job applications. Art. 6(1)(b) GDPR (pre-contractual measures) and consent where applicable. No disclosures are expected unless required by law. During the recruitment process and, if authorised by the applicant, for up to two years for future recruitment opportunities.
Marketing Communications To send information about products, services, news or events. Consent (Art. 6(1)(a) GDPR) or legitimate interest where permitted by applicable law. No disclosures are expected except where required by law or to electronic communication service providers. Until consent is withdrawn or the right to object is exercised.
Compliance with Legal Obligations To comply with tax, accounting, administrative and other legal obligations. Art. 6(1)(c) GDPR (compliance with a legal obligation). Public authorities, courts and competent authorities. For the periods established by the applicable legislation.
Information Security To ensure the security of systems, prevent unauthorised access and manage security incidents. Art. 6(1)(f) GDPR (legitimate interest) and, where applicable, compliance with a legal obligation. Law enforcement authorities, competent authorities and technology service providers where necessary. For the time strictly necessary to fulfil the purpose and for the applicable statutory limitation periods.
Supplier Management To manage contractual relationships with suppliers and business partners. Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation). Financial institutions, professional advisers and public authorities where applicable. For the duration of the contractual relationship and the applicable statutory retention periods.
Data Subject Rights Management To process requests for access, rectification, erasure, objection, restriction of processing and data portability. Art. 6(1)(c) GDPR (compliance with a legal obligation). Supervisory authorities where necessary. For the time necessary to process the request and for the applicable statutory limitation periods.

LAWFUL BASIS

The legal basis for processing your data is the performance of the business relationship between the data subject and the data controller, and this personal information will be kept for as long as the business/contractual relationship is maintained or for the time strictly necessary to comply with legal obligations.

RETENTION PERIOD

The data provided will be kept for as long as the business relationship is maintained or for the years necessary to comply with legal obligations.

RECIPIENTS

For the duration of the data subject’s processing, Gili Group 98 S.L. will not disclose the data to third parties unless there is a legal obligation to do so.

In cases where, for the performance of administrative, tax, accounting and/or commercial processing, third-party services are duly engaged, the mandatory data processing agreement will be duly formalised to guarantee the security and confidentiality of the data subject’s data vis-à-vis third parties.

RIGHTS

Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where applicable, to request erasure when, among other reasons, the data is no longer necessary for the purpose for which it was collected, as well as to withdraw the consent given. You may also exercise your right to restriction of processing, meaning your data will not be deleted, but its processing will be subject to limitations.

The rights to data portability and automated decision-making do not apply in this case due to the type of data and how it is processed.