This document describes the processing of your personal data and your rights under the data protection legislation in force, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and its implementing legislation (the “GDPR”). The type of data processed and the use we make of it may vary depending on the relationship we maintain with you and the services requested and/or rendered.

Data controller and contact details

The company controlling your data is R.FRANCO TECHNOLOGIES, S.L.U., whose head office is Plaza de Cronos, 4, 28037, Madrid.

If you so wish, you may contact the Data Protection Officer through the following email button dpo@orenesgrupo.com, or through the aforementioned postal address.

Why do we process your data (purpose of processing), and on what legal basis?

Your personal data is processed under the GDPR on the legal basis stated below.

Within the framework of the performance or fulfilment of contractual obligations – article 6.1.b GDPR

Your personal data will be processed in the first instance to establish, perform or rescind the contractual relationship or to undertake contractual modifications, i.e., R.FRANCO TECHNOLOGIES, S.L.U. will process your data to facilitate management of:

• The portfolio of professional customers, including preliminary analysis, opening of customer records, service provision and monitoring of debts and payments.
• The technical and maintenance service resulting from the proper provision of the hired services.
• Your registered user in Orenes Club (update of their points balance and delivery of their prizes).
• Machine lease agreements.
• Premises lease agreements.

Legal basis: processing based on the legitimate interest of the controller – article 6.1.f GDPR

Whenever necessary, R.FRANCO TECHNOLOGIES, S.L.U. will process your personal data to satisfy its own and third-party legitimate interests in the following cases:

• Performance of analytical and financial accounting tasks.
• Performance of audits, review of the level of compliance of workers and fraud prevention.

Consent – article 6.1.a GDPR

R.FRANCO TECHNOLOGIES, S.L.U. will notify you and request your consent to processing your data in the event of requesting electronic billing. Furthermore, we will request your consent before we send you any mail of a commercial nature.

You may withdraw your consent at any time. This also applies if your consent was granted before the entry into force of the European Union’s GDPR, i.e., before 25 May 2018. Note that objection to a specific form of processing and withdrawal of consent does not have a retroactive effect. At any time you may obtain information about the consent you have given to us to the different types of processing by exercising your rights under section 8.

By legal imperative or in the public interest – article 6.1.c and e GDPR

 Hence, we process data on that legal basis in the following scenarios:

• Management of embargoes imposed on customers in order to comply with applicable legal demands.
• Management of administrative or court cases. This processing may also be based on the lawful right to effective legal protection, both the right to defend oneself and to file any legal claims deemed appropriate, based on the civil or criminal procedure legislation.
• Compliance with the applicable legal obligations on tax and accounting.

To which recipients will we transfer your data?

To fulfil all the aforementioned objectives, R.FRANCO TECHNOLOGIES, S.L.U. collaborates with third-party service providers who may have access to your personal data as a result of implementing the hired services. In any event, upon selecting those third parties, R.FRANCO TECHNOLOGIES, S.L.U. follows strict criteria to comply with its data protection obligations, and signs with those third parties its corresponding data protection agreement binding them to comply with its data protection obligations, specifically including the obligation to perform the legal, technical and organisational measures upon processing the personal data for the agreed purposes, and the prohibition on processing that personal data for other purposes or transfers to third parties.

Your data will also be transferred to the public authorities, the Tax Agency, the judges and the courts, and the competent authorities in general, whenever R.FRANCO TECHNOLOGIES, S.L.U. is legally bound to provide it.

For how long will we store your data?

R.FRANCO TECHNOLOGIES, S.L.U. will comply with the legislation in force on the obligation to erase personal information no longer necessary for the purpose or purposes for which it was gathered. That public information will only be available to the judges and courts, the Tax Ministry or the competent public authorities to handle possible liabilities arising from the processing, and only during the limitation periods of those liabilities. Once those limitation periods have elapsed, that information will be definitively erased by secure methods.

Personal data log

As controller of the processing of your personal data, R.FRANCO TECHNOLOGIES, S.L.U. keeps a log of all the processing activities performed on your data. That inventory contains all the information on the type of data processed, such as the data subjects, the possible recipients of your data, the purposes of the processing, the time that the data will be stored, etc.

The personal data provided by the user is held in a log controlled by R.FRANCO TECHNOLOGIES, S.L.U., which remains responsible for its security at all times. Besides the above information, that log includes:

• The department controlling the processing
• The legal basis of the processing
• The category of the data processed
• The source of the data processed
• The channel through which the data processed is obtained
• The media storing the data processed
• A description of the processing performed
• A list of the systems involved in the processing
• The data processor

Changes to the Privacy Policy

R.FRANCO TECHNOLOGIES, S.L.U. reserves the right to amend the Privacy Policy. Any update is applicable to users once published. R.FRANCO TECHNOLOGIES, S.L.U. is bound to report those changes by the available means and to expressly state the date on which each version of the Privacy Policy enters into force.

Probative value

The user accepts that whenever the channel for obtaining the documents or processed data is electronic, those documents or that data will have the same probative value they would have had if they were sent or transferred on paper. Therefore, the user is bound not to challenge their validity or probative value on the basis that they are in an electronic format.

What are your rights when providing your data to us?

Under the GDPR and Spanish data protection legislation, if you so wish, you are entitled to exercise your rights of access, rectification and erasure, to request the limitation of the processing of your personal data, to object to the processing of your personal data, to request data portability, and to not be the subject of automated individual decisions. Specifically, notwithstanding the purpose or legal basis by virtue of which we process your data, you are entitled to:

• Request access to your data held by us.
• Request that we rectify the data that we already hold. Note that when you actively provide your personal data to us by any means, you guarantee that it is accurate, and you undertake to notify us of any change or amendment to that data.
• Request that we delete your data when it is no longer necessary for the purpose for which we needed it, based on what we previously reported to you, or when we no longer have the legal basis for processing it.
• Request that we limit the processing of your data, which means that in certain cases you may request that we temporarily suspend the processing of the data, or that we store the data beyond the necessary time whenever you may need it.
• Receive the personal data concerning you that you have provided to us in a commonly-used, machine-readable, structured format, as well as to transfer it to another data controller.
• Furthermore, whenever the processing of your data is based on our legitimate interest, you will also be entitled to object to the processing of your data.
• Moreover, in the event that the aforementioned processing of personal data is based on the consent provided by you, you may withdraw that consent at any time. In this respect, note that the withdrawal of the consent provided will not affect the lawfulness of the processing performed prior to the withdrawal of that consent.

You may exercise the aforementioned rights through the following channels. In the event we deem it necessary in order to identify you, we may request from you a copy of a document proving your identity (copy of your national identity card (DNI), passport, foreigner ID number (NIE), etc.):

• In writing, through a request sent to Plaza de Cronos, 4, 28037, Madrid.
• By email to dpo@orenesgrupo.com

R.FRANCO TECHNOLOGIES, S.L.U. undertakes to provide a copy of the personal data subject to processing, and reserves the right to charge for any other copy requested by the data subject a reasonable fee to cover administrative costs.

Users are entitled to access or receive the information, or a copy of that information, in a commonly-used structured electronic format, unless the data subject requests it in another format.

Am I obliged to provide information?

You must provide to us the personal data necessary in order to establish a contractual relationship with us, which requires your consent to the provision of the service.

If you do not provide that data to us, we will be bound in general to deny the provision of the service or to stop provision of the existing service, and we will be bound to consider our contractual relationship terminated.

To whom may you send your complaints?

If you believe that your data protection rights have been infringed, or you have any complaint relating to your personal information, you may contact us through the channels provided in section 8.

In any event, data subjects may always turn to the Spanish Data Protection Agency, the supervisory authority on data protection, C/Jorge Juan número 6, 28001, Madrid.