Privacy policy

This privacy policy has been drafted in accordance with the provisions of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and Organic Law 3/2018 of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

Identification of the Data Controller

Identity	D`QUART S.L.
NIF	B28864817
Postal Address	Calle Jose Abascal, 44 – piso 1 dr. D9, Madrid, 28003
Registry Data	D’QUART S.L.
Email Address	dquartsl@gmail.com
DPD Contact	968 249 262

For what purposes may D`QUART process your personal data?

Below, we will detail the purposes for which we may process your personal data depending on your relationship with us; we also indicate the legal basis for this processing, the retention period, and whether there are recipients who may have access to your data:

PROCESSING	STUDENT RESIDENCE
Purpose of processing	The data requested by the data controller will be processed to provide services related to the student residence, such as management and reservation of spaces.
Categories of interested parties	Customers and interested parties who are the owners of personal data.
Categories of personal data	Identification data Personal data Payment/banking data.
Categories of recipients	The data will not be shared with anyone. However, in compliance with current law, we may send personal data to the law enforcement authorities (FFCCSE) if required.
International transfers	None foreseen.
Retention period	We will retain the data for the time necessary to address responsibilities arising from the processing. As long as the user/customer keeps their account active, we will retain the personal data.
Legal basis	Execution of a contract in which the interested party is a party or at their request for the application of pre-contractual measures. Art. 6.1.b) GDPR. Without the requested data, we will not be able to provide the specific service as they are necessary to create a user account, among other activities.
Automated decisions or profiling	None are made.

PROCESSING	ADMINISTRATIVE AND ACCOUNTING MANAGEMENT
Purpose of processing	Personal data will also be processed to manage the internal administration and accounting of the data controller, such as generating invoices.
Categories of interested parties	Customers and interested parties who are the owners of personal data.
Categories of personal data	Customers and interested parties who are the owners of personal data.
Categories of recipients	Public administrations with competence in the matter, such as the AEAT and other similar administrations.
International transfers	None foreseen.
Retention period	We will retain the data for the time necessary to address responsibilities arising from the processing. For example, billing data will be retained for a maximum of 10 years, according to the current tax laws. Accounting data will be retained for 6 years.
Legal basis	The processing is necessary to comply with legal obligations of the controller. Art. 6.1.c) GDPR.
Automated decisions or profiling	None are made.

PROCESSING	HUMAN RESOURCES
Purpose of processing	Processing of the data of employees and job applicants to manage the activities related to labor relations: hiring, firing, interviews, and other related purposes. This includes internship students who may perform internships in our entity.
Categories of interested parties	Employees, job applicants, and internship students.
Categories of personal data	Identification data, personal data, SS number for employees, other data related to employer obligations, such as payroll and occupational risk prevention. CV data will also be processed. Identification data for trainees. Other necessary data according to the agreement signed with the institution of origin.
Categories of recipients	Public administrations with competence in the matter, such as AEAT, Social Security, and other similar administrations.
International transfers	None foreseen.
Retention period	We will retain the data for the time necessary to address responsibilities arising from the processing. CVs will be retained for a maximum of 1 year from receipt. Employee and labor-related data will be retained according to applicable regulations such as Social Security Law, LISOS, etc. For example, payroll data will be retained for 4 years.
Legal basis	The processing is necessary to comply with legal obligations of the controller. Art. 6.1.c) GDPR. Also for fulfilling labor contract obligations. Art. 6.1.b) GDPR. Regarding CV data, the data will be processed under the legitimate interest of the data controller in announcing potential job openings to fill positions within the entity. Art. 6.1.f) GDPR.
Automated decisions or profiling	None are made.

PROCESSING	NEWSLETTER
Purpose of processing	The email will be used to send the data controller's informational newsletter.
Categories of interested parties	The recipients of the communication.
Categories of personal data	Email address.
Categories of recipients	None foreseen.
International transfers	None foreseen.
Retention period	The newsletter will be sent until the user decides to unsubscribe or object to the processing.
Legal basis	The explicit consent of the user. Art. 6.1.a) GDPR.
Automated decisions or profiling	None are made.

PROCESSING	SECURITY BREACH MANAGEMENT
Purpose of processing	To manage personal data security breaches that may occur in the processing activities of the data controller.
Categories of interested parties	All the data subjects whose data has been obtained by the controller.
Categories of personal data	All personal data collected by the controller.
Categories of recipients	The competent authority in the matter: AEPD (Spanish Data Protection Agency).
International transfers	None foreseen.
Retention period	During the statute of limitations for violations arising from the processing.
Legal basis	The processing is necessary to comply with legal obligations of the controller. Art. 6.1.c) GDPR.
Automated decisions or profiling	None are made.

PROCESSING	EXERCISING DATA SUBJECT RIGHTS
Purpose of processing	To address data subjects' rights under the GDPR (access, rectification, deletion, opposition, restriction, and portability).
Categories of interested parties	All the data subjects whose data has been obtained by the controller.
Categories of personal data	All personal data collected by the controller.
Categories of recipients	The competent authority in the matter: AEPD (Spanish Data Protection Agency).
International transfers	None foreseen.
Retention period	During the statute of limitations for violations arising from the processing.
Legal basis	The processing is necessary to comply with legal obligations of the controller. Art. 6.1.c) GDPR.
Automated decisions or profiling	None are made.

More information about the rights under data protection law

What rights does the data subject have?

The GDPR grants you the following rights, which you can exercise by sending an email to the data controller's address:

Right of access

You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and, if so, the right to access the personal data and information related to its processing.

You have the right to obtain a copy of the personal data being processed.

Right of rectification

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to complete incomplete personal data.

Right of erasure

You have the right to obtain without undue delay the erasure of personal data concerning you.

We are obliged to erase personal data without undue delay when any of the following circumstances apply:

The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
The data subject withdraws consent for specific purposes or the explicit consent given for the processing of special categories of data, such as those revealing political opinions, provided that this processing is not based on any other legal ground;
The data subject objects to the processing for reasons related to their particular situation and no other legitimate grounds for the processing prevail;
The personal data has been processed unlawfully;
The erasure of personal data is necessary for compliance with a legal obligation under Union or Member State law applicable to the data controller.

The obligation to erase personal data will not apply when the processing is necessary for:

The exercise of the right to freedom of expression and information;
Compliance with a legal obligation that requires processing imposed by Union or Member State law applicable to the data controller;
The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impede the achievement of the objectives of that processing;
The exercise, defense, or presentation of claims.

Restriction of processing

You have the right to obtain restriction of the processing of personal data when one of the following conditions is met:

You contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the data;
The processing is unlawful and you oppose the erasure of the personal data and request instead the restriction of its use;
We no longer need the personal data for the purposes of processing, but you need it for the establishment, exercise, or defense of legal claims;
You have objected to the processing for reasons related to your particular situation, while it is being verified whether the legitimate grounds of the data controller override those of the data subject.

Data portability

You have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format.

Right to object to processing

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is based on Article 6(1)(e) or (f) of the GDPR. We will cease processing the personal data, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Withdrawal of consent

You have the right to withdraw at any time the consent you have given for the processing of your personal data.

Complaints to the data protection authorities

You have the right to lodge a complaint with the supervisory authority in the area of data protection if you believe that your personal data is not being processed correctly.

In this case, the competent authority is the Spanish Data Protection Agency (AEPD). You can exercise your rights at the following address: https://sedeagpd.gob.es/sede-electronica-web/vistas/infoSede/inicio.jsf

Processing of data of minors

Our web services should be used by individuals over the age of 14. If you are under this age, you should refrain from using them.

We may require official documentation to verify your age.

Modification of this privacy policy

Due to legislative and jurisprudential updates, this privacy policy may be modified to adapt to new legal realities. In such cases, the controller will announce changes on this page with reasonable prior notice before they come into effect.