1.Who will process your data?

2. What will your data be used for?

If you exercise a right related to data protection: To manage the obligations of attention to the exercise of rights related to the protection of data of individuals.

If you are notified of a security breach: to manage and assess the security breaches that occur.

If you have a business or administrative relationship with us: If you are involved in a contract as a self-employed person or as an individual, to maintain and develop the contractual relationship. If, as a party to a contract, you are the representative or contact person of a legal entity, the purpose is to maintain contact with the entity you represent or work for.

If you are a natural person or a contact person of a legal entity or an individual entrepreneur to manage communication actions, doubts and queries that may be made to us.

3.Storage periods or criteria. How long will we keep your data?

If you exercise a right related to data protection: it will be kept for three years from the termination of the right. Prescription of very serious infringements.

If you are notified of a security breach: they will be kept for three years from the termination of care. Prescription of very serious infractions.

If you are involved in a business or administrative relationship with us: in the case of being a party to a contract and being a self-employed person or an individual, the data will be kept for the time necessary to fulfill the purpose for which it was collected and to determine possible liabilities and deal with any claims that may be filed against the entity in the future. If you are a representative or contact person of a legal entity, as long as you maintain your representation or professional position or as long as you do not request its deletion.

If you are a contact person of a legal entity or a sole proprietorship and the legal entity or its company to be the recipient of our commercial offers, we will keep them as long as you do not exercise your right of objection.

4.Legitimacy Why are we entitled to process your personal data?

If you exercise a right related to data protection: Because the processing is necessary for the fulfilment of a legal obligation applicable to the data controller (article 6.1.c) of Regulation (EU) 2016/679 General of Data Protection).

If you are informed of a security breach: Because the processing is necessary for the fulfilment of a legal obligation applicable to the data controller (Article 6.1.c) of Regulation (EU) 2016/679 General on Data Protection)

If you have a business or administrative relationship with us: In the case of being a party to a contract and being autonomous or a natural person, the purpose of the processing is to maintain and develop the contractual relationship. We are entitled to do so because it is allowed by article 9.2.c) Regulation (EU) 2016/679 General Data Protection) as it is necessary for the execution of a contract or for the application of pre-contractual measures at the request of the data subject. If you are involved in a contract as a representative of a legal person or are a contact person for that legal person, we are entitled to process your data because the processing is necessary for the fulfilment of legitimate interests pursued by the controller or by a third party (Article 6.1.f) of Regulation (EU) 2016/679 General Data Protection).

If you are a contact person of a legal person or a sole proprietor and the legal person or its company to be a recipient of our commercial
offers Because the processing necessary for the satisfaction of legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (Article 6.1.f) of Regulation (EU) 2016/679 General Data Protection.

5.Obligation to provide your data Why do you have to provide your data or not?

If you are in a business or administrative relationship with us as a supplier and have to enter into a contract: You are obliged to provide us with your data because they are necessary for us to carry out the contract and therefore the refusal to provide them prevents us from entering into such a contract.

To which recipients will your data be communicated or transferred?

If you exercise a right related to data protection: the data can be communicated to the Spanish Data Protection Agency. Fulfilment of an obligation

legal applicable to the data controller (Article 6.1.c) of Regulation (EU) 2016/679 General on Data Protection).

If you are notified of a security breach: the data is reported to the Spanish Data Protection Agency. Compliance with a legal obligation applicable to the data controller (Article 6.1.c) of Regulation (EU) 2016/679 General on Data Protection) In addition, they may be communicated to the State Security Forces and Corps.

If you have a business or administrative relationship with us: In the case of being a party to a contract and being self-employed or a natural person, the data will be sent to banks, savings banks and rural banks for payment and collection of invoices and expenses for the fulfilment of contractual obligations. And they will be presented at the Tax Office with the declaration models prepared: Law 58/2003, of 17 December, General Tax Office. If you are involved in a contract as a representative of a legal entity or are a contact person for this legal entity, we will not communicate the data to third parties, unless we have a legal obligation to do so. We will not carry out any international transfer of the data to third countries or international organisations.

If you are a contact person of a legal entity or a sole proprietorship and the legal entity or its company is to be a recipient of our commercial
offers, the data will not be passed on to third parties nor will we carry out any international transfer of the data to third countries or international organizations except as required by law, or the transfer or communication to other companies of the group collected in the collection of personal data through express consent.

7.What are your rights when you provide us with your data and how can you exercise them?

• Right of access: Right to obtain confirmation as to whether or not LULA PLAYA S.L. is processing personal data concerning you.
• Right of rectification: Right to request the modification or rectification of your data in case they are inaccurate
• Right of suppression: Right to request that your data be deleted or suppressed due to illicit processing of data, the disappearance of the purpose for which the data was processed or collected, or when you revoke your consent or object to the processing.
• Right to limit the processing If you contest the accuracy of the data, while we are checking the accuracy or if you have exercised your right to oppose the processing of the data, while we are checking whether the legitimate reasons of the data controller prevail over your rights
• The right to the conservation of your data - If the treatment is illicit and we oppose to the suppression of the data asking for the limitation of its use - If the data is needed for the formulation, exercise or defense of claims.
• Right of data portability: In a structured, commonly used, machine-readable format, where technically possible for portability and where it has been used/treated with your consent or because there is a contract
  
  

You can exercise these rights, together with a copy of a document that proves your identity, before Lula Playa S.L..

In addition, you have the right

• To revoke the consent given: In the event that the processing has its legitimacy in the consent, you have the right to revoke it.
• To file a complaint: You can go in any case to the Data Protection Delegate, you also have the right to file a complaint with the Spanish Data Protection Agency.