1.Who will process your data?

2.What will your data be used for?

If you exercise a right related to data protection: To manage the obligations of attention to the exercise of rights related to data protection of individuals.

If you are notified of a security breach: to manage and evaluate security breaches that occur.

If you have a business or administrative relationship with us: In the case of being an intervener of a contract as a self-employed person or being a natural person, to maintain and develop the contractual relationship. If, as a contractual partner, you are a representative or contact person of a legal entity, the purpose is to maintain contact with the entity you represent or work for.

If you are a natural person or a contact person of a legal entity or an individual entrepreneur to manage the communication actions, doubts and queries that we may have.

3.Retention periods or criteria. How long will we keep your data?

If you exercise a right related to data protection: they will be kept for three years from the termination of the attention of the right. Statute of limitations for very serious infringements.

If you are notified of a security breach: they will be retained for three years from the termination of the attention of the right. Statute of limitations for very serious breaches.

If you have a business or administrative relationship with us: if you are a party to a contract and are self-employed or a natural person, the data will be kept for the time necessary to fulfil the purpose for which they were collected and to determine possible liabilities and to deal with any claims that may be filed in the future against the entity. If you are a representative or contact person of a legal entity, as long as you maintain your representation or professional position or as long as you do not request its deletion.

If you are a contact person of a legal entity or an individual entrepreneur and the legal entity or your company is to be the recipient of our commercial offers, we will keep them as long as you do not exercise your right of objection.

4.Legitimation Why are we entitled to process your personal data?

If you exercise a right related to data protection: Because the processing is necessary for compliance with a legal obligation applicable to the controller (Article 6(1)(c) of the General Data Protection Regulation (EU) 2016/679).

If you are notified of a security breach: because the processing is necessary for compliance with a legal obligation applicable to the controller (Article 6(1)(c) of the General Data Protection Regulation (EU) 2016/679).

If you have a business or administrative relationship with us: In the case of being an intervener of a contract and being self-employed or a natural person, the purpose of the processing is to maintain and develop the contractual relationship. We are entitled to do so because we are permitted by Article 9(2)(c) General Data Protection Regulation (EU) 2016/679) as it is necessary for the performance of a contract or for the implementation of pre-contractual measures at the request of the data subject. If you are a party to a contract as a representative of a legal person or are a contact person of such a legal person, we are entitled to process your data because the processing is necessary for the fulfilment of legitimate interests pursued by the controller or a third party (Article 6.1.f) General Data Protection Regulation (EU) 2016/679).

If you are a contact person of a legal person or an individual entrepreneur and the legal person or your company to be the recipient of our commercial offers
Because the processing necessary for the fulfilment of legitimate interests pursued by the controller or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (Article 6(1)(f) of the General Data Protection Regulation (EU) 2016/679.

5.Obligation to provide your data Why are you or are you not obliged to provide your data?

If you have a business or administrative relationship with us as a supplier and must enter into a contract: You are obliged to provide us with your data because they are necessary to carry out the contract, therefore the refusal to provide them prevents us from entering into the contract.

6.To which recipients will your data be communicated or transferred?

If you exercise a right related to data protection: the data can be communicated to the Spanish Data Protection Agency. Fulfilling an obligation

legal applicable to the controller (Article 6(1)(c) of the General Data Protection Regulation (EU) 2016/679).

If you are notified of a security breach: the data is communicated to the Spanish Data Protection Agency. Compliance with a legal obligation applicable to the controller (Article 6.1.c) of the General Data Protection Regulation (EU) 2016/679). They may also be communicated to the State Security Forces and Corps.

If you have a business or administrative relationship with us: In the case of being an intervener of a contract and being self-employed or a natural person, the data will be sent to banks savings banks and rural banks for payment and collection of invoices and expenses for the fulfilment of contractual obligations. And they will be presented to the Tax Agency of the declaration models prepared: Law 58/2003, of 17 December, General Taxation. If you are a party to a contract as a representative of a legal entity or a contact person of such a legal entity, we will not disclose your data to third parties, unless we are legally obliged to do so. We will not make any international transfer of data to third countries or international organisations.

If you are a contact person of a legal entity or an individual entrepreneur and the legal entity or your company is to be the recipient of our commercial offers
The data will not be passed on to third parties nor will we make any international transfer of the data to third countries or international organizations except as legally required, or the transfer or communication to other companies of the group collected in the collection of personal data through the express consent.

7.What are your rights when you provide us with your data and how can you exercise them?

• Right of access: The right to obtain confirmation as to whether or not Mercado de Fuencarral, S.A. is processing personal data concerning you.
• Right of rectification: The right to request the modification or rectification of your data in the event that it is inaccurate.
• Right of erasure: The right to request that your data be erased or deleted due to unlawful data processing, due to the disappearance of the purpose for which the data was processed or collected, or when you revoke your consent or object to the processing of your data.
• Right to restrict processing If you contest the accuracy of the data, pending verification of the accuracy of the data by us or if you have exercised your right to object to the processing of the data, pending verification of whether the legitimate reasons of the controller outweigh your rights.
• Right to the conservation of your data - If the processing is unlawful and we oppose the deletion of the data by requesting the limitation of its use - If the data is needed for the formulation, exercise or defense of claims.
• Right to data portability: In a structured, commonly used, machine-readable format, provided that it is technically possible for portability and where they have been used/processed with your consent or because of a contract.

You can exercise these rights, together with a copy of a document proving your identity, at Mercado de Fuencarral, S.A.

In addition, you have the right to

• To revoke the consent given: In the event that the treatment has its legitimacy in the consent, you have the right to revoke it.
• To file a complaint: You can in any case go to the Data Protection Delegate, you also have the right to file a complaint with the Spanish Data Protection Agency.