ATISoluciones Seguridad Privacy Policy

ATISoluciones Seguridad de Sistemas S.L.

At ATISoluciones Seguridad de Sistemas Electrónicos SL we care about privacy and transparency. We are also committed to processing your data in compliance with the data protection regulations in force:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Below we set out in detail the processing of personal data we carry out, together with all the related information.

Who is the controller of your data?

ATISoluciones Seguridad SL
B18896746
C/ Córdoba 2, Polígono Industrial ASEGRA, 18210 Peligros, Granada
958 999 284
administracion@atisoluciones.com

Contact details of the Data Protection Officer (DPO)

Altabir (Formacont SL)
B18955195
C/ Luis Amador 26, Centro de Negocios Cámara de Comercio de Granada, P.0 - Of.B
685 470 834
dpo@altabir.es

For what purpose do we process your personal data?

At ATISoluciones Seguridad SL we process the information provided by data subjects for different purposes. Each of the purposes is described below according to the processing carried out:

Processing of images for promotional purposes: we process the information provided by data subjects in order to capture, disseminate and assign images and/or video for promotional purposes for publication on the Internet (social networks, video platforms and websites), in the organisation's publications and in other media.
Processing of data of job applicants: we process the information provided by data subjects in order to manage the CVs received and carry out staff selection processes, interviews and other procedures necessary to find the best possible candidate for a given position.
Processing of client data: we process the information provided by data subjects in order to carry out the administrative, accounting and tax management of the services requested, as well as to send promotional communications about our products and services.
Processing of data of the parties involved in the protocol for the prevention of sexual and gender-based harassment: we process the information provided by data subjects in order to manage the protocol for the prevention of sexual and gender-based harassment; regulate the procedure, manage the complaint, and collect personal data and conduct interviews with the parties concerned.
Processing of potential clients and contacts: we process the information provided by data subjects in order to manage potential clients who have shown interest in our products and/or services, as well as other business contacts, and, where applicable, to send promotional communications, including by electronic means.
Processing of data of owners and tenants: carrying out the administrative management of the identification data of the owners' association (comunidad de propietarios) for access control to the property, in compliance with the obligations imposed by the Spanish Horizontal Property Act (LPH), and guaranteeing the exercise of their rights.
Processing of supplier data: we process the information provided by data subjects in order to carry out the tax, accounting and administrative management of suppliers, as well as their professional contact details.
Processing of user data for access control: we process the information provided by data subjects in order to keep the identification data of users with access to the client's premises, as well as of their personal vehicles.
Processing of video surveillance data (monitoring of work): monitoring and directing work activity using the controller's video surveillance systems.
Processing of video surveillance data (security): ensuring the security of people, property and premises using video surveillance systems.
Processing of video surveillance data from the client's premises: storage of the video surveillance data captured by the cameras installed at the client's premises, including their maintenance and the extraction of images if the client has contracted this service.
Processing of data of visitors to the premises: we process the information provided by data subjects in order to record and manage visits to the controller's premises.
Processing of newsletter subscriber data: we process the information provided by data subjects in order to send our newsletter and other promotional communications of interest to its subscribers.
Processing of staff data: we process the information provided by data subjects in order to carry out staff management; training; occupational risk prevention and health surveillance; preparation of payroll, social security and contributions; working-time recording; and, where applicable, workplace accidents.
Processing of data for the exercise of data subjects' rights: we process the information provided by data subjects in order to manage and respond to requests from data subjects exercising the rights established in the data protection regulations.

No automated decisions will be made on the basis of the data provided.

If you do not provide your personal data, we will be unable to fulfil the purposes described.

How long will we keep your data?

Each processing operation has its own retention period. We therefore indicate the retention period for each of the different processing operations we carry out at ATISoluciones Seguridad SL:

Processing of images for promotional purposes: The data will be kept for as long as the data subject does not request its erasure.
Processing of data of job applicants: Two years from the last interaction.
Processing of client data: The data will be kept for as long as the data subject does not request its erasure and, where applicable, for the years necessary to comply with legal obligations.
Processing of data of the parties involved in the protocol for the prevention of sexual and gender-based harassment: The data will be erased after two years, unless it needs to be kept to determine any liability that may arise from claims made by the persons concerned.
Processing of potential clients and contacts: The data will be kept for as long as the data subject does not request its erasure.
Processing of data of owners and tenants: The data will be kept for as long as the data subject owns a property or resides in the owners' association and for the limitation periods necessary to comply with tax, accounting, social security or civil regulations.
Processing of supplier data: The data will be kept for as long as the data subject does not request its erasure and, where applicable, for the years necessary to comply with legal obligations.
Processing of user data for access control: The identification data of users with access to the premises will be erased once the business relationship with the client has ended. Image data captured by the access control system will be erased within 30 calendar days, unless communicated to the State Security Forces and Corps or the courts.
Processing of video surveillance data (monitoring of work): The data will be kept for a maximum of 30 days, unless communicated to the Courts and Tribunals.
Processing of video surveillance data (security): The data will be kept for a maximum of 30 days, unless communicated to the Courts and Tribunals.
Processing of video surveillance data from the client's premises: The data will be kept for a maximum of 30 days, unless communicated to the Courts and Tribunals.
Processing of data of visitors to the premises: For four years or until the data subject requests its erasure.
Processing of newsletter subscriber data: The data will be kept for as long as the data subject does not request its erasure.
Processing of staff data: For as long as the employment relationship with the organisation continues and for the years necessary to comply with legal obligations.
Processing of data for the exercise of data subjects' rights: The data will be kept for the time necessary to resolve the requests and for at least three years to deal with any claims.

What is the legal basis for processing your data?

Each processing operation has a different legal basis. We therefore indicate the legal basis for each of the processing operations we carry out at ATISoluciones Seguridad SL:

Processing of images for promotional purposes: Consent of the data subject: Capture, dissemination and assignment of images and/or video for promotional purposes for publication on social networks, video platforms and websites, as well as in the organisation's publications and other media. (GDPR Art. 6.1.a).
Processing of data of job applicants: Performance of a contract or pre-contractual measures: Management of the CVs submitted by the applicant in order to carry out staff selection processes to find the best possible candidate for a given position. (GDPR Art. 6.1.b).
Processing of client data: Performance of a contract or pre-contractual measures: Tax, accounting and administrative management of clients. (GDPR Art. 6.1.b).
- Legitimate interest of the Controller: Sending promotional communications, including by electronic means. (GDPR Recital 47, LSSICE Art. 21.2).
Processing of data of the parties involved in the protocol for the prevention of sexual and gender-based harassment: Compliance with a legal obligation: Spanish Organic Law 3/2007 of 22 March on effective equality between women and men (Art. 48); Royal Decree 901/2020 of 13 October; Spanish Law 31/1995 of 8 November on the prevention of occupational risks (Art. 14).
Processing of potential clients and contacts: Performance of a contract or pre-contractual measures: Management of potential clients who have shown interest in our products and/or services. (GDPR Art. 6.1.b).
- Consent of the data subject: Sending promotional communications, including by electronic means. (GDPR Art. 6.1.a, LSSICE Art. 21).
- Legitimate interest of the Controller: Management of professional contact details (LOPDGDD Art. 19, GDPR Art. 6.1.f).
Processing of data of owners and tenants: Performance of a contract or pre-contractual measures: Administrative management of the data for the installation and maintenance of the access control system contracted by the client (GDPR Art. 6.1.b).
Processing of supplier data: Performance of a contract or pre-contractual measures: Carrying out the administrative, accounting and tax management of the services contracted. (GDPR Art. 6.1.b).
- Legitimate interest of the Controller: Management of professional contact details. (LOPDGDD Art. 19, GDPR Art. 6.1.f).
Processing of user data for access control: Performance of a contract or pre-contractual measures: Administrative management of the data for the installation and maintenance of the access control system contracted by the client (GDPR Art. 6.1.b).
Processing of video surveillance data (monitoring of work): Performance of a contract or pre-contractual measures: Royal Decree-Law 2/2015 approving the consolidated text of the Workers' Statute Act (Art. 20.3); Organic Law 3/2018 on the protection of personal data and guarantee of digital rights (Art. 89).
Processing of video surveillance data (security): Task carried out in the public interest: Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Art. 6.1.e), as stated in the "Guide on the use of video cameras for security and other purposes" published by the Spanish Data Protection Agency (AEPD).
Processing of video surveillance data from the client's premises: Task carried out in the public interest: Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR Art. 6.1.e), as stated in the "Guide on the use of video cameras for security and other purposes" published by the Spanish Data Protection Agency (AEPD).
- Performance of a contract or pre-contractual measures: Providing the installation and maintenance services contracted by the client (GDPR Art. 6.1.b).
Processing of data of visitors to the premises: Legitimate interest of the Controller: Control of entries to and exits from the controller's premises for security reasons and traceability of visits. (GDPR Art. 6.1.f).
Processing of newsletter subscriber data: Consent of the data subject: sending our newsletter and other promotional communications of interest to its subscribers (GDPR Art. 6.1.a, and LSSICE Art. 21).
Processing of staff data: Performance of a contract or pre-contractual measures: Staff management, training and skills development. (GDPR Art. 6.1.b).
- Compliance with a legal obligation: Occupational risk prevention and health surveillance; preparation of payroll, social security and contributions; working-time recording; management of workplace accidents, where applicable. (Law 31/1995 of 8 November on the Prevention of Occupational Risks; Royal Legislative Decree 2/2015 of 23 October approving the consolidated text of the Workers' Statute Act; Royal Legislative Decree 8/2015 of 30 October approving the consolidated text of the General Social Security Act; Royal Decree-Law 8/2019 of 8 March on urgent measures for social protection and to combat precariousness in working hours; GDPR Arts. 6.1.c and 9.2.b). Royal Decree 902/2020 of 13 October on equal pay for women and men.
- Consent of the data subject: Inclusion of employees in WhatsApp work groups (GDPR Art. 6.1.a).
Processing of data for the exercise of data subjects' rights: Compliance with a legal obligation: managing and responding to requests from data subjects exercising the rights established in the data protection regulations (GDPR Art. 6.1.c).

To which recipients will your data be disclosed?

Depending on the processing operation, data may be disclosed to other recipients. We therefore detail the disclosures of data for each of the processing operations we carry out at ATISoluciones Seguridad SL:

Processing of images for promotional purposes:
- The Internet (social networks, video platforms and websites), the organisation's website and other media, for the purpose of assigning and publishing images and/or video for promotional purposes.
Processing of data of job applicants: No data will be disclosed to third parties, except where required by law.
Processing of client data:
- Tax Authorities, in order to comply with legal obligations (legal requirement).
- Financial institutions, in order to issue the corresponding direct debits (contractual requirement).
Processing of data of the parties involved in the protocol for the prevention of sexual and gender-based harassment:
- State Security Forces and Corps, judicial bodies and the Public Prosecutor's Office, in order to report the possible commission of an offence (legal requirement).
Processing of potential clients and contacts: No data will be disclosed to third parties, except where required by law.
Processing of data of owners and tenants: No data will be disclosed to third parties, except where required by law.
Processing of supplier data:
- Tax Authorities, in order to comply with legal obligations (legal requirement).
- Financial institutions, in order to make the corresponding payments (contractual requirement).
Processing of user data for access control: No data will be disclosed to third parties, except where required by law.
Processing of video surveillance data (monitoring of work):
- Courts and Tribunals, to provide the images if a work-related offence has been committed (legal requirement).
Processing of video surveillance data (security):
- State Security Forces and Corps, as well as Courts and Tribunals, to provide the images if a criminal offence has been committed (legal requirement).
Processing of video surveillance data from the client's premises:
- State Security Forces and Corps, as well as Courts and Tribunals, to provide the images if the client has contracted the image extraction service and a criminal offence has been committed (contractual and legal requirement).
Processing of data of visitors to the premises: No data will be disclosed to third parties, except where required by law.
Processing of newsletter subscriber data: No data will be disclosed to third parties, except where required by law.
Processing of staff data:
- Tax Authorities, Social Security and the occupational accident insurance mutual (Mutua), in order to file taxes and comply with social security obligations (legal requirement).
- Banks and financial institutions, in order to pay salaries (contractual requirement).
- Spanish State Foundation for Training in Employment (Fundae), in order to manage training credits for employee training (contractual requirement).
Processing of data for the exercise of data subjects' rights:
- Supervisory authorities, public administration bodies and the Ombudsman, where applicable, in order to manage and respond to requests and any complaints (legal requirement).

Transfers of data to third countries

Depending on the processing operation, data may be transferred to third countries. We therefore list each of the processing operations we carry out at ATISoluciones Seguridad SL, indicating whether any data is transferred to third countries:

Processing of images for promotional purposes:
- Social networks and promotional dissemination systems, for the purpose of advertising the organisation's services. The safeguard for this transfer is the explicit consent of the data subject.
Processing of data of job applicants: No transfers of data to third countries are planned.
Processing of client data: No transfers of data to third countries are planned.
Processing of data of the parties involved in the protocol for the prevention of sexual and gender-based harassment: No transfers of data to third countries are planned.
Processing of potential clients and contacts: No transfers of data to third countries are planned.
Processing of data of owners and tenants: No transfers of data to third countries are planned.
Processing of supplier data: No transfers of data to third countries are planned.
Processing of user data for access control: No transfers of data to third countries are planned.
Processing of video surveillance data (monitoring of work): No transfers of data to third countries are planned.
Processing of video surveillance data (security): No transfers of data to third countries are planned.
Processing of video surveillance data from the client's premises: No transfers of data to third countries are planned.
Processing of data of visitors to the premises: No transfers of data to third countries are planned.
Processing of newsletter subscriber data: No transfers of data to third countries are planned.
Processing of staff data: No transfers of data to third countries are planned.
Processing of data for the exercise of data subjects' rights: No transfers of data to third countries are planned.

What are your rights when you provide us with your data?

Any person has the right to obtain confirmation as to whether or not we at ATISoluciones Seguridad SL are processing personal data concerning them.

Data subjects have the right to access their personal data and to request the rectification of inaccurate data or, where applicable, request its erasure where, among other reasons, the data is no longer necessary for the purposes for which it was collected. They also have the right to data portability.

In certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will only keep it for the exercise or defence of claims.

In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data. In this case, ATISoluciones Seguridad SL will stop processing the data, except for compelling legitimate grounds or the exercise or defence of possible claims.

You may exercise your rights as follows: by writing to dpo@altabir.es or C/ Luis Amador 26, Centro de Negocios Cámara de Comercio de Granada, P. 0 - Of. B.

Where commercial communications are sent on the legal basis of the controller's legitimate interest, the data subject may object to the processing of their data for that purpose.

If you have given your consent for a specific purpose, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

If you feel that your rights regarding the protection of your personal data have been infringed, especially if you have not obtained satisfaction in exercising your rights, you may lodge a complaint with the competent Data Protection Supervisory Authority through its website: www.aepd.es.

How did we obtain your data?

The personal data we process at ATISoluciones Seguridad SL comes from: The data subject themselves.