Privacy

LA RIOJA ALTA, S.A. PRIVACY POLICY AND PERSONAL DATA PROTECTION

PERSONAL DATA PROCESSING

In compliance with the provisions of the applicable regulations on Data Protection, we hereby notify you that the data will be processed by LA RIOJA ALTA, S.A. as Controller. The purpose of processing is the provision of the service requested by the user through our contact form. In order to do so, we need you to check the box that indicates your acceptance of this policy. Should you refrain from doing so, we will lack your express consent and will therefore be unable to respond to your request.

For the proper provision of the services offered by LA RIOJA ALTA, S.A., the user should answer each and every one of the questions that appear in our website forms. You, the user, also represent to be of legal age.

The purpose of processing the personal data requested is, in addition, to send commercial information relating to products and services offered now and in the future by LA RIOJA ALTA, S.A. Such information includes advertising and promotional communications via postal mail, fax, email or any other means. To perform this processing it is necessary that the user check the box enabled for that purpose in the form on the website.

Given the personal nature of the data provided,LA RIOJA ALTA, S.A. undertakes to treat them as strictly confidential, maintaining due secrecy. To this purpose, the entity has implemented suitable security measures in accordance with relevant risk analyses.

We hereby notify you that your data will not be transferred to third parties nor will international transfers be carried out, except under legal obligation or necessary assignment and then, only and exclusively when it is necessary for the provision of the service requested, in which case relevant consent will be sought.

RIGHTS

The data that is collected and processed will be kept for a limited period of time. This period will be in compliance with the legal obligations imposed on LA RIOJA ALTA, S.A. by the various applicable regulations.

As data subject, the user can exercise the following rights at any time at the address indicated in the Legal Notice:

• Right of access: the data subject may request the Controller which data are processed and, as the case may be, the data subject’s specific personal data that are processed.
• Right to rectification: the data subject may request that the Controller rectify their personal data should it not be accurate.
• Right to erasure: the data subject may request that the Controller erase their personal data.
• Right to object: the data subject may object to the Controller’s processing of their personal data.
• Right to restrict processing: the interested party may request that the Controller temporarily refrain from processing their personal data under specific circumstances.
• Right to data portability: the data subject may request that the Controller provide their automated data in a structured, commonly used and machine readable format.

More information about your rights at www.agpd.es.

Likewise, you have the right to file a complaint with the Spanish Data Protection Agency.

COOKIES

The data that is stored in each cookie is as follows: language, date and time of the last time the user visited our Website, design of contents that the user chose during their first visit to our Website and security elements involved in controlling access to restricted areas.

At this Website we study the preferences of our users (demographic aspects, traffic patterns and other information which altogether helps us understand our users’ behaviour and profile). Tracking our users’ preferences helps us improve our Website, as well as our services.

To do this, we use Google Analytics (a tool developed by Google to measure traffic on websites), which may store cookies in your computer to help us collect information that will be used only for statistical purposes and to study the behaviour of users of our Website. The information collected by the cookie (including IP) is stored and transmitted to the Google servers in the United States. Google will use this information to collect your activity on our site and generate reports for the purpose of identifying the use made of the site. Google may provide such information to third parties when so required by Law. Acceptance of this policy means the acceptance of the use by Google of the information collected by Google Analytics.

Users can configure their browsers to reject the storage of cookies on their computer. You can find more information in our Cookies Policy.

PERSONAL DATA PROCESSING

CONTROLLER

• Who is the controller of your data?
• Identity: LA RIOJA ALTA, S.A.
• Postal address: Avenida Vizcaya 8 - 26200 - Haro
• Email: info@riojalta.com

PURPOSE OF PROCESSING

What is the purpose of processing your personal data?

At LA RIOJA ALTA, S.A. we provide the information provided by data subjects for the following purposes:

• Managing and administrating contractual relationships with suppliers, clients, partners and employees.
• Provide the data subjects with Commercial information about products and services that may be of interest to them.
• Video surveillance of the facilities in the event that you visit them.
• Responding to any inquiries that you may send us through our website.
• Evaluating your application for a future job vacancy, if you have sent us your CV.

How long will we keep your data?

The personal data provided will be preserved:

a) As long as our trading relationship is maintained.

b) Provided the data subject does not request its erasure.

c) In the case of information that must be kept for a specific time by legal requirement, for as long as set out in such requirement.

LEGITIMATION FOR PROCESSING THE DATA

What is the legitimation for processing your data?

The legal basis for processing your data is as follows:

• Execution of contract in the event that you are an employee, client or supplier...
• Legitimate interest in the event that it has been recorded by video surveillance cameras
• Consent of the data subject given through the Website to send a request or inquiry using our contact form. Social media image.
• Consent of a data subject who has sent a CV.
• Legitimate interest when making sending advertising.

RECIPIENTS OF PERSONAL DATA

Who will be given your personal data?

a)The data will be communicated by legal requirement to

• Social security organisations (in the case of employees).
• Public registries
• Professional associations
• Fuerzas y cuerpos de seguridad (En el caso de videovigilancia)
• Tax authorities (in the case of employees, suppliers and clients)
• Other public administration entities (in the case of employees, suppliers and clients)
• Spanish National Securities Market Commission
• Spanish National Gaming Commission
• Law enforcement agencies (in the case of video surveillance)
• Fulfilment/breach of monetary obligations
• Insurance companies (case of employees)
• Other financial institutions
• Health institutions
• Telecommunications services
• Publishing or direct marketing companies
• Not-for-profit associations and organisations
• Trade unions and staff meetings
• Competent public administrations
• European Union entities

b) The data will be communicated by contractual requirement to:

• Organisations/individuals related to the Controller.
• Notaries and solicitors (in the case of services provided to legal clients)
• Banks, savings banks, and rural savings banks

c) The data (IMAGES) of WORKERS/CLIENTS/EVENTS will be communicated by their consent granted to the following social media:

• Facebook.
• Twitter.
• Linkedin.
• Youtube.

*The assignments described in this section entail an international transfer of data to the United States of America, for which the data subject granted their consent.

RIGHTS OF DATA SUBJECTS

What are your rights?

Anyone has the right to obtain confirmation about whether we are processing personal data concerning them

• Right of access: the data subject may request the Controller which data are processed and, as the case may be, the data subject’s specific personal data that are processed.
• Right to rectification: the data subject may request that the Controller rectify their personal data should it not be accurate.
• Right of suppression: the data subject may request that the Controller erase their personal data when, among other reasons, such data are no longer necessary for the purposes for which they were collected.
• Right to object: the data subject may object to the Controller’s processing of their personal data.
• Right to restrict processing: the interested party may request that the Controller temporarily refrain from processing their personal data under specific circumstances.
• Right to data portability: the data subject may request the Controller that it provide their automated data in a structured, commonly used and machine readable format.

How can rights be exercised?

In writing, addressed to LA RIOJA ALTA, S.A., Avenida Vizcaya 8 - 26200 - Haro

How can complaints be lodged?

If you consider that your rights have not been properly addressed, you have the right to file a complaint with the Spanish Data Protection Agency, Calle Jorge Juan, 6. 28001 – Madrid.