VESNA RICHARDSON shall ensure that the personal data of the data subject collected on the website is processed in accordance with the principles relating to processing:

• Processed lawfully, fairly and transparently in relation to the data subject (‘lawfulness, fairness and transparency’).

• Collected for specified, explicit and legitimate purposes, and not further processed in a manner that is incompatible with those purposes (‘purpose limitation’).

• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’).

• Accurate and, where necessary, kept up to date by taking reasonable technical and organisational measures to ensure that they are deleted or rectified when they are inaccurate in relation to the purposes for which they are processed (‘accuracy’).

• Kept in a form which permits identification for no longer than is necessary for the purposes for which the data are processed (‘storage limitation’).

• Processed in such a way as to ensure adequate security through the implementation of appropriate technical or organisational measures (‘integrity and confidentiality’).

• VESNA RICHARDSON shall therefore be responsible for compliance with the above provisions and must be able to demonstrate this subsequently (‘proactive responsibility’).

Similarly, the processing carried out by the entity will only be lawful if it meets at least one of the following conditions (‘lawfulness of processing’):

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes; processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject; processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This legitimate basis shall not apply to processing carried out by public authorities in the exercise of their functions. Where processing is based on the data subject’s consent, the controller shall be able to demonstrate that the data subject consented to the processing of their personal data.

If the consent of the data subject is given in the context of a written statement that also refers to other matters, the request for consent shall be presented in such a way that it is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.

The data subject shall have the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Before giving their consent, the data subject shall be informed of this. Withdrawing consent shall be as easy as giving it.

VESNA RICHARDSON must include in the forms used for the collection of personal data the information required to comply with the duty to inform set out in Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR).

In this regard, and in order to comply with the applicable and current regulations on data protection, when VESNA RICHARDSON obtains personal data directly from a data subject, it must:

1. Provide the identity and contact details of the Data Controller and, where applicable, their representative, the contact details of the Data Protection Officer, where applicable, and the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing.
2. Specify the legitimate interests of the controller or a third party when the processing is necessary for the satisfaction of those interests. Provided that the interests or fundamental rights and freedoms of the data subject do not prevail over them.
3. Provide the recipients or categories of recipients of the personal data and, where applicable, the controller’s intention to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission.
4. Indicate the period for which the personal data will be stored or the criteria used to determine the storage period.
5. Inform of the existence of the right to request from the data controller access to personal data concerning the data subject, its rectification or erasure (‘right to be forgotten’), the restriction of its processing or the right to object to the processing, as well as the portability of their data.
6. Inform about the possibility of withdrawing consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. Also, inform them of the possibility of lodging a complaint with a Supervisory Authority.
7. Specify whether the communication of personal data is a legal or contractual requirement, or a requirement necessary to enter into a contract, and whether the data subject is obliged to provide the personal data and inform them of the possible consequences of not providing such data.
8. Inform about the existence of automated decisions, including profiling, and, at least in such cases, inform about the logic applied, as well as the significance and expected consequences of such processing for the data subject.

When VESNA RICHARDSON does not obtain the personal data from the data subject, it must provide the information described in the previous section. This includes the categories of personal data processed, the source from which they originate and, where applicable, whether they come from publicly accessible sources.

VESNA RICHARDSON shall include in the forms or documents used for the collection of personal data, including those established on the website owned by VESNA RICHARDSON, the information required to comply with the duty to inform set out in Articles 13 and 14 of the General Data Protection Regulation (hereinafter GDPR), and, where necessary, record the consent given by the data subject.

In order to make the greater requirement for information to be provided to the data subject whose personal data is to be processed compatible, the possibility of presenting the information using a layered or tiered information model is established, which must be in line with the requirement that the information be provided in clear, simple and concise language that is transparent, intelligible and easily accessible.

Article 11 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD) regulates the basic information required in the first layer.

Layered information consists of:

• Presentation of basic information (1st layer): consists of presenting basic information at a first level, in summary form, at the same time and in the same medium in which the data is collected.
• Reference to additional information (2nd layer): This consists of presenting detailed and comprehensive information in an appropriate, structured, concise and accurate manner. The way in which this additional information is presented depends on the characteristics of the medium used to report it; it may be presented in paper or electronic format.

4.1.2. Website privacy policy

PRIVACY POLICY OF WWW.IBIZASALES.COM

Website owner details:

COMPANY NAME: VESNA RICHARDSON

TAX ID NUMBER: X2961639K

DOMAIN: WWW.IBIZASALES.COM

POSTAL ADDRESS: GREGAL, 5, 07800 EIVISSA (BALEARIC ISLANDS)

EMAIL ADDRESS: [email protected]

TELEPHONE NUMBERS: 609960097

REGISTRATION NUMBER/ADDITIONAL INFORMATION

Data protection

In accordance with current and applicable regulations on personal data protection, we inform you that your data will be incorporated into the processing system owned by VESNA RICHARDSON with Tax Identification Number X2961639K and registered office at GREGAL, 5, 07800 EIVISSA (ILLES BALEARS). The following information is provided on the processing carried out:

PROCESSING PERFORMED

Web user management

Purpose: Collection, registration and processing of user data. Retention period: for as long as consent is given, unless otherwise required by law. Legitimate basis: The consent of the data subject. Type of data: Basic data: Name and surname(s), email address

Commercial actions web form

Purpose: Collection, registration and processing of data for the purpose of responding to your queries and/or requests, as well as for advertising and commercial prospecting. Retention period: for as long as consent is given, unless there is a legal obligation. Legitimate basis: The consent of the data subject. Type of data: Basic data: Name and surname(s), email address

Newsletter

Purpose: Management of newsletter subscriptions, to send out the corresponding newsletters. Retention period: for as long as consent is given. Legitimate basis: The consent of the data subject. Type of data: Basic data: Name and surname(s), email address

Cookie installation

Purpose: Management and installation of cookies. Retention period: for as long as consent is given. Legitimate basis: The consent of the data subject. Type of data: Basic data: Email address, IP address

Web form management

Purpose: To respond to your queries and/or requests. Retention period: for as long as consent is given.

Legitimate basis: The consent of the data subject. Type of data: Basic data: Name and surname(s), email address, IP address

We also inform you that you can contact the Data Protection Officer by writing to [email protected] or by calling 872 987 665.

Rights of data subjects

VESNA RICHARDSON informs Users that they may exercise their rights of access, rectification, restriction, erasure, portability, and objection to the processing of their personal data, as well as their right not to be subject to automated decisions, including profiling, before the Data Controller, and to withdraw their consent.

• Right of Access: This is the user’s right to obtain confirmation as to whether their data is being processed and, if so, the specific personal data being processed and the legal information regarding the processing (purposes, legal basis, retention periods, transfers, origin of the data, etc.).
• Right of Rectification: This is the right of the data subject to have inaccurate or incomplete data modified. In relation to the website, this right can only be satisfied in relation to information that is under the control of the website, for example, deleting comments posted on the page itself, images or web content containing the user’s personal data.
• Right to Restriction of Processing: This is the right to have the purposes of the processing originally envisaged by the data controller restricted in certain cases.
• Right to erasure: This is the right to erase the user’s personal data, except as provided for in the GDPR itself (freedom of expression and information, storage obligations, formulation, exercise or defence of claims, etc.).
• Right to portability: The right to receive the personal data that the user has provided, in a structured, commonly used and machine-readable format, and to transmit it to another controller when the processing is based on consent or on the performance of a contract and is carried out by automated means.
• Right to Object: The right of the user to prevent the processing of their personal data or to have the processing of their data by the website cease when the processing is based on legitimate interest or public interest or when it involves direct marketing.
• Right not to be subject to automated decisions, including profiling: When the processing is not necessary for the conclusion or performance of a contract, nor is it authorised by European Union or Member State law, nor is it based on consent, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you in a similar way.
• Right to withdraw consent: For any processing based on your consent, you have the right to withdraw it at any time and free of charge.

To exercise any of the data protection rights described above, you must follow these instructions:

• Submit a letter to GREGAL, 5, 07800 EIVISSA (ILLES BALEARS) (for the attention of VESNA RICHARDSON) or by email to [email protected].
• The letter sent by the owner of the personal data (data subject) requesting the exercise of their rights must take into account the following:
  o You must provide reliable identification and, in the event of any doubts regarding the identity of the applicant, you will be asked to rectify the request (e.g. by providing further information, such as your national identity card number, national identity card document, the email address you provided, etc.).
• o The request may be made by a legal or voluntary representative, provided that they are duly identified and authorised by the data subject (by means of express authorisation from the data subject to exercise the personal rights regulated in the regulations on personal data protection).
• o Request specifying the application (right(s) to be exercised). If no reference is made to a specific processing operation, a response will be provided in relation to all processing operations affecting your personal data. If you request information on a specific processing operation, only information on that operation will be provided. If you make your request by telephone, you will be asked to make it in writing and will be informed of how to do so and the address to which it should be sent. Information will never be provided over the telephone.
• o Postal or email address for notification purposes.
• o Supporting documents for the request, if necessary.
• o The applicant must use any means that allows for proof of the sending and receipt of the request. Finally, we inform you that you have the right to lodge a complaint with the Spanish Data Protection Agency if you become aware of or consider that a fact may constitute a breach of the applicable data protection regulations. VESNA RICHARDSON undertakes to adopt the necessary technical and organisational measures, in accordance with the level of risk associated with the processing carried out by them and indicated in this section, in order to guarantee its integrity, confidentiality and availability.