Privacy Policy

1. Data Controller and contact details of the Data Protection Officer (DPO).

In accordance with Spanish personal data protection regulations, GDPR[1] and the LOPDGDD[2], MCI Assist, S.L., with Tax Identification Number B81519035 and address at C/ Santa Leonor, 65 – Edif. B – 1º Dcha., 28037, Madrid, is considered the data controller of the Internal Information Channel, hereinafter the “IIC”, as well as the Manager of the Internal Information Channel, hereinafter the “IIC Manager”.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

[2] Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights.

Data subjects may contact the Data Protection Officer by email at dpo@mcimanager.com

 

2. Purposes and lawfulness of processing.

The personal data accessed in the performance of the functions and procedures regulated in this Policy shall be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter the “General Data Protection Regulation” or “GDPR”, and Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights, hereinafter the “LOPDGDD”.

Personal data shall be processed by MCI Assist, S.L. as Data Controller for the purpose of managing, investigating and resolving communications relating to the alleged commission of actions within the organization that may be contrary to the Data Controller’s Code of Ethics or the Law, submitted through the IIC.

In this regard, the processing of personal data through the IIC shall be considered lawful on the basis of compliance with a legal obligation applicable to the data controller, in accordance with Article 6.1.c) of the GDPR, as well as compliance with a task carried out in the public interest or in the exercise of official authority vested in the data controller, in accordance with Article 6.1.e) of the GDPR. Likewise, the processing of special categories of personal data, such as health, race, sexual orientation, etc., which may be processed on the basis of the claim submitted and for reasons of substantial public interest, may be carried out in accordance with Article 9.2.g) of the GDPR.

However, where personal data, including special categories of data, are obtained during the investigation process and are not necessary for the knowledge and investigation of the facts, they shall be immediately deleted from the IIC without being recorded, stored or processed.

For this purpose, and in order to comply with this purpose with all guarantees, we collect the following data:

• Identification data: First name, surname and email address, if the person wishes to identify themselves in the communication.
• Relationship or existing link between the complainant and the Data Controller.
• Description of the event constituting a violation of the Data Controller’s Code of Ethics / ethical principles and values, laws, procedures and/or standards, including all relevant data and details.
• Information on the identity of the persons involved in the event.

 

3. Communication of your personal data

The processing of data by persons other than MCI Assist, S.L., including disclosure to third parties, is legitimized insofar as it is necessary to adopt corrective measures at MCI Assist, S.L. or for the processing of the corresponding sanctioning or criminal proceedings.

In this regard, data may be communicated to the State Security Forces and Corps, Public Administrations with powers over the reported actions, Courts of Justice and other judicial bodies, in the cases provided for by Law and for the purposes defined therein.

 

4. Duration of data processing

Your data shall be kept for the time necessary to investigate the reported facts, considering that:

• Communication filed without processing: If the communication does not meet the formal requirements, relates to a doubt, query or complaint that does not constitute an infringement, is manifestly irrelevant or does not show indications of constituting an infringement, all data shall be deleted from the system within three months from its entry into the IIC.
• Communication admitted for investigation: In compliance with Article 24 of the LOPDGDD, the data shall be kept for a period that may not exceed three (3) months after the date of completion of the investigation procedure. Once this period has elapsed, the information shall be archived. This does not apply to cases in which disciplinary and/or judicial proceedings have been initiated against the person involved, the person who made the communication or a third party, in which case the data may be kept for the time required by the applicable legislation and until any liabilities arising from the communication expire.

 

5. Rights

The data protection rights that data subjects may exercise, where applicable, are:

 

Right	What does it consist of?
Right of access	To consult which personal data are processed by the Data Controller. More information, here.
Right to rectification	To modify the personal data processed by the Data Controller when they are inaccurate, incorrect or incomplete. More information, here.
Right to object	To request that the Data Controller not process your personal data for certain specific purposes. More information, here.
Right to erasure	To request that the Data Controller delete your personal data. More information, here.
Right to restriction	To request that the Data Controller restrict the processing of your personal data. More information, here.
Right to portability	When the processing is carried out by automated means, to receive your personal data in a structured, commonly used, machine-readable and interoperable format, and to be able to transmit them to another data controller. More information, here.
Right not to be subject to automated individual decisions	This right is intended to ensure that you are not subject to a decision based solely on the processing of your data, including profiling, which produces legal effects concerning you or similarly significantly affects you. More information, here.
Right to lodge a complaint with the competent authority	To lodge a complaint against the Data Controller with the Spanish Data Protection Agency (AEPD) if the User considers that the entity has processed their personal data in breach of the regulations.

 

The holders of the personal data obtained may exercise their personal data protection rights by sending a written communication to the registered office of MCI Assist, S.L. at C/ Santa Leonor, 65 – Edif. B – 1º Dcha., 28037, Madrid, or to the email address provided for this purpose: dpo@mcimanager.com.

You may use the following forms to exercise your rights:

• Access to the form to exercise the right of access.
• Access to the form to exercise the right to rectification.
• Access to the form to exercise the right to erasure.
• Access to the form to exercise the right to object.
• Access to the form to exercise the right to restriction of processing.
• Access to the form to exercise the right to portability.
• Access to the form to exercise the right not to be subject to automated individual decisions.

More information on exercising rights is available on the official website of the Spanish Data Protection Agency, hereinafter the “AEPD”, at the following link.

 

6. Security measures

In order to safeguard the security of your personal data, the Data Controller undertakes to maintain the security and confidentiality of the data provided and, specifically, of the data of users who submit a communication through the IIC, preventing access to such data by those who caused the communication regarding the alleged commission of actions within the organization that are contrary to the Law or to the entity’s Code of Ethics. For this purpose, the Data Controller has adopted the legally required security levels for the protection of personal data and has used the technical means at its disposal to prevent the loss, misuse, alteration, unauthorized access and theft thereof, although absolute security does not exist.

Likewise, the Data Controller informs you that all our staff, regardless of the stage of processing in which they are involved, have undertaken to process your data with the utmost care and confidentiality.

 

7. Updating the Privacy Policy

The Data Controller may modify its Privacy Policy in accordance with the legislation applicable at any given time. For this reason, we advise you to read it each time you access the website or carry out any procedure with our organization.