FONTANALS ESPORTIVA SA complies with the duty to inform contained in articles 13 and 14 of the General Data Protection Regulation and must also comply with the principle of lawfulness of processing (article 6 of the RGPD).
ARTICLE 6 OF THE GENERAL DATA PROTECTION REGULATION
1. Processing shall only be lawful if at least one of the following conditions is met:
a) the data subject consented to the processing of his or her personal data for one or more specified purposes;
b) the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation at his request of pre-contractual measures;
c) the processing is necessary for compliance with a legal obligation applicable to the controller;
d) the processing is necessary for the protection of vital interests of the data subject or of another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
2. Member States may maintain or introduce more specific provisions in order to adapt the application of the rules of this Regulation with regard to processing in compliance with paragraph 1(c) and (e) by setting out more precisely specific processing requirements and other measures ensuring lawful and fair processing, including other specific processing situations within the meaning of Chapter IX.
3. The basis for the processing referred to in paragraph 1(c) and (e) shall be established by:
a) Union law; or
b) the law of the Member States applicable to the controller.
The purpose of the processing must be specified in that legal basis or, as regards the processing referred to in paragraph 1(e), it must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Such legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data processed; the data subjects concerned; the entities to which personal data may be disclosed and the purposes of such disclosure; purpose limitation; data retention periods, as well as processing operations and procedures, including measures to ensure lawful and fair processing, such as those relating to other specific processing situations within the meaning of Chapter IX. Union or Member State law shall meet a public interest objective and shall be proportionate to the legitimate aim pursued.
4. Where processing for a purpose other than that for which the personal data were collected is not based on the data subject’s consent or on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the purposes referred to in Article 23(1), the controller, in order to determine whether processing for another purpose is compatible with the purpose for which the personal data were originally collected, shall take into account, inter alia:
a) any relationship between the purposes for which the personal data were collected and the purposes of the intended further processing;
b) the context in which the personal data have been collected, in particular as regards the relationship between the data subjects and the controller;
c) the nature of the personal data, in particular where special categories of personal data are processed, pursuant to Article 9, or personal data relating to criminal convictions and offences, pursuant to Article 10;
d) the possible consequences for data subjects of the intended further processing;
e) the existence of appropriate safeguards, which may include encryption or pseudonymization.
ARTICLE 13 OF THE GENERAL DATA PROTECTION REGULATION
1. Where personal data relating to a data subject is collected from him/her, the controller shall, at the time the data is collected, provide him/her with all the information set out below:
a) the identity and contact details of the controller and, where applicable, of his representative;
b) the contact details of the data protection officer, if any;
c) the purposes of the processing for which the personal data are intended and the legal basis for the processing;
d) where the processing is based on Article 6(1)(f), the legitimate interests of the controller or of a third party;
e) the recipients or categories of recipients of the personal data, where applicable;
f) where applicable, the controller’s intention to transfer personal data to a third country or international organization and the existence or absence of an adequacy decision of the Commission, or, in the case of transfers referred to in Article 46 or 47 or Article 49(1), second subparagraph, reference to adequate or appropriate safeguards and the means of obtaining a copy of these or the fact that they have been provided.
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject, at the time the personal data are obtained, with the following information necessary to ensure fair and transparent data processing:
(a) the period for which the personal data will be kept or, where this is not possible, the criteria used to determine this period;
b) the existence of the right to request from the controller access to personal data relating to the data subject, and their rectification or erasure, or the restriction of their processing, or to object to their processing, as well as the right to data portability;
c) where the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of the processing based on consent prior to its withdrawal;
d) the right to lodge a complaint with a supervisory authority;
e) whether the communication of personal data is a legal or contractual requirement, or a necessary requirement for entering into a contract, and whether the data subject is obliged to provide the personal data and is informed of the possible consequences of not providing such data;
f) the existence of automated decisions, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, meaningful information about the logic applied and the significance and expected consequences of such processing for the data subject.
3. Where the controller intends to further process personal data for a purpose other than that for which they were collected, the controller shall provide the data subject, prior to such further processing, with information on that other purpose and any additional relevant information within the meaning of paragraph 2.
4. The provisions of paragraphs 1, 2 and 3 shall not apply where and insofar as the information is already available to the data subject.
ARTICLE 14 OF THE GENERAL DATA PROTECTION REGULATION
1. Where the personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
a) the identity and contact details of the controller and, where applicable, his or her representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing;
d) the categories of personal data concerned;
e) the recipients or categories of recipients of the personal data, where applicable;
f) where applicable, the controller’s intention to transfer personal data to a recipient in a third country or international organization and the existence or absence of an adequacy decision of the Commission, or, in the case of transfers referred to in Article 46 or 47 or Article 49(1), second subparagraph, reference to adequate or appropriate safeguards and the means of obtaining a copy of them or the fact that they have been provided.
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent data processing in respect of the data subject:
a) the period for which the personal data will be kept or, where that is not possible, the criteria used to determine this period;
b) where the processing is based on Article 6(1)(f), the legitimate interests of the controller or of a third party;
c) the existence of the right to request from the controller access to personal data relating to the data subject, and their rectification or erasure, or the restriction of their processing, and to object to their processing, as well as the right to data portability;
d) where the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of the processing based on consent prior to its withdrawal;
e) the right to lodge a complaint with a supervisory authority;
f) the source from which the personal data originate and, where appropriate, whether they originate from publicly available sources;
g) the existence of automated decisions, including profiling, as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information about the logic applied and the significance and expected impact of such processing on the data subject.
3. The controller shall provide the information referred to in paragraphs 1 and 2:
a) within a reasonable time after the personal data have been obtained, and at the latest within one month, having regard to the specific circumstances in which the personal data are processed;
b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to the data subject; or
c) if the personal data are intended to be disclosed to another recipient, no later than the time at which the personal data are first disclosed.
4. Where the controller intends to further process the personal data for a purpose other than that for which they were obtained, the controller shall provide the data subject, prior to such further processing, with information on that other purpose and any other relevant information referred to in paragraph 2.
5. The provisions of paragraphs 1 to 4 shall not apply where and to the extent that:
a) the data subject already has the information;
b) the communication of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1), or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impede the achievement of the purposes of such processing. In such cases, the controller shall take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, including by making the information public;
c) the collection or disclosure is expressly provided for by Union or Member State law which applies to the controller and which provides for appropriate measures to protect the legitimate interests of the data subject; or
d) where the personal data must remain confidential on the basis of an obligation of professional secrecy laid down by Union or Member State law, including a statutory obligation of secrecy.