PRIVACY POLICY. In accordance with the principles of legality, loyalty and transparency, the Controller makes available this privacy policy (hereinafter, the “Privacy Policy“) which aims to inform, clearly and accurately, users (hereinafter, the “Users“) of the website hosted under the domain name www. elmatador.es and under any of the subdomains of the same (the “Website“), about the processing of personal data collected by Ilia Topuria through the aforementioned Website. This Privacy Policy may be modified at any time for legal or regulatory reasons, for technical reasons or due to changes in the provision of the Website’s services. When this happens and with the aim of notifying you, we will publish it on the Website itself and/or inform you via your e-mail address. If you continue to use the services of the Website, we will understand that you have accepted the modifications introduced.

• Who is responsible for the processing of your personal data?
.

. .

Custodian	XXX (hereinafter referred to as the “Responsible Party“)
D.N.I.	XXX
Commercial address	XXX
E-mail address	XXX

• What categories of data do we collect and process?

The Data Controller will process the data you provide to us, which may be data of the following categories:

• Identifying data, e.g. name, surname, first name, ID number
.
• Contact data, e.g. e-mail address, telephone number
.
• Financial data, e.g. payment or card details, bank account.

• For what purpose do we process your data and on what legal basis do we use it?
.

• To provide the services contracted by the User through the Website:
.

In the event that the User provides personal data so that the Responsible Party can provide the services indicated on the Website, the Responsible Party will process said data so that it can provide its services and carry out the execution of the contract between the Responsible Party and the Users who have contracted the services of the Responsible Party. In the event that the User does not provide any of these data, the Controller will not be able to provide any of its services.

• To attend to your queries, send you the information requested and/or resolve any doubts or questions you may raise:

In the event that the User has provided us with their details in order to make a request or enquiry, the Data Controller will process said data in order to be able to respond to them, and to provide them with solutions that meet their needs. The Data Controller undertakes to process the data obtained and provided by the data subject for as long as they are necessary for the purpose described. The Controller considers that it has a legitimate interest in carrying out such data processing insofar as it enables it to improve its services and the experience of Users.

• For marketing and communication purposes:

On the other hand, only in those cases in which the data subject has given us his/her prior and express consent, the Data Controller will process his/her data for the purpose of sending personalised information about our products or services, sending newsletters and magazines through various means (both by ordinary and electronic means). Whenever this processing is carried out by electronic means, it will be legitimised in the satisfaction of the legitimate interests of the Controller, by virtue of the provisions of article 21 of Law 34/2002, of 11 July, on information society services and electronic commerce (“LSSI“), as well as the European Regulation on Electronic Commercial Communications. In accordance with the provisions of the LSSI, in the event that the user wishes to stop receiving commercial or promotional communications from the Controller, he/she may request cancellation of the service by sending an email to the following email address: info@elmatador.es, or via the link provided for this purpose in the communications themselves.

• For how long will we keep the data?
.

Your data will be kept for the minimum time necessary to satisfy the purpose for which it was provided, as well as to meet the responsibilities that may arise from the data provided and any other legal requirement. In this sense, the personal data will be kept once the relationship with you has ended, duly blocked, for the period of limitation of any actions that may arise from the relationship maintained with the interested party. Once blocked, your data will be inaccessible to the Data Controller, and will not be processed by the latter, except to make them available to the Public Administrations, Judges and Courts, for the attention of possible liabilities arising from the processing, as well as for the exercise and defence of claims before the Spanish Data Protection Agency (“AEPD“). Finally, and provided that you have not withdrawn your consent for this purpose, the Data Controller will keep your data in order to keep you up to date on products, events and services that may be of interest to you.

• To which recipients will we communicate your data?
.

Personal data collected through the Website will not be disclosed to any third party to be used for their own purposes other than those for which the User has consented to their processing. However, the personal data of Users may be accessed by authorised staff of the Controller and other third parties or collaborators who provide services on behalf of the Controller, for the purpose of managing the provision of services, the contractual and/or pre-contractual relationship with Users. In those cases in which access is allowed to other collaborating companies, such access to data on behalf of third parties will be regulated in the corresponding contract, as required by the regulations in force. The Controller, for the processing of personal data, may use the services of processors and sub-processors who may host some of your data outside the European Union and the European Economic Area. This may involve an international transfer of data to countries that the European Union considers not yet to have an adequate level of data protection. For example, their laws may not guarantee you the same rights, or there may not be a data protection supervisory authority capable of dealing with your complaints. Without prejudice to the foregoing, the Controller ensures that, in the event that data is shared outside the European Economic Area, the resulting international transfers are subject to any appropriate safeguards described in the applicable regulations such as the signing of standard data protection clauses. The Controller may also disclose the personal data collected in specific cases where such transfer is provided for and required by applicable law; or where required by the competent authorities.

• What security measures have we adopted to guarantee the security of your data?
.

In order to safeguard the security of your personal data, we inform you that the Data Controller has adopted all the technical and organisational measures necessary to guarantee the security of the personal data provided. All of this to avoid their alteration, loss and/or unauthorised processing or access, as required by law, although absolute security does not exist. Likewise, the Data Controller informs you that all our staff, whatever the stage of processing in which they are involved, are committed to treating your data with the utmost care and confidentiality. However, the User should bear in mind that security measures on the Internet, due to their nature and global nature, are not impregnable.

• What are your rights when you provide us with your data?

Any person has the right to obtain confirmation as to whether or not we process personal data concerning him or her. The data protection rights held by data subjects are:

• Right to request access to personal data relating to the data subject.
.
• Right of rectification or erasure.
Right of objection.
• Right to oppose the processing of personal data.
• Right to request the limitation of its processing.
• Right to data portability.

. Interested parties may exercise their personal data protection rights by sending a written communication to the registered office of the Data Controller or to the e-mail address provided for this purpose, info@elmatador.es, including in both cases a photocopy of their National Identity Document (DNI) or other equivalent identification document. In addition, we inform you that you have the corresponding models, forms and more information about your rights on the website of the national supervisory authority of the AEPD, www.agpd.es.

• Duty of secrecy
.

The Data Controller undertakes to maintain secrecy regarding the data and information provided and to instruct all its staff or collaborators to follow the instructions of the Data Controller regarding the processing of this personal data and regarding any other information or circumstances of which it may become aware or to which it may have had access in the exercise of the functions entrusted to them.

• Obligation of the data subject
.

The User guarantees that the data provided are true, accurate, complete and up to date, and shall be liable for any direct or indirect damage or harm that may be caused as a result of non-compliance with this obligation. In the event that the data provided belong to a third party, the user guarantees that he/she has informed said third party of the aspects contained in this document and obtained his/her authorisation to provide his/her data to the Data Controller for the aforementioned purposes.

• Can I withdraw my consent?
.

You have the possibility and the right to withdraw consent for any specific purpose granted at the time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal. To do so, you only have to notify us by sending an e-mail to info@elmatador.es or by ordinary mail to the Data Controller, enclosing a photocopy of your National Identity Document (DNI), Passport or other equivalent identification document.

• Where can I complain if I consider that my data is not being processed correctly?
.

If you consider that your data are not being treated correctly by the Data Controller, you can send your complaints to info@elmatador.es or to the competent supervisory authority, the Spanish Data Protection Agency.