Privacy Policy
PROCESSING OF PERSONAL DATA
At LANTEK SHEET METAL SOLUTIONS, S.L.U., we care about the personal data we process and the strict compliance with current regulations regarding the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC and Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights.
In accordance with this, we inform you of the following issues related to the processing of personal data that we carry out at LANTEK SHEET METAL SOLUTIONS, S.L.U.:
Who is responsible for the processing of your personal data?
Identity: LANTEK SHEET METAL SOLUTIONS, S.L.U.
NIF: B01395698
Postal address**: **Calle Ferdinand Zeppelin, No. 2 01510 Miñano (Álava)
Phone: +34 945 771 700
Email: info@lantek.es.
Contact details of the Data Protection Officer: dpo@lantek.es.
Notwithstanding this, and as applicable, both the aforementioned company and other subsidiaries of the Group may also be responsible for the processing of data collected through this website and/or others, domains, subdomains, and landing pages: Lantek Sheet Metal Solutions, S.L.U. (Lantek Spain), Lantek Polska Sp. Z.o.o (Lantek Poland), Lantek Yazilim Ticaret Ltd. Sti. (Lantek Turkey), Lantek México, S.A. de C.V. (Lantek Mexico), Lantek Shanghai Trading Co. Ltd. (Lantek China), Lantek Systèmes, SARL (Lantek France), Lantek Systemtechnik GmbH (Lantek Germany), Lantek Systems, Ltd. (Lantek UK), Lantek Systems, Inc. (Lantek USA), Lantek Systems Korea LLC (Lantek Korea), Lan Tek Service S.R.L. (Lantek Italy), Lantek Sistemi S.R.L. (Lantek Italy), Lantek Australia Pty. Ltd. (Lantek Australia) and Lantek Japan KK (Lantek Japan).
This privacy policy will also apply to such websites, domains, subdomains, and landing pages of the mentioned companies.
From now on, the reference to LANTEK will be understood as referring to both LANTEK SHEET METAL SOLUTIONS, S.L.U. and any of the mentioned companies of the Group.
Principles related to processing
In the processing of personal data carried out herein, the principles required by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data, which repeals Directive 95/46/EC (hereinafter, GDPR), are respected:
Principle of lawfulness, fairness, and transparency: the data we collect is processed lawfully, fairly, and transparently, with the prior consent of the data subjects when necessary or, as the case may be, for the execution of a contract in which the data subject is a party or for the application at their request of pre-contractual measures, or for compliance with legal obligations that apply, or for the satisfaction of legitimate interests pursued by the data controller or by a third party, provided that such interests do not override the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data, particularly when the data subject is a child.
Purpose limitation principle: the personal data we process is used for the purposes indicated in the section*“What purposes do we use your personal data for?”*
Data minimization principle: according to this principle, the only personal data we collect from users is strictly necessary to manage the contractual relationship, their participation in recruitment processes, or to address the inquiries and/or requests they make to us.
Accuracy principle: the personal data we collect will be kept accurate and, if necessary, updated. To this end, in the event of any change in personal data, the user must inform us so that we can carry out the appropriate update.
Storage limitation principle: the personal data we process will be retained for the periods indicated in the section*“How long will we keep your personal data?”*
Principle of integrity and confidentiality: to respect this principle, personal data will be processed in a way that ensures adequate security, including protection against unauthorized or unlawful processing and against loss, destruction, or accidental damage, applying appropriate technical and organizational measures.
Information collected through this website
On this website, we have enabled several forms for data collection for different purposes, according to each of them. The categories of personal data collected on this website are:
Data collected through the 'Work at Lantek' form: name, surname, email address, phone number, and curriculum vitae attached by the user.
Data collected through the registration and magazine request form: email address.
***Data collected through the contact form:***name, company, phone number, email address, country, and message or comment made by the user.
***Data collected through the member registration form:***license number, company, postal address, phone number, website, user (email address), password, and language.
***Data collected through the Whistleblower Channel:***although they can be anonymous, the interested party can provide their name and surname, email address, phone number, and reported facts.
All personal data requested in each of the forms is mandatory, so if the user does not provide any of it, we will not be able to process their request and, therefore, we will not be able to fulfill the purpose associated with each form.
No personal data is collected that the General Data Protection Regulation qualifies as special categories of data (ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data aimed at uniquely identifying a natural person, data related to health or data related to sexual life or sexual orientation) nor data related to criminal convictions and offenses.
In turn, through cookies, information is collected about how users use the website, pages visited, origin, geographical location, IP addresses, although this information will be collected in an aggregated manner, that is, without identifying the users. You can consult the information about the cookies used in the Cookie Policy.
The forms available on this website are hosted and managed through Odoo. The personal data submitted through these forms is initially recorded in Odoo and may subsequently be transferred to LANTEK's internal customer and lead management systems, including NEXUS, so that the relevant LANTEK company or department can manage the request, commercial opportunity, subscription, registration, or other purpose associated with the form.
Regarding the sending of the Lantek magazine and the newsletter, Odoo is used to manage these communications. Where permitted by applicable law and subject to the corresponding consent requirements, these communications may include tracking technologies that allow LANTEK to monitor email delivery and opening and the clicking of links contained in the emails, and to prepare follow-up reports on the campaigns using the information collected.
What purpose do we use your personal data for (whether you are a user of the website or not)?
Customer data: for the proper maintenance, development, compliance, and control of the contractual relationship with clients and the provision of the services they demand.
We will also use your identifying and contact data to conduct satisfaction surveys and to send, by electronic means or otherwise, technical, operational, and/or commercial information about news and commercial information regarding both news, our products and services, and those of other companies in the Lantek Group.
Regarding this type of communication, to manage it more efficiently, dynamically, and operationally, and to better control the commercial communications we send via email, we use Odoo. Where permitted by applicable law and subject to the corresponding consent requirements, this platform may use tracking technologies in these communications to monitor email delivery and opening and the clicking of links contained in the emails, and to prepare follow-up reports on the campaigns using the information collected.
Potential client data: to carry out commercial prospecting, management of budgets and commercial offers, follow-up on them, and conduct commercial activities for client acquisition.
Supplier data: for the proper maintenance, development, compliance, and control of the contractual relationship with our suppliers and the services they provide to us.
Personnel data: for the proper maintenance, development, compliance, and control of the contractual relationship with our employees, as well as compliance with current regulations regarding labor, Social Security, and Occupational Risk Prevention that may apply.
Candidate data: to manage the participation of interested parties in the recruitment processes carried out by the company itself and other subsidiary companies of the Lantek Group. This implies that when a candidate provides a resume to Lantek Sheet Metal Solutions, S.L.U., it will be used to manage their participation in both the recruitment processes conducted by this company and other companies of the Lantek Group, identified in the section responsible for data processing.
Visitor control data: to control the entries and exits of the company's facilities for security reasons.
Data collected through the registration form and magazine request: to manage the sending of the Lantek magazine and, consequently, the subscription of users to our newsletter and, therefore, the sending, by email, of newsletters or informational bulletins about the company, our products, services, news, articles, updates, offers, or promotions as well as other commercial content that may be of interest.
As mentioned above, to manage these communications more efficiently, dynamically, and operationally, and to better control the commercial communications we send via email, we use Odoo. Where permitted by applicable law and subject to the corresponding consent requirements, this platform may use tracking technologies to monitor email delivery and opening and the clicking of links contained in the emails, and to prepare follow-up reports on the campaigns using the information collected.
Data collected through the contact form: to manage and respond to inquiries and requests for information or services that are requested through it.
Data collected through the member registration form: since registering requires having a license for a Lantek product, the personal data of the members will be used to manage their registration and allow them to access, through the private area, different functionalities related to it, such as (without limitation) tracking software incidents, plant indicators of machines with Lantek software, manuals, training, or subscription to new applications.
Data collected through the Whistleblower Channel: to manage the internal information system or ethical channel, investigate the facts and propose resolution measures, prevent regulatory non-compliance and correct those already detected, as well as contribute to the effective functioning of the organization with the continuous improvement of internal processes for the management and control of illegal behaviors or those contrary to the ethical culture of the organization. All of this in compliance with the obligations established by Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and the fight against corruption.
User data from our social media profiles: to interact with our users, mainly by responding to comments they make on the posts we publish on the profiles we have on different social media.
What is the legal basis for the processing of your personal data?
Customer data: the legal basis that legitimizes the processing of your personal data is that it is necessary for the execution of the contract in which you are a party.
Regarding satisfaction surveys and the sending of commercial information from us or other companies in the Lantek Group, the legal basis that legitimizes such processing is that it is necessary for the satisfaction of legitimate interests pursued by the data controller and/or third parties (other companies in the Lantek Group) as provided for in Article 6.1. f) of the GDPR. This is without prejudice to the possibility that the data subject has to object to the sending of that commercial information.
Potential customer data: the legal basis that legitimizes the processing of your personal data is that it is necessary for the execution of the pre-contractual and commercial relationships maintained between both companies.
Supplier data: the legal basis that legitimizes the processing of personal data of suppliers is that it is necessary for the execution of the contract in which they are a party.
Employee data: the legal basis that legitimizes the processing of personal data of workers is that it is necessary for the execution of the employment contract between the company and its workers.
Candidate data: the legal basis that legitimizes the processing of personal data of interested parties is the consent they provide by giving us their resume to participate in the personnel selection processes we conduct.
Visitor control data: the legal basis that legitimizes the processing of personal data provided to us by individuals accessing our facilities is that it is necessary to satisfy our legitimate interest in controlling the entries and exits of the facilities for security reasons.
Data collected through the registration and magazine request form: the legal basis that legitimizes the processing of personal data provided to us by interested parties when filling out the form is the consent given when registering to receive the Lantek magazine and thus subscribing to our newsletter, and therefore, the necessity of such processing to address and respond to the request for the magazine and its subscription.
Data collected through the contact form: the legal basis that legitimizes the processing of personal data provided by the interested parties when filling out the form is the consent they give when contacting us through it and, therefore, the necessity of such processing to address and respond to the inquiries or requests they make.
Data collected through the member registration form: to the extent that it is necessary to have a Lantek software license to register, the legal basis that legitimizes the processing of personal data is that it is necessary for the execution of the license agreement in which they are a party, as well as the consent they provide when requesting registration.
Data collected through the Whistleblower Channel: the legal basis that legitimizes the processing of personal data is its necessity for compliance with the obligations established by Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combat corruption. However, if the report is made via recording, the legal basis that legitimizes such data processing is the consent provided by the interested party to do so in that manner. The interested party, if they prefer, can select the option to delete the metadata and have their voice recorded in a distorted manner to further enhance their anonymity.
Data from users of our social media profiles: the legal basis that legitimizes the processing of personal data of our followers and users of our social media is the consent they provide by following us on those platforms, although they can stop doing so at any time.
How have we obtained your personal data?
All personal data that we process at LANTEK is provided to us by the interested parties themselves or their legal representatives.
The personal data we collect through this website has been gathered through the various forms available or through the email address provided to contact us.
The personal data requested through the forms is necessary to fulfill the purposes corresponding to each of them, so it is mandatory to provide all of them; otherwise, we cannot fulfill the indicated purpose.
To whom will your personal data be communicated?
The personal data of clients, suppliers, and employees will be communicated, where applicable, to the tax administration for compliance with legal and tax obligations, as well as to the financial entity/entities through which we manage collections (in the case of clients) and payments (in the case of suppliers and employees).
The personal data of clients, potential clients, suppliers, employees, and candidates may be communicated to other companies within the Lantek business group for internal administrative purposes; however, in the case of the newsletter and the contact form, the personal data may be communicated to other companies in the Group to manage the request or sending of the requested information. This will depend on the company that has to manage the request or sending of the information, with the companies that make up the Lantek Group and, therefore, the potential assignees, being those listed in the final paragraph of this section.*“Who is responsible for the processing of your personal data?”*of this privacy policy.
Regarding the whistleblower channel, we will not disclose personal data to third parties unless necessary for compliance with legal obligations or for the processing of complaints. This will be the case, for example, for data communications to Courts and Tribunals, to the Public Prosecutor's Office, or to the competent administrative authority within the framework of a criminal, disciplinary, or sanctioning investigation.
In other treatments, data will not be communicated to third parties unless necessary for compliance with legal obligations.
Additionally, for some other matters, we use third-party services, which act as data processors, with whom we have signed the corresponding data processing agreement in accordance with the provisions of Article 28.3 of the GDPR.
This includes Odoo, which provides the website, form management, email campaign, and related data management infrastructure used by LANTEK. Personal data submitted through the website may be stored and managed in Odoo and transferred to NEXUS for the allocation, monitoring, and management of enquiries, subscriptions, and commercial opportunities. Odoo and any other technology providers involved will process personal data on behalf of LANTEK under the corresponding data processing agreements.
Transfers of personal data to third countries
For some information management matters, we use third-party services, such as Microsoft Corporation and the relevant Odoo entity, which may act as data processors. Where personal data is transferred outside the European Economic Area, LANTEK will ensure that the transfer is covered by an adequacy decision adopted by the European Commission, standard contractual clauses approved by the European Commission, or another safeguard recognised under the GDPR. Where the recipient is established in the United States, the transfer may also be based on the recipient's valid participation in the EU-U.S. Data Privacy Framework, where applicable.
The website may also include content provided by Vimeo. When the user authorises the corresponding cookies or activates embedded Vimeo content, Vimeo may receive technical and usage information, such as the user's IP address, device and browser information, and interaction with the video. Further information is available in the Cookie Policy and in Vimeo's Privacy Policy.
In any case, since LANTEK has a presence in different countries around the world, it is possible that, if the client's request requires it, international data transfers may be made to the Group company necessary to address that request. In such cases, these transfers have the guarantees required by the General Data Protection Regulation, either due to the existence of an adequacy decision by the European Commission, or due to the existence of standard contractual clauses or, where applicable, binding corporate rules.
How long will we keep your personal data?
***Data from customers, suppliers, and employees:***personal data is retained for the duration of the corresponding contractual relationship and, once it has ended, for the necessary periods to comply with legal obligations.
Regarding the sending of commercial information to customers, their identifying and contact personal data will be retained until they express their opposition for such purpose.
Data from potential customers: in this case, and to the extent that periodic contacts are made with potential clients for proper commercial follow-up, their personal data will be retained until a service contract is signed or, if applicable, until consent is revoked.
Candidate data: the personal data of candidates will be retained for a maximum period of two years.
Visitor control data: the personal data of visitors is retained for a maximum period of two months.
Data collected through the registration and magazine request form: the personal data provided to us will be retained as long as the interested parties do not revoke their consent by requesting to unsubscribe.
Data collected through the contact form: the personal data provided by users when filling out the form will be retained only during the management of the inquiries and requests made to us, so that once the processing is completed, it will be deleted.
Data collected through the member registration form: since registration requires a license for a Lantek product, the personal data of members will be used during the validity of the license or, if applicable, until the interested party requests to unsubscribe. Subsequently, personal data will be retained for the necessary periods to comply with legal obligations.
Data collected through the Whistleblower Channel: we will keep your personal data in the information system only for the periods required by Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combat corruption.
User data from our social media profiles: the retention periods for the personal data of our followers on social media depend on the policies of each social network, although we will only process them until they stop following us.
What are your rights when you provide us with your personal data?
Right to request access to your personal data: in order to know and verify the legality of the processing, you may request confirmation at any time as to whether LANTEK is processing your personal data and, in that case, we will inform you, among other things, about what data we are processing, its purpose, the source of the data, the expected retention period of the data, and, if applicable, the recipients or categories of recipients.
*Right to request rectification:*you may request the rectification of personal data that is inaccurate or that we complete any incomplete data, including through an additional statement. In that case, you must indicate in your request which data you are referring to and the correction that needs to be made, and you must attach, if applicable, the supporting documentation for the inaccuracy or incomplete nature of the data being processed.
Right to request your erasure (“right to be forgotten”): you can request that your personal data be deleted and no longer processed if they are no longer necessary for the purposes for which they were collected or processed in another way, you withdraw your consent, they have been processed unlawfully, or they must be deleted to comply with a legal obligation.
Right to request the limitation of the processing of your personal data: in this case, LANTEK will only retain your personal data for the formulation, exercise, or defense of claims, or for the protection of the rights of another natural or legal person, or for important public interest reasons.
Right to the portability of your personal data: you can request that we provide your personal data to you or to another controller you indicate, in a structured, commonly used, and machine-readable format.
Right to object to processing: LANTEK will stop processing your personal data in the manner you indicate, unless we must continue processing it for compelling legitimate reasons or for the formulation, exercise, or defense of possible claims.
How to exercise your data protection rights: to exercise your rights, you must send us a written request addressed to LANTEK SHEET METAL SOLUTIONS, S.L.U. at Ferdinand Zeppelin Street, No. 2, C.P. 01510 Miñano (Álava) or by sending an email to dpo@lantek.es. We may request a copy of your ID if necessary to verify your identity.
LANTEK will respond to all requests within the timeframes and conditions required by current regulations on personal data protection.
How to file a complaint with the Spanish Agency for Data Protection: if you believe that we have not adequately handled your personal data or that we have not properly addressed the exercise of your data protection rights, you can file a complaint with the Spanish Data Protection Agency, either through its electronic headquarters or at its address, Calle Jorge Juan, No. 6, C.P. 28001 Madrid.
More information about data protection rights and complaints to the supervisory authority at www.aepd.es .
Security
In accordance with the provisions of Article 32 of the GDPR, LANTEK has adopted appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
In order to assess the adequacy of the level of security, particular consideration has been given to the risks presented by data processing, particularly as a result of the accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored, or otherwise processed, or the unauthorized communication or access to such data.
Duty of confidentiality
LANTEK has taken measures to ensure that anyone acting under their respective authority and having access to the personal data provided to us by users can only process it following the company's instructions, and must also maintain the corresponding professional secrecy regarding the same, which will have an indefinite duration.
To this end, our employees have signed a confidentiality and duty of secrecy document regarding the information and personal data they handle in connection with the existing employment relationship with the company.
Use of the website by minors
We ask users to read the policies for the use of the web by minors that we have published in the 'Legal Notice' on our website.
Social networks
Social media profiles: LANTEK has profiles on some of the main social networks that currently exist, so there may be processing of personal data of our followers, of people who appear in the publications we make (for example, photographs) and of people who send us private messages.
Data processing and purpose: the data processing that LANTEK will carry out is limited and conditioned to the policies and functionalities of each social network.
When a user follows us on a social network, they authorize us to use their personal data solely within the scope of the corresponding social network for the management of our page or profile and for the communications we maintain in a bidirectional manner with our followers through chat, messages, or other means of communication that the social network currently allows and will allow in the future. This implies that we will have access to the information from their profile that appears in the comment, including but not limited to their username, image (if the user has uploaded a photograph to their profile), and comments made.
We also want to inform that when a user follows us, the news we publish may also appear on their wall and that if they comment on ours, both their comment and their profile name, and if applicable, the photograph they have on it, will be accessible to other followers. In any case, it is the user's responsibility how they use the social network.
We will not use users' personal data for purposes other than those indicated in the previous paragraphs or to send them information through an environment other than the social network.
Unless the interested party gives their consent or requests us to address any request they make, we will not extract their personal data from the social network environment.
Legitimacy of processing: the legal basis that legitimizes the processing of our followers' personal data is the consent they provide by following us.
***Recipients of the data:***we will not communicate to third parties or carry out international transfers of our followers' personal data unless necessary for compliance with a legal obligation. This does not affect the fact that public comments made by followers on our social media and our responses will be seen by other followers.
Data retention period: the retention periods for our followers' personal data on social media depend on the policies of each social network, although we will only process them until they stop following us.
Data protection rights: regarding the rights of access, rectification or deletion, limitation of processing, opposition, and portability of their personal data, we can only act according to the possibilities allowed by each social network. LANTEK will provide all possible assistance to the interested party to exercise the aforementioned rights.
In any case, any of our followers can unsubscribe from our page or profile at any time, so we would no longer have access to their personal data, although the social network may retain the comments they previously made on our wall.
It is the user's responsibility how they use the Social Network, so LANTEK assumes no responsibility in this regard.
You can consult below the privacy policy of each social network where LANTEK has a page or profile:
Facebook: Data policy
Twitter/X: Privacy policy
YouTube (YouTube): Privacy policy
LinkedIn: Privacy policy
Cookies
Cookies are small text files that are stored on the hard drive or in the memory of the computer that accesses or visits the pages of certain websites, so that user preferences can be known when reconnecting. The cookies stored on the user's hard drive cannot read the data contained in it, access personal information, or read cookies created by other providers.
See information about the cookies used on this website in the section “Cookie policy”.
The website may include video content provided by Vimeo and YouTube. When the user authorises the corresponding cookies or activates the content, these providers may receive technical and usage information, such as the user's IP address, device and browser information, and interaction with the video.
Lantek's intervention as data processor
In the event that the Client requests Lantek to carry out any support action or intervention, they must avoid sending personal data, which should be deleted or dissociated prior to sending it to Lantek. However, if the action or intervention requested by the Client from Lantek necessarily requires the sending of personal data, Lantek will process it on behalf of the Client, thus acting as the data processor, in which case the following conditions will apply:
1.1 OBJECT OF THE DATA PROCESSING ASSIGNMENT
Through these clauses, Lantek, as the data processor, is authorized to process on behalf of the Client, as the data controller, the personal data necessary to provide the requested service.
The processing will consist, according to the request made by the data controller, of Lantek remotely connecting to their systems in order to manage customization, reported technical incidents, or, if applicable, to customize the program or certain functionalities.
To this end, the connection by Lantek will be made using remote connection programs, whether proprietary, third-party, or even those of the data controller themselves, always with prior request and authorization from them, under the terms included in this agreement. In such cases, Lantek will not incorporate the data into its systems or supports, other than those of the data controller.
However, it is possible that the correct resolution of the customization or technical incident may require special analysis, which could imply that the data controller provides Lantek with the affected database through the private area of their website, in which case Lantek will incorporate it into its systems, separate from those of the data controller.
In such cases, the processing to be carried out by Lantek with the personal data accessed as a result of the provision of the contracted service will be, at all times, those necessary for the execution of the assignment, which may include, as appropriate and necessary, the collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of enabling access, comparison or interconnection, limitation, deletion or destruction, copying, analysis or sending.
1.2 IDENTIFICATION OF AFFECTED INFORMATION
For the execution of the services derived from the fulfillment of the object of the assignment, the data controller will make available to the data processor the categories of data subjects, which include legal representatives of clients and authorized users, along with the categories of personal data, such as identification, contact, and professional data, necessary for the execution of the service.
1.3 DURATION
The duration of this type of data processing will be necessary for the fulfillment of the assignment made by the Client. Once completed, it will proceed as indicated in section “r” of the following section. However, the stipulations of this Annex, with express or implied intention, that they continue in force after the moment of resolution or expiration thereof, will remain in force and continue to bind both parties as stipulated.
1.4 OBLIGATIONS OF LANTEK AS DATA PROCESSOR
The data processor and all its personnel are obliged to:
a) Use the personal data being processed, or any data collected for inclusion, only for the purpose of this assignment. Under no circumstances may the data be used for personal purposes or for purposes other than those contemplated in the execution of the service. The data controller authorizes the data processor to aggregate the data derived from the database in question in order to allow for continuous improvement of the service and error detection.
b) Process the data in accordance with the instructions of the data controller. If the data processor believes that any of the instructions violate the General Data Protection Regulation or any other data protection provisions of the Union or the Member States, the processor will immediately inform the controller.
If any instruction from the controller regarding how the processor should act with respect to the personal data to which they have access is unclear, before carrying out any data processing, they must contact the controller and clarify the instruction.
c) Maintain a written record of all categories of processing activities carried out on behalf of the controller, containing the aspects required by Article 30.2 of the General Data Protection Regulation.
d) Do not disclose the data to third parties, unless there is express authorization from the data controller, in legally permissible cases.
The processor may communicate the data to other processors of the same controller, in accordance with the instructions of the controller. In this case, the controller will identify, in advance and in writing, the entity (company name, tax identification number, and address) to which the data must be communicated and the data to be communicated.
If the processor must transfer personal data to a third country or to an international organization, under the law of the Union or of the applicable Member States, it will inform the controller of that legal requirement in advance, unless such law prohibits it for important reasons of public interest.
In this regard, the processor has contracted various services offered by Microsoft Corporation, such as Azure, for information hosting, among others. Microsoft acts as a sub-processor. Where the use of these services involves an international transfer of personal data outside the European Economic Area, the transfer will be covered by standard contractual clauses approved by the European Commission, an applicable adequacy decision, including valid participation in the EU-U.S. Data Privacy Framework where relevant, or another safeguard recognised under the GDPR.
(Microsoft Data Protection Annex (DPA))
e) Subcontracting. Subcontracting with third parties for services that involve access to and/or processing, in whole or in part, of personal data will require prior notification to the Data Controller, who may deny it, justifiably, within 10 days. Otherwise, it will be understood as authorized, and the subcontractor will have to contractually commit to comply with the same data protection obligations established in this clause for the Data Processor. In the event of non-compliance by the sub-processor, the initial processor will remain fully responsible to the controller regarding compliance with the obligations.
f) Maintain the duty of confidentiality regarding the personal data to which they have had access by virtue of this assignment, even after its purpose has ended.
g) Ensure that the individuals authorized to process personal data commit, expressly and in writing, to respect confidentiality and to comply with the corresponding security measures, of which they must be adequately informed.
h) Keep available to the controller the documentation evidencing compliance with the obligation established in the previous section.
i) Ensure the necessary training in personal data protection for individuals authorized to process personal data.
j) Assist the data controller in responding to the exercise of the rights of access, rectification, deletion, and opposition, limitation of processing, data portability, and not to be subject to automated individualized decisions (including profiling).
When the affected parties exercise such rights before the data processor, they must communicate it by email without undue delay to the email address indicated by the data controller.
k) Right to information. It is the responsibility of the controller to provide the right to information at the time of data collection.
l) Notification of data security breaches. The data processor will notify the data controller, without undue delay, and in any case without due delay, and through the email address indicated by the controller, of any breaches of the security of personal data under their charge that they become aware of, along with all relevant information for documenting and communicating the incident. Notification will not be necessary when it is unlikely that such a security breach would pose a risk to the rights and freedoms of individuals.
It is the responsibility of the data controller to communicate data security breaches to the affected parties as soon as possible when it is likely that the breach poses a high risk to the rights and freedoms of individuals.
m) Provide support to the data controller in conducting impact assessments related to data protection, when appropriate.
n) Provide support to the data controller in conducting prior consultations with the supervisory authority, when appropriate.
o) Make available to the controller, at their request, all necessary information to demonstrate compliance with their obligations, as well as for conducting audits or inspections carried out by the controller or another auditor authorized by them.
p) Conduct an assessment of the risks that the processing of personal data by Lantek on behalf of the data controller entails and implement appropriate technical and organizational security measures to ensure a level of security appropriate to the risk.
q) Appoint a data protection officer, whenever required, in accordance with applicable legislation and communicate their identity and contact details to the controller. In this regard, it is noted that Lantek has appointed a Data Protection Officer, having communicated their appointment to the Spanish Data Protection Agency. The data controller may contact them at the above postal address and by email at dpo@lantek.com
r) Destination of the data. Once the service execution is completed, at the choice of the data controller, the data processor must return the personal data to the controller or transfer it to another processor designated by the controller, and delete any copies in their possession. However, they may keep the data blocked to address possible administrative or jurisdictional responsibilities.
1.5 OBLIGATIONS OF THE CLIENT AS DATA CONTROLLER
a) Provide the processor with the data referred to in section "2. – Identification of the affected information."
b) Conduct, if necessary, an assessment of the impact on the protection of personal data of the processing operations to be carried out by the processor.
c) Conduct, if necessary, the corresponding prior consultations.
d) Ensure, both prior to and throughout the processing, compliance with the GDPR by the processor.
e) Supervise the processing, including conducting inspections and audits.
1.6 RESPONSIBILITIES OF THE DATA PROCESSOR
In the event that the data processor, including its employees, uses personal data for purposes other than those set forth in this contract, communicates them to third parties, or uses them in violation of the stipulations determined in the contract, it will be considered responsible for the processing, being liable for any violations it may have incurred.
However, the data processor will not incur liability when, upon express indication from the data controller, it communicates the data to a third party designated by the controller, to whom it has entrusted the provision of a service.
The data processor will only be liable for damages caused by the processing, within the limits established in these General Terms and Conditions, when it has not complied with the obligations of the GDPR specifically directed at processors or has acted outside or against the instructions of the controller. In this regard, the data processor will be exempt from liability if it demonstrates that it is not responsible for the act that caused the damages.