Data Protection Rights

INFORMATION AND FORMS FOR THE EXERCISE OF DATA PROTECTION RIGHTS

Data protection regulations include a series of rights that all individuals may exercise. Carboneras de Electricidad, S.L.U, in order to facilitate their exercise, informs you of the different rights, their content, procedures, deadlines, and provides the templates you may use when exercising them.

Common to all rights:

• Their exercise is free of charge, unless the requests are manifestly unfounded or excessive
• Requests must be answered within one month, although, considering the complexity and number of requests, the deadline may be extended by a further two months
• In all our clauses and Records of Activities we indicate the means to exercise these rights
• You may exercise the rights directly or through your legal or voluntary representative (voluntary representation template)
• The processor may respond to your request on behalf of the controller, if both have agreed so in the contract or legal act that binds them
• As a general rule, the minimum age to exercise rights is fourteen, although for matters such as health it is sixteen
• Regarding deceased persons, those linked to the deceased by family or factual ties, as well as heirs, may exercise rights of access, rectification and erasure, unless the deceased had expressly prohibited it or a law provides otherwise

How do I exercise data protection rights?

• Written request to the controller, Carboneras de Electricidad, S.L.U (forms can be found below) by any legally accepted means
• Identification (copy of ID card or passport or other valid document to identify the person)
• If acting through a representative, copy of the representation and representative’s identification (copy of ID card or passport or other valid identification document)
• Right being exercised, and as much detail as possible in your request
• Address for notifications, date and signature
• Documents (if necessary) justifying the exercise of rights

Content of the Rights:

Right of Access

This means that any person has the right to contact Carboneras de Electricidad, S.L.U to know, first of all, whether or not we are processing their personal data and, if so, to obtain the following information:

• A copy of their personal data being processed
• The purposes for which we are processing their data
• The recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients in third countries or international organizations
• The envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• The existence of the right to request rectification or erasure of personal data, restriction of processing or to object to such processing
• The right to lodge a complaint with the Spanish Data Protection Agency
• Where the data were not obtained directly from the data subject, the source of the data
• Whether there are automated decisions, including profiling, and meaningful information about the logic involved, as well as the significance and consequences of such processing
• When data are transferred to a third country or international organization, you will be informed of the appropriate safeguards relating to the transfer

The right of access includes providing a copy of the personal data undergoing processing; however, if more than one copy is requested, a reasonable fee based on administrative costs may be charged. This right to obtain a copy shall not adversely affect the rights and freedoms of others.

Access Right Form

Right of Rectification

This means that any person whose data are processed by Carboneras de Electricidad, S.L.U may obtain the rectification of their data. In the request, you must indicate the data to be rectified, and where necessary, provide documentation justifying their inaccuracy or incompleteness. Rectification must be carried out without undue delay and within one month at the latest.

Rectification Right Form

Right of Erasure (Right to be Forgotten)

Any person whose data are processed by Carboneras de Electricidad, S.L.U may exercise this right whenever these circumstances apply:

• If the personal data are no longer necessary for the purposes for which they were collected or otherwise processed
• If the processing of personal data was based on consent, and that consent is withdrawn, with no other legal basis to justify it
• If the right to object has been exercised and was based on refusal to process the data for direct marketing purposes, or was based on legitimate interest or performance of a task carried out in the public interest
• If the processing of personal data was unlawful
• If personal data must be erased for compliance with a legal obligation under Union or Member State law
• If the data were collected in connection with the offer of information society services, as covered by the General Data Protection Regulation

As with all rights, it is not unlimited, and this right has the following restrictions: in exercising freedom of expression and information, to comply with a legal obligation, to carry out a task in the public interest or exercise official authority vested in the controller, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defense of legal claims.

Erasure Right Form (Right to be Forgotten)

Right to Object

This means that individuals whose personal data are processed by Carboneras de Electricidad, S.L.U may object to such processing in two cases:

• When the processing is based on a task carried out in the public interest or on legitimate interest, including profiling. This right shall be upheld unless compelling legitimate grounds are demonstrated which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.
• When the processing is carried out for direct marketing purposes, including profiling. Once this right is upheld, personal data will no longer be processed for this purpose.

Objection Right Form

Right to Restrict Processing

This may be exercised by individuals whose data are processed by Carboneras de Electricidad, S.L.U, in two ways:

• Request suspension of processing of your data:
  a) When the accuracy of the data has been contested, for the period necessary to verify them.
  b) When the right to object has been exercised based on legitimate interest or public interest, while it is verified whether it applies or not.
• Request retention of your data:
  a) When processing is unlawful and you oppose erasure of the data, requesting restriction instead.
  b) When the data are no longer needed for the purpose of processing, but the data subject needs them for the establishment, exercise or defense of legal claims.

The fact that processing of personal data is restricted must be clearly indicated in the information systems of Carboneras de Electricidad, S.L.U

Restriction of Processing Right Form

Right to Data Portability

Where technically feasible, any person whose data are processed by Carboneras de Electricidad, S.L.U, based on consent or in the framework of a contract, may request, provided that processing is carried out by automated means, that the data be transmitted to them or to the new controller, in a structured, commonly used, machine-readable and interoperable format. This right does not apply where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Data Portability Right Form

Right not to be subject to automated individual decision-making

Any person whose data are processed by Carboneras de Electricidad, S.L.U has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them, unless provided for by law, in which case counterbalancing measures will be established. Consent may also be given for such processing, or it may be necessary for the performance of a contract, but in these two cases, you may request human intervention, express your point of view and challenge the decision.

Form Right not to be subject to automated individual decision-making