Privacy Policy

In accordance with the General Data Protection Regulation 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), this privacy policy has been updated. Below, you will find information regarding the data processing carried out by Lena Grams.

1. DATA CONTROLLER

The Data Controller is the same as the owner of this website, whose full details are provided in the Legal Notice.

2. NOTICE, POLICY AND SECURITY MEASURES.

The data controller, taking into account the nature, scope, context, and purposes of the processing, has implemented all necessary technical and organizational measures to ensure compliance with data protection regulations. This is in accordance with Articles 24 et seq. of the General Data Protection Regulation and Article 28 of Organic Law 3/2018.

Likewise, the application of appropriate security measures to the processing of personal data, as required by the applicable regulations, is guaranteed to ensure full compliance with them.

3. DATA CATEGORY, PURPOSE AND LEGITIMATION OF PROCESSING.

This website has the following forms which collect different types of data, depending on the purpose:

Contact form : Identifying information, contact details, and other information that the user may provide. This information will be used to respond to inquiries.

Registration form : This form collects identification, contact, billing, payment, commercial, and service information. This data will be used to create a user account that allows you to access our website’s features as a customer, enabling us to provide you with the services offered. It will also be used for administrative management, after-sales service, and customer loyalty programs.

Candidate form : This form includes identifying information, contact details, academic background, work experience, and other information that may be included in a resume. It will be used in the recruitment processes of the manager or other personnel related to human resources management.

Content subscription form : contact information. This will be used for sending newsletters and other information requested by the user on a regular basis.

Booking form : identification and contact information. This will be used to make, modify or cancel bookings.

Promotions or raffles : identification and contact information. This information will be used for conducting the raffles and communicating with the winners, as indicated in the specific terms and conditions of each promotion.

Reporting channel : Identifying information, contact details, details of crimes or offenses committed, and other information that may be included in a report. This information will be used for the administrative management, investigation, and resolution of submitted reports.

The legal basis for these processing activities is the informed and freely given consent that the user must provide before submitting any information through the form. This consent may be withdrawn at any time without affecting processing carried out previously. Other processing activities may also be carried out based on compliance with legal obligations or the performance of a contract, as applicable.

Additionally, the website may obtain information through cookies (see cookie policy).

4. ORIGIN AND CATEGORIES OF THE DATA PROCESSED.

Personal data is obtained directly from the data subject. If, in any case, it is obtained from other sources, appropriate information will be provided regarding its origin and the categories of data involved.

5. DATA RETENTION PERIOD.

The data will be kept for as long as necessary to carry out the entrusted procedures and tasks, as well as to execute the other purposes for which they were collected and, in any case, taking into account the legally required time limits.

Once the data is no longer considered active, it will be deleted or, if necessary, blocked, remaining accessible only to Judges and Courts, the Public Prosecutor’s Office, or the competent Public Administrations for the purpose of enforcing any potential liabilities arising from the processing, for the duration of the applicable statute of limitations. After this second period has expired, the data will then be destroyed. All of this will be done, where applicable, in compliance with Article 32 of the LOPDGDD (Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights).

6. RECIPIENTS: DATA ASSIGNMENTS AND INTERNATIONAL TRANSFERS.

No data transfers are contemplated, except those necessary for compliance with a legal provision or in favor of the execution of a contract.

Your personal data may be accessed by those in charge of processing who perform a service on behalf of the controller, that is, those service providers who have to access your personal data for the functional or operational development in favor of the service to be offered.

Furthermore, international data transfers are not contemplated. Should such transfers become necessary, they will be carried out with the appropriate authorization and in compliance with all applicable requirements.

7. SOCIAL NETWORKS.

The data of friends or followers on social media may be processed by the data controller to interact with them and keep them informed of activities, services, and promotions. This data will be processed based on your consent and will be kept as long as you remain a “friend” or “follower.” You may revoke your consent at any time, without affecting the lawfulness of any processing carried out beforehand. Providing your data for this purpose is voluntary; however, if you choose not to provide it, you will not be able to become a “friend” or “follower” on the platforms or channels where the data controller operates.

On the other hand, if this website offers a user registration option and allows registration via social media, the personal data specifically processed for this purpose will come from the relevant social network, to which the user will have previously provided said data for the purposes outlined in its corresponding privacy policies. The categories of data processed and collected from the relevant social network will be those listed in the registration form itself and those relating to the data you have provided to said social network. If, in order to register on this website, additional data beyond that provided by the social network is required, this additional data will be requested and must be completed on the registration form, subject to its applicable privacy policies.

8. MINORS

Minors may not use the services available through the website without the prior authorization of their parents or guardians as legal representatives, who will be solely responsible for all actions carried out through this website by such minors under their care, including the completion of any forms that may exist and the marking, where appropriate, of the boxes that accompany them.

Regarding the specific matter of personal data protection, and in accordance with Articles 8 of the GDPR and 7 of the LOPDGDD, only individuals aged fourteen and over may lawfully consent to the processing of their personal data. For individuals under fourteen, parental or guardian consent is required for processing, and such processing will only be considered lawful to the extent that the parents or guardians have authorized it. Under no circumstances will data relating to the professional or financial situation, or the privacy of other family members, be obtained from a minor without the prior consent of those members.

9. RIGHTS AND ADDITIONAL INFORMATION ON DATA PROTECTION.

The interested party has the right to obtain confirmation as to whether Lena Grams processes personal data concerning him or her, as well as to access his or her personal data, request the rectification of inaccurate data or, where appropriate, request its erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

In certain circumstances, the interested party may request the limitation of the processing of their data, in which case they will only be kept for the exercise or defense against possible claims.

Similarly, in certain circumstances and for reasons related to their particular situation, the data subject may object to the processing of their data. Lena Grams  will cease processing the data, except for compelling legitimate grounds, or for the establishment, exercise, or defense of legal claims. Likewise, the data subject has the right to data portability where technically feasible and in certain circumstances.

Furthermore, any previously given consent may be withdrawn at any time.

Furthermore, you have the right not to be subject to decisions based solely on the automated processing of your data, including profiling. In such hypothetical cases where such decisions are made, you would be duly informed accordingly.

The interested party may raise any questions they deem relevant in relation to this policy, obtain additional information on data protection, as well as exercise their rights under the legally established terms, by sending a communication to: Lena Grams via email, indicating the corresponding application and accompanied by a copy of the ID card or other document proving identity with respect to the power to exercise their rights. If acting through a representative, a copy of the representative’s ID card (or equivalent document) and documentation proving the representative’s power of attorney must also be provided.

You can obtain templates for exercising your various data protection rights on the website of the Spanish Data Protection Agency . You can also obtain these templates and forms by requesting them directly from the Agency.

If you believe that your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency: www.aepd.es.