I. DATA CONTROLLER
Who is the Data Controller of your data?
Holder: GRACIA HNOS S.A.U. (hereinafter, “GRACIA HNOS”)
Company Tax ID: A14009773
Registered address: Avda. Luis de Góngora y Argote, s/n, 14550 MONTILLA, Córdoba – España
Contact number: 957 650 500
Data Protection Officer (hereinafter, “DPO”):
Telephone: 957 650 500
II. PURPOSE OF THE DATA PROCESSING AND DATA CATEGORIES PROCESSED
What data categories do we process?
Depending on the Platform, GRACIA HNOS processes the following data categories:
ID data: name, surname, address, email address, postcode, telephone, National ID, car registration
Academic and professional data: education/titles, student record, professional experience, affiliation to professional boards or associations, in the case of selection processes.
User identification codes or passwords.
Traffic and location data.
Electronic communication metadata.
Commercial information data.
Economic, financial or bank data.
The personal data requested is mandatory. If you don’t provide them, the hired services cannot be delivered.
If the user provides third-party data, the user states they have consent from the third party and commits to sharing the information in this clause, waiving any responsibility from GRACIA HNOS in this sense. However, GRACIA HNOS may verify this fact, adopting the appropriate due diligence measures, pursuant to the data protection regulations.
Mercadona reserves the right to perform at any time any corporate verifications required to guarantee the accuracy of the data provided, to avoid potential duplication and/or errors in the information provided by the Customer, thus ensuring the service requests and providing greater legal protection for both parties.
The data that appears with an asterisk (*) in the forms provided by GRACIA HNOS on the Platform is mandatory to comply with the established legal or contractual purpose.
Therefore, if the user does not provide this data, it will not be possible to register them in the Platform or answer their request.
With what purpose and for how long will we process your personal data?
GRACIA HNOS will process the user’s data, manual and/or automatedly, for the following specific purposes:
Manage their registration as users of the online platform owned by GRACIA HNOS (hereinafter, the “Platform”). However, in all circumstances, the user must verify and validate their registration in the Platform by introducing their user name and password, giving consent.
Managing the purchase of products and/or services through the Platform or the establishment, as well as the request for invoices and their collection, provided that the request is made by the interested party or a person designated by them, in which case the relevant authorisation must be given. The data holder may revoke this authorisation at any time.
Send periodically (by email, post and/or SMS) electronic notices with offers, promotions and news related to our online Platform, unless otherwise stated or when the user opposes or revokes their consent.
Send periodically commercial and/or promotional information related to the industry of the products and services hired through the Platform, with added value for the final users, unless otherwise stated or when the user opposes or revokes their consent.
Create anonymous statistical reports regarding access habits and the activities carried out by the users on the Platform.
Create a commercial user profile and carry out business actions that adjust to it, using the data processed from product purchases (browsing data, access habits, traffic), unless otherwise stated or when the user opposes or revokes their consent.
Only when the user specifically ticks the corresponding box, may GRACIA HNOS create a commercial profile using the information provided by third parties, and offer products and services in line with their interests, as well as improve user experience, enabling the possibility of making automated decisions based on the user’s personal preferences or interests, reliability or behaviour, acquired products, etc. Pursuant to this, GRACIA HNOS may present specific offers and send commercial communications adapted to the user’s profile. The user may oppose or revoke their consent at any time.
If you send us your CV or you register for the job offers we publish, we will process your data with the aim of evaluating and handling your job application, to offer you positions adapted to your profile and, if appropriate, carry out the necessary steps to recruit and hire you as an employee. Unless otherwise stated, providing the data is mandatory; therefore, not providing it will prevent from continuing with the selection process.
Comply with the legally established regulations, as well as verify compliance with contractual obligations, including fraud prevention.
Performing the actions required to protect the customers’ essential interests when required.
How long do we store your data?
GRACIA HNOS will retain the user’s personal data only during the time necessary to fulfil the purposes for which it was gathered, as long as the given consent is not revoked. Subsequently, if necessary, the information will remain locked for the legally established periods, in any case, 5 years, or the term set by law for any action that might stem from the processing.
In the case of the data you provide us related to job offers you wish to apply to, the data will be stored for 3 years since the last update. After this time, without any updates, the data will be deleted, unless otherwise stated.
What security measures do we have in place to secure your data?
Encryption of the communication between the user’s device and Mercadona’s servers
Encryption of the information on Mercadona’s servers
Other measures that avoid third-party access to user data
In those cases in which Mercadona has platform maintenance service providers outside of the European Union, these international transfers are regulated pursuant to Merca-dona’s commitment to its clients’ personal data protection, integrity and security.
What is the legal standing for processing your data?
The legal standing for GRACIA HNOS to process user data in order to register the user on the Platform is in the stakeholder’s consent, requested in each case.
Additionally, the handling of the product and service hiring through the Platform, as well as the appropriate payment, invoicing and deliveries, is legitimised by the execution of the contract itself.
The processing of data to send electronic newsletters with offers, promotions and news related to our Platform, commercial and/or promotional information, the creation of anonymous statistical reports regarding access habits and activities of the users on the website, and the creation of commercial profiles using data from handling the products and services hired with GRACIA HNOS, are based on the legitimate interest of GRACIA HNOS of carrying out such processing pursuant to current legislation.
The consents obtained for the mentioned purposes are independent; therefore, the user may revoke one or several of them without affecting the rest.
Furthermore, the user information may be used to comply with GRACIA HNOS’s legal requirements.
In the case of subscribing to published job offers, your data will be processed based on your consent, which may be revoked at any time, although it would mean your application cannot be considered in our personnel selection processes. However, revoking your consent will not affect the lawfulness of past processing.
IV. DATA COMMUNICATIONS
Who will receive your data?
Spanish law enforcement agents pursuant to provisions in legislation.
Banks and financial entities for the payment of the offered services.
V. OTHER DATA PROCESSED BY GRACIA HNOS
Within Mercadona’s commitment to personal data protection and privacy, we inform you of other data processing that could take place in the framework of client relationships, specifically regarding telephone helplines.
In this regard, Mercadona will process the data to improve the quality of its services and will handle the submitted request to provide you, if applicable, with the requested services. If you wish, you can contact us through the telephone numbers available for such purpose. The legal basis of the processing will be adopting pre-contractual measures or developing the contractual relationship itself, as well as, in some cases, your own consent.
Processing data of recorded calls is based on Mercadona’s legitimate interests and, specifically, on the need to monitor and improve the telephone service provided. Data processing to handle your requests.
We also would like to inform you that our stores have a video surveillance system which aims to guarantee the safety of the people and the facilities. We remind you that current legislation authorises this processing based on Mercadona’s legitimate interest to guarantee the safety of the facilities; therefore, your image may be recorded just by ac-cessing the building. This information may be communicated to the Spanish law enforcement agents if necessary. The images will be preserved for a maximum of one (1) month since their recording.
VI. USER RIGHTS
What rights do the stakeholders have?
You may send us a mail through the customer service form (https://info.bodegasgracia.com/en/contact). At any time and free of cost, the following rights:
Revoke given consent.
Obtain confirmation regarding if GRACIA HNOS is processing your personal data or not.
Access your personal information.
Rectify incorrect or incomplete information.
Request the elimination of your data when, among other reasons, it is no longer needed for the purposes it was gathered.
Have GRACIA HNOS limit the processing of your data when one of the conditions foreseen in the data protection legislation is met.
In specific circumstances and due to reasons related to your specific data processing situation, the stakeholders may oppose the processing of their data. GRACIA HNOS will stop processing the data, except for critical legal reasons, or when exercising or defending potential claims.
Receive human intervention, express your view point and contest automated decisions adopted by GRACIA HNOS, if applicable.
Request the transfer of your information.
Present a claim before the Spanish Data Protection Agency (www.agpd.es) when the stakeholder considers that GRACIA HNOS has violated the rights that are recognised by the applicable data protection legislation.