Legal information

PRIVACY AND DATA PROTECTION POLICY

In compliance with current legislation, El Gayo (hereinafter also referred to as the Website) is committed to adopting the necessary technical and organizational measures in line with the appropriate level of security for the risk associated with the collected data.

Laws Incorporated in This Privacy Policy

This privacy policy adheres to current Spanish and European regulations regarding the protection of personal data on the internet, specifically observing the following laws:

• Regulation (EU) 2016/679 of the European Parliament and Council, of April 27, 2016, on the protection of individuals with regard to the processing of personal data and the free movement of such data (GDPR).
• Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
• Royal Decree 1720/2007, of December 21, approving the development regulation of Organic Law 15/1999, of December 13, on the Protection of Personal Data (RDLOPD).
• Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the Data Controller

The data controller for personal data collected on El Gayo is El Gayo Ibérico SL, with NIF: B56376569. Contact details are as follows:

• Address: C/ Ortega Y Gasset 14 – 5th Floor, 28006 Madrid, Spain
• Contact phone: +34.648047158
• Contact email: casagayo@outlook.com

Personal Data Registration

In compliance with the GDPR and LOPD-GDD, we inform you that the personal data collected by El Gayo through forms on its pages will be incorporated and processed within our file to facilitate, expedite, and fulfill the commitments established between El Gayo and the User or to maintain the relationship established in the forms completed by the User or to respond to a request or query. Likewise, in accordance with the GDPR and LOPD-GDD, except where the exception of Article 30.5 of the GDPR applies, we maintain a record of processing activities specifying, according to their purposes, the activities undertaken and the additional circumstances stipulated in the GDPR.

Principles Applicable to Personal Data Processing

The processing of the User’s personal data is subject to the following principles as stated in Article 5 of the GDPR and Article 4 et seq. of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights:

• Principle of lawfulness, fairness, and transparency: User consent is required, with fully transparent information on the purposes of data collection.
• Principle of purpose limitation: Personal data will be collected for specified, explicit, and legitimate purposes.
• Principle of data minimization: Only strictly necessary personal data for the purposes of processing will be collected.
• Principle of accuracy: Personal data must be accurate and kept up to date.
• Principle of storage limitation: Personal data will be kept only as long as necessary for processing purposes.
• Principle of integrity and confidentiality: Personal data will be processed in a manner that ensures its security and confidentiality.
• Principle of proactive responsibility: The data controller is responsible for ensuring compliance with these principles.

Categories of Personal Data

El Gayo only processes identifying personal data. No special categories of personal data, as defined in Article 9 of the GDPR, are processed.

Special categories of personal data include those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying an individual, health data, or data on an individual’s sex life or sexual orientation.

To process special categories of personal data, explicit User consent for one or more specific purposes is required.

Legal Basis for Processing Personal Data

The legal basis for processing personal data is consent. El Gayo commits to obtaining explicit and verifiable User consent for processing their personal data for one or more specific purposes.

The User has the right to withdraw consent at any time. Withdrawal of consent will be as easy as providing it. As a general rule, withdrawing consent will not condition the Website’s use.

When the User needs or may provide data via forms for inquiries, information requests, or content-related matters, the User will be informed if any data is required, as it is essential to complete the intended operation correctly.

Purposes of Processing Personal Data

Personal data is collected and managed by El Gayo to facilitate, expedite, and fulfill commitments established between the Website and the User or to maintain the relationship outlined in the forms completed by the User or to respond to a request or inquiry.

Data may also be used for commercial purposes related to customization, operations, statistics, and activities aligned with El Gayo’s corporate objectives, as well as for data extraction, storage, and marketing studies to tailor Content to the User, improving the Website’s quality, functionality, and navigation.

Upon collecting personal data, the User will be informed of the specific purpose(s) of the data processing, i.e., the intended use(s) of the collected information.

Personal Data Retention Periods

Personal data will only be retained for the minimum time necessary for processing purposes and, in any case, only for the following period: 12 months, or until the User requests its deletion.

When personal data is obtained, the User will be informed about the retention period for the data or, when this is not possible, the criteria used to determine this period.

Recipients of Personal Data

The User’s personal data will not be shared with third parties.

In any case, the User will be informed of the recipients or categories of recipients of the personal data at the time of data collection.

The User’s personal data may be shared with the following recipients or categories of recipients:

If the Data Controller intends to transfer personal data to a third country or international organization, the User will be informed at the time of data collection of the intended third country or organization and whether or not there is a Commission adequacy decision.

Minor’s Personal Data

In compliance with Articles 8 of the GDPR and 7 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, only those over the age of 14 may provide valid consent for the lawful processing of their personal data by El Gayo. If under the age of 14, parental or guardian consent is required, which will be considered valid to the extent of such authorization.

Confidentiality and Security of Personal Data

El Gayo is committed to taking necessary technical and organizational measures appropriate to the data’s security level, ensuring the safety of personal data to avoid destruction, accidental loss, or alteration, or unauthorized access or communication.

The Website has an SSL certificate (Secure Socket Layer), ensuring personal data is securely and confidentially transmitted, as data exchange between the server and the User is fully encrypted.

However, as El Gayo cannot guarantee internet invulnerability or prevent hackers or others from fraudulently accessing personal data, the Data Controller commits to promptly informing the User of any breach likely to risk individual rights and freedoms. In line with Article 4 of the GDPR, a personal data breach is understood as any security breach resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to transmitted, stored, or otherwise processed personal data.

Personal data will be treated as confidential by the Data Controller, who undertakes to ensure and guarantee that this confidentiality is maintained by employees, associates, and anyone else to whom access is given.

Rights Derived from Personal Data Processing

The User has the following rights recognized under the GDPR and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights:

• Right of access: The right to obtain confirmation from El Gayo of whether or not personal data is being processed and, if so, access that data.
• Right to rectification: The right to modify personal data that is inaccurate or, considering processing purposes, incomplete.
• Right to deletion (“right to be forgotten”): The right to delete personal data, provided it is no longer necessary for the purposes for which it was collected.
• Right to restrict processing: The right to restrict data processing when data accuracy is contested, processing is unlawful, or data is no longer needed but required for claims.
• Right to data portability: For automated processing, the right to receive personal data in a structured format, allowing transmission to another data controller.
• Right to object: The right to cease the processing of personal data by El Gayo.
• Right to not be subject to automated decision-making, including profiling: The right to not be subject to automated decision-making based solely on personal data processing unless otherwise legally mandated.

Thus, the User may exercise rights by submitting written communication to the Data Controller, referencing “GDPR-” and specifying:

• Name, surname, and copy of DNI (or other valid proof of identity)
• Request details and relevant information
• Notification address
• Date and signature
• Relevant supporting documents

This request and any other accompanying document may be sent to the following address and/or email:

• Postal address: Ortega y Gasset 14, 5th Left, Madrid, Spain 28006
• Email: casagayo@outlook.com

Links to Third-Party Websites

The Website may include hyperlinks or links to web pages operated by third parties, independent of El Gayo. The owners of such sites have their data protection policies and are responsible for their practices.

Complaints to the Supervisory Authority

If the User considers a breach of applicable law exists in the way their personal data is being handled, they have the right to effective judicial protection and to file a complaint with a supervisory authority in their usual residence, workplace, or alleged breach location. In Spain, the supervisory