Through this Privacy Policy, BDR Group —hereinafter referred to as BDR or we— informs you about the personal data we collect in connection with the services we provide and which are presented on this website, how we process that data, and the rights granted to you under the applicable personal data protection legislation in relation to your personal data and our processing activities.
Applicable legislation
- Qualified Law 29/2021 of 28 October on Personal Data Protection in the Principality of Andorra —hereinafter the LQPD.
- Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights —hereinafter the LOPDGDD.
- Decree 391/2022 of 28 September 2022 approving the implementing regulations of the LQPD.
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data —hereinafter the GDPR.
Contents
- Who does this Privacy Policy apply to?
- Who is responsible for processing your personal data?
- How do we obtain your personal data?
- What do we use your data for, and on what legal basis?
- Who may we share your personal data with?
- How long do we retain your personal data?
- What rights do you have?
- What responsibilities do you have?
- How do we protect your personal data?
- Changes to this Privacy Policy
1. Who does this Privacy Policy apply to?
This Policy applies to people who interact with BDR through this website, users of the services offered by BDR for the purposes described in Section 4 of this Policy —hereinafter the Services— and anyone whose personal data, such as their image, may appear on our website or in connection with the Services.
2. Who is responsible for processing your personal data?
The sole data controller responsible for processing your personal data in accordance with this Policy is:
BDR Group
Passeig de l’Arnaldeta de Caboet, 11
AD700 Escaldes-Engordany, Andorra
NRT L-707599-R
Commercial Register number 920400X
Email: info@bdrinformatica.com
We have appointed an external data protection officer —Win2win, SLU, an Andorran company specialising in privacy and personal data protection— whom you may contact at any time by emailing DPDextern@win2win.ad.
If you are located in the European Union, you should also be aware that our representative for data protection purposes is COMPLIANCE GAP MITIGATION, whose registered address is Calle Ferraz 28, 2.º izq., 28008 Madrid, Spain. You may contact the company by calling (+34) 917 589 441 or (+34) 915 482 701.
BDR is not responsible for the activities carried out by other websites, even where those websites are accessed through links included on our website. We therefore strongly recommend that you carefully read the information provided by the controllers of those websites before supplying them with your personal data.
3. How do we obtain your personal data?
As a general rule, you provide your personal data to us directly, for example through the forms available on this website.
The only exceptions to this rule are:
- Data provided to us by third parties who purchase our services on your behalf.
- Contact details provided by our product and service suppliers when you represent them.
- Data relating to people whose image or other personal data is published on our website.
- Personal data about you that may appear in emails we receive.
- Cookies used on this website, about which you can find further information in our Cookie Policy.
4. What do we use your data for, and on what legal basis?
To establish and maintain relationships with our suppliers
If you represent a product or service supplier, we collect your contact details and signature to manage our relationship with the supplier you represent, administer its record in our approved supplier list, and manage its quotations and invoices.
To establish and maintain relationships with our clients
We collect data received verbally or in writing, either directly from you, from a third party you represent or from a third party whose services benefit you, when you purchase one of our services, for the purpose of managing the corresponding contract.
The processing of this data is lawful because it is necessary to perform the service agreement to which you are a party.
To select and recruit our staff
We process the information contained in any CV that you voluntarily send us in order to manage your application for a position at BDR.
This processing may include searching, screening and retaining your CV as a potential candidate, conducting the recruitment process and, where applicable, completing the hiring process.
To prepare quotations and offer our services
We collect the information you provide at our offices, over the telephone or by email in order to prepare a quotation for the service you request and, if you accept it, to provide the corresponding service.
To respond to your requests, enquiries or complaints
We collect the personal data you provide by email, over the telephone, through the contact page form or through requests to exercise your data protection rights.
We use this information to respond to your requests, enquiries or complaints concerning our services or the rights you hold in relation to your personal data.
To manage potential future claims
We retain any data that may be necessary to manage possible claims made by you or by us, based on our legitimate interest in defending ourselves and safeguarding our rights.
To ensure the operation of our website through functional cookies
We use functional cookies to collect, store, access and process personal information from your device’s browser for the purpose of ensuring that our website operates correctly.
To obtain aggregated statistics on the use of our website through analytics cookies
We use analytics or statistical cookies to identify the most and least visited pages, analyse which content is of greatest interest to our visitors and measure the success of our information campaigns.
We do this in order to improve the services offered through our website.
To improve the relevance of the advertising you receive through advertising cookies
We download third-party advertising cookies. These files help us infer your interests based on the pages you visit, the content you click on and other actions you perform online.
To use Google services
As part of the obligations imposed by Google LLC on organisations that use Google Analytics and Google Ads, we inform you that both services are operated by Google Inc., whose registered address is 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.
We also inform you that we have enabled IP anonymisation to provide additional safeguards.
To inform you of personal data breaches
If we determine that your data has been misused, exposed as a result of a security breach or improperly obtained by a third party, we will inform you immediately about the breach, the measures we have taken and the steps we recommend that you take.
To protect security through video surveillance
We collect your image through our video surveillance systems for the purpose of protecting people, property and our facilities, as well as retaining video recordings that may be used as evidence.
For other purposes that are compatible with those described above
We may use your personal data for other purposes that are not incompatible with those previously stated, including archiving in the public interest, scientific or historical research and statistical purposes, provided that such processing is permitted by applicable legislation.
5. Who may we share your personal data with?
We do not disclose your personal data to third parties except where:
- You ask us to do so.
- We are legally required to do so.
- We act as an intermediary, for example where we need to purchase a final service on your behalf.
- We act as joint controllers of data collection so that, always with your consent, other organisations may process the data for their own purposes. This is the case with Google Ireland Ltd., which we have appointed to process data collected through the cookies required to use its Analytics services.
- Our service providers need to process the data on our behalf.
- Certain third parties may occasionally have access to the data even though they do not need to process personal data on our behalf.
Any international transfer of data that we may need to carry out will comply with the applicable legislation in force at the relevant time.
6. How long do we retain your personal data?
BDR retains your personal data only for as long as it is required for the relevant processing activities and, subsequently, for the applicable limitation periods relating to any legal liabilities that may arise.
When we no longer have a legitimate purpose for processing certain personal data, we will delete or anonymise it.
Where this is not possible, we will securely store and block the data to prevent any further processing until deletion becomes possible.
7. What rights do you have?
You have the right to obtain confirmation as to whether or not we hold personal data concerning you.
Your rights
You may ask us to exercise the following rights:
- Access your personal data.
- Correct any of your personal data, specifying the reason.
- Delete some or all of your personal data.
- Restrict the processing of your data, specifying the reason for the restriction.
- Object to the processing of your personal data.
- Request the portability of your data where the legal basis for collecting it was consent or a contract.
- Not be subject to automated individual decision-making.
Consent given for either the processing or disclosure of a data subject’s personal data may be withdrawn at any time. Withdrawal of consent will not have retroactive effect.
Where and how you can exercise your rights
You may exercise your rights:
- By sending a written request to BDR at the postal address stated in Section 2 of this Policy.
- By sending the form relating to the right you wish to exercise to DPDextern@win2win.ad and stating “Exercise of Personal Data Protection Rights” in the subject line.
You may also lodge a complaint with the national supervisory authority in your country or contact the Andorran Data Protection Agency —APDA.
8. What responsibilities do you have?
By providing us with your data, you guarantee that it is accurate and complete. You also confirm that you are responsible for the accuracy of the personal data supplied to us and that you will keep it properly updated.
You may not provide us with another person’s personal data unless doing so is justified in connection with the services you request from us.
Where you need to provide us with personal data relating to a child under the age of 16 or a person whose capacity to exercise their rights is restricted, you undertake to obtain the authorisation of the person or persons holding parental responsibility or legal guardianship.
9. How do we protect your personal data?
We are fully committed to protecting your privacy and personal data.
We have created a record of all personal data processing activities we carry out, assessed the risks that each activity may pose to you and implemented appropriate legal, technical and organisational safeguards.
We restrict access to personal data to employees who genuinely need to know that information in order to perform one of the processing activities described in this Policy.
If we determine that your data has been misused, exposed as a result of a security breach or improperly obtained by a third party, we will immediately inform you about the breach and the measures we have taken.
10. Changes to this Privacy Policy
We will update this Policy whenever necessary to reflect changes in applicable legislation or in our data processing activities.
Where the changes are substantial, we will inform you before they take effect.
If you have any questions about this Policy, please contact us at DPDextern@win2win.ad.