Data protection policy

WATA FACTORY, S.L. (hereinafter, WATA Factory) carries out activities that involve the processing of personal data and assumes responsibility for ensuring that such processing is lawful, transparent and secure.

This Data protection policy sets out the general principles that WATA Factory applies to the processing of personal data and the guidelines to be followed throughout the organisation.

It is applied in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) and other applicable legislation.

The purpose of this Policy is to establish a common framework to ensure the protection of the personal data processed by WATA Factory and to guarantee respect for the rights and freedoms of individuals.

WATA Factory applies an accountability-based approach, adopting the technical and organisational measures necessary to ensure, and to be able to demonstrate, that personal data is processed in accordance with applicable regulations.

Data protection is built into the organisation’s procedures, systems, products and services from the design stage and throughout their entire life cycle.

This approach is consistent with the concept of data protection by design and by default established by the GDPR and developed by the Spanish Data Protection Agency.

This Policy applies to WATA Factory, its directors, managers and employees, as well as to the people involved in personal data processing operations on behalf of the organisation.

It also applies, where relevant, to suppliers and third parties who have access to personal data on behalf of WATA Factory as data processors.

WATA Factory will process personal data in accordance with the principles established in data protection legislation and will be responsible for ensuring, and being able to demonstrate, compliance with them.

Personal data will be processed lawfully, fairly and transparently. All processing must have an appropriate legal basis, and the individuals concerned will receive the relevant information in a clear and accessible way.

Personal data will be collected for specified, explicit and legitimate purposes and will not be further processed in a manner that is incompatible with those purposes.

Only personal data that is adequate, relevant and necessary for the stated purposes will be processed.

Reasonable steps will be taken to keep personal data accurate and up to date and to rectify or erase any data that is inaccurate.

Personal data will be kept only for as long as necessary to fulfil the purposes for which it was collected and, afterwards, for the periods needed to meet legal obligations or possible liabilities.

Personal data will be processed using appropriate technical and organisational measures to protect it against unauthorised access or processing, and against accidental loss, destruction or damage.

These are the core principles set out in Article 5 of the GDPR. BOE

WATA Factory will take the measures necessary to ensure compliance with these principles and must be in a position to demonstrate it.

The measures will be determined taking into account the nature, scope, context and purpose of each processing activity, as well as the risks to the rights and freedoms of individuals.

When WATA Factory engages suppliers that need access to personal data in order to provide their services, it will select suppliers that offer sufficient guarantees of compliance with data protection legislation.

The relationship with these suppliers will be governed by the relevant data processing agreements where necessary.

Assessing the guarantees offered by processors and formalising these contracts are part of the compliance measures envisaged by the Spanish Data Protection Agency.

Where processing involves a transfer of personal data outside the European Economic Area, WATA Factory will ensure that the transfer is carried out in accordance with the mechanisms and safeguards established by applicable regulations.

WATA Factory will facilitate the exercise of the rights recognised by data protection legislation, including, where applicable, the rights of:

Internal procedures must make it possible to handle requests from the individuals concerned in accordance with the requirements and deadlines set by the regulations.

Specific information on how to exercise these rights is available in the Privacy policy.

WATA Factory will apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures will be determined taking into account, among other factors, the nature and scope of the processing, the context, the purposes, the state of the art and the risks that may affect the rights and freedoms of individuals.

The GDPR does not establish identical generic security for all processing, but measures appropriate to the risk. Spanish Data Protection Agency

People who work at WATA Factory and have access to personal data must know and comply with this Policy and the internal measures and procedures that apply to their duties.

In particular, they must:

The duty of confidentiality continues even after the relationship with WATA Factory has ended, as established by the LOPDGDD. BOE

WATA Factory will periodically review the technical and organisational measures in place to ensure they remain adequate and effective.

These measures will also be reviewed when there are significant changes in data processing, the systems used, the risks identified or the applicable regulations.

Where necessary, WATA Factory will carry out risk analyses and impact assessments and adopt any additional measures needed to ensure the protection of personal data.