Data
protection.

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter GDPR), INGENIERÍA DE PROCESOS Y PRODUCTO I-MAS S.L. (hereinafter Proto&Go!) hereby sets forth the present Policy regarding the processing and protection of personal data.

Data controller details

INGENIERÍA DE PROCESOS Y PRODUCTO I-MAS S.L.

NIF: B-63729495

Registered address: C/ Castello, 19 08110 Montcada i Reixac (Barcelona)

E-mail: info@protoandgo.com

Data Protection Officer contact details: rgpd@protoandgo.com

Scope of data protection

This Policy shall apply:

• To individuals who visit the Proto&Go! website, protoandgo.com (hereinafter, any reference to this shall also include its English and French versions respectively).
• To those who voluntarily communicate with Proto&Go! via email, chat, or complete any of the data collection forms published on the Proto&Go! website.
• To those who request information about the products and services of Proto&Go! or who request to participate in any of the commercial actions of Proto&Go!.
• To those who formalize a contractual relationship with Proto&Go! through the contracting of its products and services.
• To those who use any other service present on the website that implies the communication of data to Proto&Go! or the access to data by Proto&Go! for the provision of its services.
• To any others who, directly or indirectly, have given their express consent for their data to be processed by Proto&Go! for any of the purposes set out in this Policy.

The use of the products and services of Proto&Go! requires the express acceptance of this Policy.

Proto&Go! warns in its data protection policy that, except for the existence of a legally constituted legal representative, no user and/or client can use the identity of another person and communicate their personal data; therefore, the data provided to Proto&Go! must be personal data, corresponding to their own identity, appropriate, relevant, current, accurate, and true. In this regard, the user and/or client will be solely responsible for any direct or indirect damage caused to third parties or to Proto&Go! due to the use of another person's data or their own data when they are false, erroneous, not current, inappropriate, or not relevant. Likewise, the user and/or client who communicates the personal data of a third party will be responsible for having obtained the corresponding authorization from the interested party themselves, as well as for its consequences in the contrary case.

Likewise, the user and/or client who communicates personal data to Proto&Go! declares to be of legal age, in accordance with the provisions of Spanish legislation, refraining from providing data to Proto&Go! in the contrary case. Any data provided about a minor will require the prior consent or authorization of their parents, guardians, or legal representatives, who will be considered responsible for the data provided by the minors under their care.

This Policy will be applied subsidiarily with respect to any other conditions regarding personal data protection that are established in a special manner and communicated, without a limiting character, through the registration forms, contracts, and/or terms of the particular services, being this Policy therefore complementary to the aforementioned ones in anything not expressly provided therein.

Purposes of the collection and processing of personal data

Proto&Go!, in its capacity as data controller, informs users of the existence of several treatments and files in which the personal data communicated to Proto&Go! are collected and stored.

The purposes of such collection and processing of personal data are as follows:

• Regarding the "cookies" used by Proto&Go! during navigation through its websites, they are stored on the user's terminal device (computer or mobile device) and collect information when visiting said websites, with the aim of improving their usability, understanding users' browsing habits or needs to adapt to them, as well as obtaining information for statistical purposes. In the case of users who are already clients of Proto&Go!, the information gathered via cookies will also serve to identify them when accessing the various tools made available by Proto&Go! for service management. In any case, users can configure their browser so that the reception of all or some of the cookies is disabled or blocked. The fact of not wishing to receive these cookies does not constitute an impediment to accessing the information on Proto&Go!'s websites, although the use of some services may be limited. If consent for the reception of cookies is granted and you wish to withdraw it, those stored on the user's device must be deleted via the settings of the different browsers. All information about the cookies used by Proto&Go! is published in its Cookies Policy, available for consultation at https://www.protoandgo.com/politica-de-cookies/.
• In the case of sending an email to Proto&Go! or of personal data communication through any other means, such as a contact form, the purpose of the collection and processing of said data by Proto&Go! is to handle inquiries and information requests regarding Proto&Go!'s products and services.
• In the case of sending an email to Proto&Go! related to its job offers, said data will be processed to participate in personnel selection procedures.
• In accordance with Art. 6, paragraph 1, subsection 1, letter a of the GDPR, having previously obtained your explicit consent to subscribe to our newsletter, we will use the necessary data for that purpose to send commercial communications in accordance with such consent. You may unsubscribe from the newsletter at any time by sending a message to our contact address described here or by clicking on the link provided for that purpose in the e-mail with such commercial communication. After unsubscribing, we will block your e-mail address for this purpose, provided that you have not given your explicit consent for the data to continue being used, or we reserve the right to continue using your data in cases permitted by law.
• In the contracting of the services offered by Proto&Go!, only those personal data that are necessary to establish the contractual relationship and enable the provision of services and remuneration thereof by the clients will be collected, said data being collected and processed with the following purposes:
  • The main purpose will consist of maintaining the contractual relationship established with the client, in accordance with the nature and characteristics of the contracted services, contacting Proto&Go! with the client via the email address, phone number, or other means indicated by the latter.
  • For the maintenance of historical records of business relationships during legally established periods.
  • In cases where Proto&Go! must access and/or process personal data regarding which the client holds the status of data controller or data processor, Proto&Go! will process said data as a data processor in accordance with Article 28 of the GDPR and as indicated in the section titled "Proto&Go! as a data processor", included in this Policy.
  • In compliance with the provisions of Law 25/2007, of October 18, on the conservation of data relating to electronic communications and public communications networks, Proto&Go! informs the user that certain traffic data generated during the development of communications will be retained and conserved, as well as, where applicable, communicated to the competent authorities whenever the legal circumstances provided in said Law occur.
  • For all other purposes, which are expressly recorded in the Specific Terms applicable to the product or service contracted by the client and expressly accepted by the latter.

Retention period of personal data

Proto&Go! will retain personal data for the time strictly necessary to fulfill the aforementioned purposes. Proto&Go! may keep said data duly blocked during the period in which liabilities could arise from its relationship with the client.

In the case of data subject to conservation pursuant to Law 25/2007, of October 18, on the conservation of data relating to electronic communications and public communications networks, the retention period thereof shall be that detailed in said regulation.

Recipients of personal data

The recipients of the personal data collected by Proto&Go! shall be the following:

• The employees of Proto&Go! in the performance of their duties.
• The suppliers of Proto&Go! involved in the provision of the services, in the event that this is necessary for the provision thereof.
• The companies making up the Group of Companies of which Proto&Go! is a part, understood in the sense of Article 42 of the Commercial Code, whose activity is the marketing of services of identical or similar nature offered by Proto&Go!, such as design services, engineering, manufacturing, or innovation development solutions.
• The judicial or administrative authorities, as well as the State Security Forces and Corps, in the event that Proto&Go! is required in accordance with current legislation to provide information related to its clients and its services.
• Any others who, due to the nature of the service, must access the data provided with it, as detailed in the Specific Terms applicable to the product or service contracted by the client and expressly accepted by the latter.

Users' rights and their exercise

Users may exercise at any time the following rights recognized by the GDPR:

• Right of access.
  Users have the right to obtain from Proto&Go! information on whether personal data concerning them are being processed, to access such data, and to obtain information about the processing carried out.
• Right to obtain a copy of your personal data.
• Right to rectification.
  Users have the right to have Proto&Go! rectify their personal data in the event that they are inaccurate or incomplete.
• Right to erasure.
  Users have the right to have their data erased when they are no longer necessary for the purpose for which they were provided or when the other legally stipulated circumstances apply.
• Right to restriction of processing.
  Users have the right to request a restriction on the processing of their personal data, so that the processing operations that should apply in each case are not applied to them, in the scenarios provided for in art. 18 of the GDPR.
• Right to data portability.
  Users have the right to receive the personal data that concern them in a structured format, provided that such data concern exclusively the user and have been provided by them.

Users may exercise these rights in the following ways:

• If you are customers of Proto&Go!, users can check their personal data at any time through the "My Account" section, which is accessed by authenticating from https://protoandgo.com/.
• Whether you are customers of Proto&Go! or not, users can exercise their rights by sending a communication via e-mail to the address info@protoandgo.com or by sending a request accompanied by their D.N.I. or valid legal document that certifies their identity, addressed to Proto&Go!, C/ Castelló 19, 08110, Montcada i Reixac, Barcelona, Spain, to the attention of the Commercial Information Department, specifying the right they wish to exercise.

In cases of manifestly unfounded or excessive requests due to their repetitive nature, Proto&Go! reserves the right to charge a fee for the administrative costs incurred or the right to refuse to act regarding them, in accordance with what is established in art. 12.5 GDPR.

Supervisory Authority

Users and/or customers may contact the local supervisory authority that corresponds if they consider that the processing carried out regarding their personal data has not been carried out in accordance with current legislation.

The data protection supervisory authority in Spain is the Spanish Data Protection Agency, whose contact details are available on its website, specifically at http://www.agpd.es/portalwebAGPD/CanalDelCiudadano/contacteciudadano/index-ides-idphp.php.

International data transfers

In those Proto&Go! products and services where international transfers are required to enable their provision, such a circumstance will be recorded in the Specific Terms that apply to the corresponding product or service contracted by the customer and expressly accepted by them prior thereto.

Proto&Go! as a data processor

In accordance with Article 28 of the GDPR and related provisions, Proto&Go! will process personal data where the client holds the status of data controller or data processor, as necessary for the proper delivery of the contracted services. In such cases, Proto&Go! will act as a data processor, in accordance with the terms indicated below:

• Proto&Go! will process data solely in accordance with the instructions of the client data controller or data processor, not using them for any purpose other than that specified in this Data Protection Policy and/or the applicable contractual terms.
• Once the services triggering the processing of personal data have been delivered, such data will be destroyed, along with any support or documents containing personal data or any type of information generated during, for, and/or for the delivery of the services covered by the respective Conditions. However, the above notwithstanding, Proto&Go! may keep such data securely blocked for the period during which liabilities may arise from its relationship with the client.
• In the event that Proto&Go! uses data for a different purpose or communicates or uses them in violation of this Data Protection Policy and/or the applicable Service Conditions, it will also be considered a data controller.
• Proto&Go! undertakes, in accordance with Article 28 of the GDPR, to maintain professional secrecy regarding personal data to which it must access and/or process in order to fulfill the object of the applicable Service Conditions, both during and after their termination, committing to use such information solely for the intended purpose in each case and to require the same level of commitment from any person within its organization participating in any phase of the data processing for which the client is responsible.
• In accordance with the GDPR, the following rules will apply regarding the form and modalities of access to data for the delivery of services:

1. In the event that Proto&Go! must access processing resources located in the client's facilities, the client will be responsible for establishing and implementing the security policy and measures, as well as communicating them to Proto&Go!, who commits to respecting them and to ensuring their compliance by persons in its organization participating in the delivery of services.
2. When Proto&Go! accesses the client's data processing resources remotely, the client must establish and implement the security policy and measures in its remote processing systems, with Proto&Go! being responsible for establishing and implementing the security policy and measures in its own local systems.
3. When the service is provided by Proto&Go! in its own premises, Proto&Go! will record in its Record of Processing Activities the circumstances related to data processing in the terms required by the GDPR, including the corresponding security measures for such processing.

• Access to and/or processing of data by Proto&Go!, without prejudice to any specific legal or regulatory provisions that may apply in each case or that Proto&Go! may adopt on its own initiative, shall be subject to the necessary security measures to:
  • Ensure the permanent confidentiality, integrity, availability, and resilience of the processing systems and services.
  • Restore the availability and access to personal data quickly in the event of a physical or technical incident.
  • Regularly verify, evaluate, and assess the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
  • Pseudonymize and encrypt personal data, where applicable.
• The client authorizes Proto&Go!, in its capacity as data processor, to subcontract to third parties, on behalf and for the account of the client, the services of storage, custody of data backup copies, and security, and those that may be necessary to enable the provision of the contracted services, respecting in all cases the obligations imposed by the GDPR and its implementing legislation. At any time, the client may contact Proto&Go! to identify the subcontracted entities for the provision of the aforementioned services, which will act in accordance with the terms set out in this document and prior to the formalization of a data processing contract with Proto&Go! in accordance with Art. 28.4 of the GDPR.
• The client authorizes Proto&Go! to carry out the actions indicated below, provided they are necessary for the execution of the provision of the services. Such authorization is limited to the necessary action(s) for the provision of each service and has a maximum duration linked to the validity of the applicable Contractual Terms:
  • To carry out the processing of personal data on portable devices only by users or user profiles assigned to the provision of the services.
  • To carry out the processing outside the client's or Proto&Go!'s premises, only by users or user profiles assigned to the provision of the services.
  • The entry and exit of media and documents containing personal data, including those included in and/or attached to an email, outside the premises under the control of the client responsible for the processing.
  • The execution of the data recovery procedures that Proto&Go! may be obliged to carry out.
• Proto&Go! is not liable for non-compliance with the obligations arising from the GDPR or the corresponding legislation on data protection by the user and/or client in matters pertaining to their activity and that are related to the execution of the contract or commercial relations linking them to Proto&Go!. Each party shall bear the liability arising from its own non-compliance with contractual obligations and the applicable legislation.