Privacy Policy

Introduction

This Privacy Policy sets out the guidelines governing the collection and processing of personal data by S22 DIGITAL SL (hereinafter, “S22 DIGITAL”) in connection with the provision of its professional services (hereinafter, individually or jointly, the “S22 Digital Services”).

S22 DIGITAL guarantees that any collection and processing of personal data it carries out will comply at all times with the applicable personal data protection legislation.

S22 DIGITAL’s official website is: https://www.s22digital.com.

Purpose

The purpose of this Privacy Policy is (i) to inform the Data Subject, fully, clearly, appropriately and concisely, about the data collected by S22 DIGITAL concerning them, the reasons for collecting such data, any possible disclosures to third parties and the conditions under which such disclosures may take place; (ii) to communicate and explain to the Data Subject how and for what purposes their data are processed; and (iii) to explain the rights and options available to the Data Subject in relation to the personal data that we collect and process about them and how S22 DIGITAL protects their privacy.

S22 DIGITAL strictly complies with privacy and data protection legislation, in particular Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (hereinafter, the “LSSICE”), and any associated legislation or legislation replacing or amending the foregoing.

Throughout this Privacy Policy, the following expressions shall have the meanings set out below:

• “Cookie”: shall have the meaning assigned to it from time to time in our Cookies Policy.
• “Processor”: the natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller.
• “Data Subject”: any identified or identifiable natural person who accesses the S22 DIGITAL Professional Services.
• “Direct Marketing”: any form of sale, advertising or promotion, through any Communication Channel, addressed to individual persons whose personal data are processed in order to communicate advertising and/or promotional messages concerning the S22 DIGITAL Services, even where no particular product or service is offered.
• “Information Society Service”: any information society service, whether or not provided for remuneration, supplied at a distance, by electronic means and at the individual request of a recipient of services.
• “Third Party/Parties”: companies outside S22 DIGITAL, as well as companies that collaborate with and/or are partly owned by—but are not controlled by—S22 DIGITAL.
• “Communication Channel(s)”: any digital or non-digital form or means of communication expressly or tacitly authorised by the Data Subject, as applicable, through which information about the S22 DIGITAL Services is communicated to them.

This Privacy Policy applies to all Data Subjects who access the S22 DIGITAL Services.

Controller

S22 DIGITAL, a Spanish company with tax identification number B87951232 and registered with the Madrid Commercial Registry, is the company responsible for the personal data collected from Data Subjects through their access to and interaction with the S22 DIGITAL Services and, specifically, for the processing of personal data through this website and its subdomains.

S22 DIGITAL has appointed a Data Protection Officer (“DPO”). Data Subjects and the relevant supervisory authority may contact the DPO at elvira@s22digital.com in order to raise or discuss any matter concerning S22 DIGITAL’s collection and processing of data.

Data Subjects may also send questions, suggestions or complaints to elvira@s22digital.com and, where appropriate, lodge a complaint with the Spanish Data Protection Agency.

Purposes and legal basis for processing personal data

The purposes for which S22 DIGITAL collects and processes your data as a Data Subject, together with the legal basis that legitimises the processing for each purpose, are set out below:

1. Managing and controlling the Data Subject’s registration in connection with the S22 DIGITAL Services and any requests, subscriptions or other contracts entered into by the Data Subject in relation to the Services, in accordance with this Privacy Policy and the terms and conditions applicable in each case. The legal basis for this purpose of processing personal data is the performance of the contract or non-contractual relationship to which the Data Subject is a party, namely the maintenance, performance, development, monitoring and execution of the contractual or business relationship established between the Data Subject and S22 DIGITAL.
2. Sending commercial communications: sending commercial communications, by any means, including electronic means, concerning S22 DIGITAL Services similar to those previously contracted by the Data Subject. The legal basis for this purpose of processing personal data is S22 DIGITAL’s legitimate interest.

Rights of Data Subjects

Any Data Subject may exercise the rights granted to them by European and/or national legislation in relation to their personal data, in particular:

• Right of access: the right to be informed about the personal data concerning you that we process;
• Right to rectification: the right to ask us to correct or update your personal data when they are inaccurate or incomplete;
• Right to erasure: the right to ask us to delete your personal data;
• Right to restriction: the right to ask us to stop processing all or some of your personal data temporarily or permanently;
• Right to object: your right (i) to object at any time, on grounds relating to your particular situation, to the processing of your personal data; and/or (ii) to object to the processing of your personal data for Direct Marketing purposes;
• Right to data portability: the Data Subject’s right (i) to request an electronic copy, in an electronic format, of their personal data that are processed by automated means and (ii) to ask us to transmit those data to a Third Party that will become the new Controller;
• Right not to be subject to automated decision-making: the Data Subject’s right not to be subject to decisions based solely on automated processing, including profiling, where the decision may have legal effects concerning them or similarly significantly affect them.

Where the collection and processing of your data are based on your consent, you may withdraw it under the same conditions in which it was given, either (i) through the commercial communications associated with the S22 DIGITAL Services that you receive or (ii) by sending an email to elvira@s22digital.com. Any withdrawal of consent will not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

Any Data Subject may exercise any of their other rights either (i) by sending reliable written notice to the Controller’s postal address, addressed to the S22 DIGITAL Data Protection Officer, or (ii) by contacting the DPO at elvira@s22digital.com from the email address used when registering or, if no email registration took place, from any other email address. In all cases, the Data Subject must provide proof of their full identity—or that of the person legally representing them and the person represented—by means of a valid national identity document or equivalent document and specify the right or rights they wish to exercise. We recommend that the Data Subject provide all available information about the S22 DIGITAL Services that they use or have used and the personal data they supplied, so that we can properly process their request.

Minors

S22 DIGITAL does not collect or process data relating to children under the age of 14 obtained through the S22 DIGITAL Professional Services. Persons under the age of 16 must not register or provide data in connection with the S22 DIGITAL Services unless they have the express and verifiable consent of their parents, guardians or holders of parental responsibility.

Retention of personal data

S22 DIGITAL will actively retain and process personal data only for the period strictly necessary for the purposes for which they were collected and while the consent granted by the Data Subject has not been withdrawn, a legitimate interest continues to exist, and none of the rights provided for in the applicable data protection legislation and described in this Privacy Policy has been exercised.

Once your relationship with the S22 DIGITAL Services has ended, we may also retain your data in order to comply with a legal obligation to which we are subject, perform a task carried out in the public interest or exercise official authority vested in us, perform a contract, address any potential liabilities arising from the processing relationship during the applicable statutory period, or bring or defend legal and/or administrative proceedings, as applicable, all in accordance with the terms and conditions of the data protection legislation in force.

Third parties and recipients of the data

Under no circumstances will personal data collected and processed by S22 DIGITAL be disclosed to Third Parties without the Data Subject’s prior consent, except where required by law.

Notwithstanding the foregoing, there are cases in which S22 DIGITAL will communicate the information provided to us to companies that provide services to us in their capacity as Processors, such as cloud hosting providers (cloud computing), payment gateway and/or payment service providers, or other suppliers. S22 DIGITAL will ensure that those Processors comply with personal data protection legislation and with the terms and conditions under which the data were collected.

Except as indicated in this Policy, S22 DIGITAL does not transfer data to Third Parties or Processors located in third countries outside the European Union or to international organisations.

On certain occasions, Information Society Services are provided by Third-Party companies that operate social networks and/or online data-hosting platforms and whose processing of personal data is governed by their own privacy or data protection policies. S22 DIGITAL recommends that Data Subjects read those entities’ privacy or data protection policies before registering with them and/or providing them with information. If the Data Subject does not agree with those policies, we recommend that they do not register.

Changes to the Privacy Policy

S22 DIGITAL may periodically develop and implement new and/or additional products or services. Any change in the type of personal data collected or in how Data Subjects’ personal data are collected and processed as a result of implementing such new or additional products and/or services will be duly communicated by S22 DIGITAL to the Data Subjects. S22 DIGITAL will make any corresponding changes, particularly to its Privacy Policy, in order to comply with the personal data protection legislation in force.

S22 DIGITAL therefore reserves the right to amend this Privacy Policy at any time. The version in force at any given time, as determined by its publication, shall apply.

Data Subjects are advised to review our Privacy Policy periodically.

Interpretation of language versions

The different language versions of this Privacy Policy are intended to make the S22 DIGITAL Privacy Policy easier for users to access and understand. However, in the event of any discrepancy or question of interpretation between the different language versions, the Spanish-language Privacy Policy shall prevail.

Governing law

This Privacy Policy is governed by Spanish law, irrespective of the language version used and whether or not the place where the service is provided is Spain.

Terms and conditions

Where the full or partial performance of the services covered by this contract is entrusted by S22 DIGITAL to a contractor for the performance of a contract issued by a third-party legal entity (the principal entity), and that entity applies any discount, penalty or financial reduction arising from the quality, compliance or service level provided, S22 DIGITAL shall be entitled to pass that discount on proportionally to the contractor or collaborator responsible, increasing the resulting amount by up to a maximum of ten per cent (10%) of the affected amount as compensation for the management, supervision and costs associated with correcting the identified non-compliance or deficiency. The invoice shall remain on hold until an execution report has been issued by the principal entity.

Submitting an invoice through the online supplier-management system constitutes acceptance of these terms and conditions.