Privacy Policy

GRUP DE DISTRIBUCIÓ COSTA BRAVA, SA is committed to protecting the privacy of users who access this website and/or any of its services. Use of the website and/or any of the services offered by GRUP DE DISTRIBUCIÓ COSTA BRAVA, SA implies acceptance by the user of the provisions contained in this Privacy Policy and that their personal data will be treated as stipulated therein. Please note that although there may be links from our website to other websites or social networks, this Privacy Policy does not apply to the websites of other companies or organizations to which the website is redirected. GRUP DE DISTRIBUCIÓ COSTA BRAVA, SA does not control the content of third-party websites, nor does it accept any responsibility for the content or privacy policies of these websites.

Basic information on data processing (Regulation (EU) 2016/679 and LO 3/2018)

Data controller	GRUP DE DISTRIBUCIÓ COSTA BRAVA, SA NIF: A17435827 Pol. Ind. Bosc de Can Cuca, c/Tallers, 18 17410 Sils Email: grupcostabrava@grupcostabrava.com
Purpose of the treatment	Offer and manage our wholesale food and beverage product distribution services.
Legitimation	Consent obtained from the interested party when they request information from us. Execution of the service contract when they contract with us.
Recipients	The data will not be communicated to third parties, unless required by law or necessary to fulfill the purpose of the processing.
Rights of people	Interested parties have the right to exercise their rights of access, rectification, limitation of processing, deletion, portability and opposition by sending their request to our address.
Data retention period	As long as the business relationship is maintained or for the years necessary to comply with legal obligations.
Claim	Interested parties may contact the AEPD to submit any complaint they deem appropriate.
Additional information	You can consult additional and detailed information below in the “Privacy Questions” section.».

Questions about privacy

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we offer you the following information on the processing of your personal data:

Who is responsible for the processing of your data?

Identity: GRUP DE DISTRIBUCIÓ COSTA BRAVA, SA
NIF: A17435827
Address: Pol. Ind. Bosc de Can Cuca, c/Tallers, 18 17410 Sils
Tel.: 972853512
Email: grupcostabrava@grupcostabrava.com

For what purpose do we process your personal data?

- We process the information provided to us to manage our wholesale food and beverage distribution services.
- If you contact us using the contact form on our website, we will process your data to manage your query.
- We may also use your data to inform you about future promotions, offers and other commercial actions in cases where you are already a customer or, if you are not, when you have given us your consent in the corresponding section.
- When accessing our facilities, your image may be recorded by video surveillance cameras for security control purposes.
- If you send us a CV, we will process the data for the purpose of managing the CV database for staff selection.

How long will we retain your data?

The personal data provided will be kept for as long as you are a user of our services or wish to receive information, given that you may object to the processing of your data for promotional purposes, when you provide it to us or at any time thereafter, by notifying us at grupcostabrava@grupcostabrava.com, and then, during the periods established to comply with our legal obligations, which in the case of accounting and tax documentation for commercial purposes will be 6 years, in accordance with Art. 30 of the Commercial Code, and for tax purposes will be 4 years, in accordance with articles 66 to 70 of the General Tax Law. The images captured by the video surveillance system will be kept for one month. In the case of CVs, the data will be kept for one year.

What is the legitimacy for the processing of your data?

For the management of the contractual relationship with the interested party, we will base the processing of the data on the execution of the contract or within the framework of the pre-contractual relationship. For the sending of commercial information, we will base the processing on your consent, although if you are already a customer we may send you information about similar products, always providing a simple and free means to unsubscribe, in accordance with the provisions of article 21.2 of Law 34/2002, of July 11, on information society services and electronic commerce. As for legitimacy, it is given by the legitimate interest of preserving the security of people and property.

To which recipients will your data be communicated?

The data will not be communicated to third parties, unless required by law or necessary to fulfill the purpose of the processing, as will be the case of transport agencies for the shipment of orders.

What are your rights when you provide us with your data?

- Any person has the right to obtain confirmation as to whether or not we are processing their personal data..
- Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
- In certain circumstances, interested parties may request that the processing of their data be limited. In this case, we will only retain them for the exercise or defence of claims.
- Also, in certain circumstances and for reasons related to their particular situation, interested parties may object to the processing of their data. In this case, we will stop processing the data, except for compelling legitimate reasons or for the exercise or defense of possible claims.
- Interested parties also have the right to data portability.
- Every data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
- Finally, interested parties have the right to lodge a complaint with the competent Control Authority.

How can you exercise your rights?

By sending a letter attaching a copy of a document that identifies you, to our physical or electronic address.

How did we obtain your data?

The personal data we process comes from the interested party. The interested party guarantees that the personal data provided is true and is responsible for communicating any changes to it. The data marked with an asterisk will be mandatory in order to provide the requested service.

What data do we process?

The categories of data that we may process in the provision of our services are:

- Identification data
- Postal or electronic addresses
- Transaction data for goods and services In the case of the video surveillance system:
- Image In the case of resumes, also:
- Personal characteristics
- Academics and professionals

The data is limited, since we only process the data necessary for the provision of our services and the management of our activity.

Do we carry out international data transfers?

For the sending of commercial communications we use the MailChimp service provided by The Rocket Science Group, LLC, a company located in the United States. The international transfer of data is based on the Standard Contractual Clauses for processors approved by the European Commission, and on the Commission Implementing Decision of 10.7.2023 in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, on the adequate level of protection of personal data under the EU-US Data Privacy Framework Agreement.

Do we use cookies?

Our website does not use cookies to collect information from users. Only our own session cookies are used for technical purposes (those that allow the user to navigate through the website and use the different options and services available on it). This website may have links to third-party websites that have privacy policies that are not related to our website. When accessing these websites, you can decide whether to accept their privacy and cookie policies. In general, if you browse the Internet, you can accept or reject third-party cookies from the configuration options of your browser.

What security measures do we apply?

We apply the security measures established in article 32 of the GDPR, therefore, we have adopted the necessary security measures to guarantee a level of security appropriate to the risk of the data processing we carry out, with mechanisms that allow us to guarantee the confidentiality, integrity, availability and permanent resilience of the treatment systems and services.
Some of these measures are:

- Information on data processing policies for staff.
- Performing regular backups.
- Data access control.
- Regular verification, evaluation and assessment processes.