In accordance with the provisions of the applicable legislation on the protection of personal data, the User is informed of the following:
1. THE DATA CONTROLLER
COMPAÑÍA ESPAÑOLA DE PETRÓLEOS, S.A. (CEPSA) (hereafter Cepsa).
Tax ID Number: A28003119. Registered Office: Paseo de la Castellana 259 A, 28046 Madrid, Spain.
Data Protection Officer contact details: dpo@cepsa.com
2. PURPOSE OF PERSONAL DATA PROCESSING
Personal data provided via the website shall be incorporated into processing records owned by Cepsa or the companies that comprise the Cepsa Group, which can be checked on www.cepsa.com with the following purposes:
Purpose 1: User management
- Data processed for this purpose: Identification and contact data (such as name, last name, and e-mail) provided by the User when registering as a User on the Website.
- Description of the purpose: Manage the Users of the Website and, where appropriate, the activation and administration of the registration as a User in the reserved area of the Website.
- Basis of legitimacy: The processing is necessary for the maintenance of the existing contractual relationship between Cepsa and the User.
Purpose 2: Provision of Web Site Services
- Data processed for this purpose: Identification and contact data (such as name, last name, and e-mail) provided by the User when registering as a User of the Website.
- Description of the purpose: To provide the services included on the website and/or the information requested, either via the website, email or telephone. Phone calls may be recorded for the purpose of guaranteeing the quality of the service. Emails may register confirmation of receipt and reading.
- Basis of legitimacy: The processing is necessary for the maintenance of the existing contractual relationship between Cepsa and the User.
Purpose 3: To manage the contractual relationship with Users.
- Data processed for this purpose: Identification and contact data (such as name, surname, and e-mail) provided by the User when registering as a customer.
- Description of the purpose: To manage the contractual or commercial relationship established between Cepsa and the User.
- Basis of legitimacy: The processing is necessary for the maintenance of the existing contractual relationship between Cepsa and the User.
Purpose 4: Incident management.
- Data processed for this purpose: Identification and contact data (such as name, last name, and e-mail address) provided by the User.
- Description of the purpose: To deal with any incidents that may arise in connection with the use of the Web Site.
- Basis of legitimacy: The processing is based on the legitimate interest of CEPSA, consisting of pursuing a correct development of the Website, avoiding the occurrence of illicit, fraudulent or harmful practices to its own interests or those of a third party.
Purpose 5: Query management.
- Data processed for this purpose: Identification and contact data (such as name, last name, and e-mail address) provided by the User.
- Description of the purpose: Manage the queries made by users through the contact forms implemented for this purpose in the web portal.
- Basis of legitimacy: The treatment is based on the consent given by the User by means of the clear affirmative action that involves sending the query through the form prepared for this purpose.
Purpose 6: Manage queries regarding job opportunities.
- Data processed for this purpose: Identification and contact data (such as name, last name, e-mail address and country of residence) provided by the User.
- Description of the purpose: Manage queries regarding employment opportunities in CEPSA, made by users through the contact forms implemented for this purpose in the web portal.
- Basis of legitimacy: The treatment is based on the consent given by the User by means of the clear affirmative action that involves sending the query through the form prepared for this purpose.
Purpose 7: Ethics channel management.
- Data processed for this purpose: Identification and contact data (such as name, last name, e-mail address and telephone number) provided by the User.
- Description of the purpose: Manage queries regarding CEPSA's corporate ethics channel made by users through the contact forms implemented for this purpose on the web portal.
- Basis of legitimacy: The treatment is based on the consent given by the User by means of the clear affirmative action that involves sending the query through the form prepared for this purpose.
Purpose 8: Send news alerts on the Website.
- Data processed for this purpose: Identification and contact data (IP address of the terminal used for the connection) collected by means of information retrieval systems (Cookies).
- Description of the purpose: In those cases in which the User subscribes, to send alerts of new content published on the Website.
- Basis of legitimacy: The treatment is based on the consent given by the User by means of the clear affirmative action that involves sending the query through the form prepared for this purpose.
Purpose 9: Implement cookies.
- Data processed for this purpose: Identification and contact data (IP address of the terminal used for the connection) collected by means of information retrieval systems (Cookies).
- Description of the purpose: Install those tracking systems that report on browsing habits or Cookies accepted by the interested party, as indicated in the Cookies Policy of this Website.
- Basis of legitimacy: The processing is based on the consent given by the User.
In each process where the User provides his/her personal data, he/she shall be informed of the mandatory or optional nature of their completion and the consequences of not providing them.
3. ORIGIN OF THE PERSONAL DATA
The personal data of an identifying and contact nature that Cepsa will process, including name, last name, e-mail address, etc., have been provided mostly directly by the User himself/herself through forms. Users are responsible for the accuracy of the data and for updating it.
Likewise, Cepsa may obtain information collected through the web, such as statistical or navigation data.
4. THIRD PARTY PERSONAL DATA
If the data provided belonged to a third party, the User guarantees that he or she has informed the third party of this Privacy Policy and obtained his or her consent to furnish his/her data to Cepsa for the stated purposes. He/she also confirms that the data provided is accurate and up-to-date, and assumes liability for any loss or damages, whether direct or indirect, that may be incurred as a result of non-compliance with this obligation.
5. PERSONAL DATA STORAGE PERIOD
The personal data provided shall be kept until the contractual relationship is maintained, its deletion is not request by the interested party and should not be deleted for the fulfillment of a legal obligation or for the formulation, exercise and defense of claims.
If the customer revokes their consent or exercises their rights of cancellation or deletion, his data shall be kept blocked at the disposal of the Administration of Justice within the time limits legally established to meet the possible responsibilities derived from the processing of the same.
7. TRANSFERS AND RECIPIENTS OF PERSONAL DATA
All transfers specified below are necessary for the fulfillment of the aforementioned purposes, or are carried out in compliance with a legal obligation. Personal data can be transferred to:
If necessary, to companies of the Cepsa Group, which can be consulted at www.cepsa.es for administrative purposes and management of the relationship with the client, based on CEPSA's legitimate interest to that effect. The legitimate interest for the aforementioned purpose of assignment would consist of guaranteeing better organization and optimization, as well as unified management of the resources of the business group in cases in which, internally, it is necessary for the effective execution of the activity undertaken in the Website.
Government Administrations and the Administration of Justice.
CEPSA suppliers who, where appropriate, are contracted to measure web traffic and user behavior by means of cookies and similar systems, in accordance with the Cookies Policy, and who will act as data processors.
No international transfer of users’ personal data is foreseen. However, in the event of any international transfer, it will be carried out in compliance with the criteria and requirements of the regulations in force, through the adoption of appropriate legal guarantees, which may consist of the formalization with the recipient of the data of (i) Standard Contractual Clauses approved by the European Commission to legitimize the international transfer of data to third countries or (ii) in another valid legal instrument that allows guaranteeing an adequate level of protection equivalent to that of the European Economic Area.
8. RIGHTS OF DATA SUBJECTS
The User may exercise with COMPAÑÍA ESPAÑOLA DE PETRÓLEOS S.A., if applicable, their rights of access, rectification or deletion, limitation of processing, opposition, portability and to oppose automated individual decisions at the e-mail address derechos.arco@cepsa.com or at CEPSA’s registered office at Paseo de la Castellana, 259 A, 28046-Madrid (Spain). They may also revoke their consent if they have granted it for any specific purpose, and may modify their preferences at all times.
It is also noted that CEPSA has appointed a Data Protection Officer (DPO) to whom questions may be raised concerning the processing of personal data at their registered office and/or by email dpo@cepsa.com with the reference: “Data Protection”.
Additionally, the User is informed that they may address any type of claim regarding personal data protection to the Agencia Española de Protección de Datos (Spanish Data Protection Agency), www.agpd.es, if they consider their rights in the matter are being violated.