Privacy policy

1. RESPONSIBLE.
1.1. Who is responsible for processing your data?

Identity: NUBAPP APPLICATIONS, S.L. (hereinafter, the Responsible Party).
Adress: calle Madres de la Plaza de Mayo, 44, oficina 5-2, 31013, Artica (Navarra, España)
Telephone: 948 368 138
Email: nubapp@nubapp.com

2. PURPOSE.
2.1. What will the Responsible use my data for?

The data provided by you may be used by the Controller for one or more of the purposes indicated below, which will be determined by factors such as your relationship with us (e.g. regular customer, occasional customer, company using the service, etc.) or by the means used to forward the data (e.g. contact or additional information form, etc.). The following is a description of the treatments referred to in this privacy policy, without prejudice to the fact that there may be others for which you are informed or asked for the appropriate authorisation:

Provision of services and maintenance of the business relationship.

– To provide and manage the services that you have entrusted to us for the acceptance of the terms and conditions, including the preparation of estimates and offers that you request, whether or not they are the result of the extension of any service that we may be providing at present.

– Processing of reservations and registrations at the sports centre of your choice. For this processing, you must communicate your data to the company responsible for the activities or the plant in which you wish to carry out the activity. This communication of data is essential for the provision of services and is therefore legitimated by the execution of the services entrusted to the Responsible by you at the time of contracting the service.

-Send you commercial communications related to the activities and services that we offer in the Responsible Party and that fall within the reasonable expectation of you in relation to the services previously contracted. This treatment may cease if you object to it.

– Administrative management of the relationship, including the management and processing of the collection of our services or the products or services offered through our Platform or that of our associated centres. The management may also include the transfer of your data to one or more of the companies that form or may form part of our business group, all motivated by internal administrative management based on legitimate interest which implies that your data will not be used by the rest of the group for any purpose other than that expressed here unless express consent on your part.

– Treatments derived from the normative fulfillment: in the relation with you it can become applicable normative that obliges us or makes possible the relation of certain treatments of your data, always with the purpose of fulfillment of the above mentioned norms (or in exercise of the rights that the same can grant us).

Information requests.

– When you contact us, for example, using the contact form on the website, by telephone, fax, e-mail, courier services, social networks, telephone or even in person, to ask us for information or consultation on any subject, make a suggestion, complaint or claim, we will treat your data in order to meet the request for information and / or consultation that we have made, with the management and scope that it requires. This operation may include the use of the data received for the preparation of proposals for services and/or collaboration, if this is indeed the request.

Newsletters

– In the event that you ask us to register for our newsletter service and/or periodic information, for example, by means of the box enabled for this on our website or by requesting it by e-mail, we will process your data for the management and sending of the aforementioned newsletter, as well as commercial communications related to our activities, services and products, including by electronic means. At any time you may withdraw your consent and complete the treatment exposed.

Cookies:

– If you have agreed to receive cookies when you start visiting this website, the website’s cookie policy will apply to you. We recommend that you visit the aforementioned policy in which you will be able to find out, among other things, about the cookies used, their purpose and the configuration options that you can adopt in your page display devices, for example, to delete them.

2.2. How long will you keep my data?

The storage periods of the data you provide us with are intimately linked to the treatment in question.

In this regard, indicate that we will treat the data in a general manner as long as the legal relationship that takes place or does not oppose the processing.

Once the period indicated above has ended, we will keep your data on the one hand, as long as the regulations impose it on us, and on the other hand, until the complete prescription of actions that may concur has been exhausted. These deadlines may be conditioned, among other factors, by the law applicable to the relationship between the parties.

Therefore, in order to calculate the conservation period, it will be necessary to take as a starting point the period indicated in section 2.2.2 relating to the specific treatment and add the period that could affect it at the level of statute of limitations and prescription of actions.

2.2.1. Deadlines related to treatments:

– Treatments relating to the provision of services and maintenance of the business relationship: For as long as the relationship between the parties is maintained.
– Treatments related to requests for information. We will treat your data for the time necessary to meet and manage your request for information and an additional period of 90 days.
– Treatments related to newsletters: as long as you are a client or user and you have not objected to the treatment or in the case that you have expressly requested us to receive the newsletter, as long as you wish to continue receiving it and you have not objected.

– Cookies: according to the type of cookies, expressed in the corresponding policy.

2.2.2. Time limits imposed by the regulations and prescription of actions:

– Civil Code (article 1964): 5 years.

– Law 28 of Law 1/1973, of 1 March, 3 or 10 years in general. Likewise, Law 39 of Law 1/1973 of 1 March 1973 and the period contained therein of 30 years may also be applicable to the relationship between the parties.

– Commercial Code: 6 years documentation retention obligations imposed by Article 30.

3. LEGITIMISATION OF PROCESSING.
3.1. Why can the person in charge process my data? what legitimizes him?

Dependiendo de la relación que se entable y por ende la finalidad del tratamiento, la base jurídica del mismo puede ser diferente. Below, we explain the different situations that may occur and what legal basis is applicable depending on the treatment:
PURPOSES RELATED TO THE PROVISION OF SERVICES OR THEIR CONDITION OF CLIENT AND/OR USER:

– Treatment of your data in order to provide the contracted service: We are entitled to treat your data under the contract agreed with you in connection with the provision of the contracted service.

– Sending of commercial communications: In accordance with the regulations currently in force and having weighed our interests and your rights, we indicate that we have a legitimate interest in treating your data with the aim of sending you commercial communications related to the services contracted by you with us (without prejudice to your being able to oppose this treatment at any time).

– Administrative management and compliance with legal obligations: At an accounting and administrative level we need to process your data in order to comply with the obligations imposed by, among others, the mercantile, tax and money laundering regulations, which is why we are legitimised to do so by legal imperative.

Attention to requests for information

– Attend requests for information: This processing is legitimised by the consent given by you at the time of sending your request for information and/or assistance.

Registration in newsletters:

– Newsletters and commercial communications: We will only send you commercial communications if you have previously and expressly consented to receive them. The lack of consent for the processing of your data for the purpose of sending commercial communications will not affect in any case the processing of your query, assistance or request.

Cookies:

– We are legitimized for this treatment by the consent given by you at the beginning of the navigation on our website.

3.2.- Consequences of the withdrawal of consent or opposition to the processing of your data. Mandatory and optional fields.

In the event that you are requested at any time to authorise the processing of a purpose requiring consent, your failure to grant it (or its eventual withdrawal at a later date) will have no consequences for you under any circumstances. Neither will your opposition to the processing of your data for purposes based on legitimate interest (for example, the use of your data as a customer for sending commercial communications) have any kind of consequence.
In some data collection forms you will clearly see that some fields are marked as mandatory (with an asterisk) and the rest are absolutely voluntary. Therefore, not filling in voluntary fields will not have any consequence, and you can complete them if you are interested in it.

4. RECIPIENTS
4.1. Will my data be passed on to third parties?

Depending on the relationship you have with the person in charge it is possible that due to the nature of the service we may communicate your data.

4.1.1. End users who use the Platform and the services offered by the Controller as an intermediary between the Sports Centre and the User: In this case, in view of the intermediary nature of the services offered by the Controller, the communication of the User’s data to the Centre where the Controller intends, for example, to register or reserve a facility, is essential for the correct provision of the service.
In this sense, your data will only be communicated to the centre chosen by you and not to the other centres that make up the Responsible’s client portfolio. In this way, only the centre chosen by you will have access to your data and only for the purpose of attending to your reservation, registration or similar request and not for other purposes.

4.1.2. Professional clients of the service offered by the Responsible: In general, except for legal obligations, your data will not be transferred to any third party without your consent. In any case, some transfers of data to third parties may be imposed by certain regulations, for example, tax regulations (the communication of your data to tax authorities, such as the Regional Treasury of Navarre).

4.2. Providers of services related to the website and e-mail service.
Hosting: the Responsible party’s website is hosted by the provider ACENS TECHNOLOGIES, S.L.U.
E-mail: the service is provided by ACENS TECHNOLOGIES, S.L.U.
Sending of commercial communications: the service of sending commercial communications is provided by ACENS TECHNOLOGIES, S.L.U.

5. RIGHTS
5.1. What rights do I have with regard to data protection? General information.

With regard to personal data collected for processing, you have the possibility of exercising the rights of access, rectification, deletion and portability. Likewise, we inform you that in certain circumstances you will have the right to request the limitation or opposition to the processing of your data, in which case the data controller will cease processing and will only keep the same in the event that there is any legal obligation that imposes it or until the prescription of the actions that may concur.

If you would like more information on these rights, we invite you to continue reading or to visit the infographics prepared by the Spanish Data Protection Agency, which can be accessed via the following hyperlink.

5.2. What are these rights?

Right of access: This right allows the data subject to obtain confirmation from the Controller as to whether or not personal data concerning him or her is being processed and, if so, the right of access to the personal data as well as to the following additional information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the addressees or categories of addressees; (d) the intended storage period or the criteria used to determine that period; (e) the existence of the right to request from the controller the rectification or erasure of personal data or the limitation of the processing of personal data relating to the data subject, or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) available information on the origin of the data; (h) the existence of automated decisions.

Right of rectification: This right empowers the interested party to urge the Controller to rectify or complete inaccurate personal data without delay. It is important that the data contained in the databases are updated and in this regard we are at your disposal to rectify any errors or inaccuracies that may exist in them.

Right to suppression: At any time you have the right to request that we suppress your personal data request that will be dealt with without delay unless there are any of the circumstances set out in the General Regulation on Data Protection, among which it is important to note that we must retain your data to comply with a legal obligation or to defend ourselves against a claim.

Right of portability: In the case of automated data processing based on consent, you may ask us to send, in a structured format, of common use and mechanical reading, to another person responsible for processing the personal data about you that you have provided us.

Right of opposition: Through this right the interested party opposes the processing of their data by the data controller. This right is not absolute, which implies that the data controller may continue to process the data as long as he can prove legitimate reasons that prevail over the interests, rights of the interested party or for the formulation, exercise and defence of claims.

Right to limit processing: This right confers on you, under certain circumstances indicated below, the right to request the data controller to limit the processing of your personal data. In the event that this right is exercised, the data controller may only process the data with the consent of the data subject. The circumstances under which this right may be exercised are as follows:

(i) the data subject contests the accuracy of the personal data, for a period allowing the controller to verify the accuracy of the data;

(ii) the processing carried out by the controller is unlawful and the data subject objects to the deletion of personal data and requests instead the limitation of their use;

(iii) the controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the formulation, exercise or defence of claims;

(iv) the data subject has objected to the processing, pending verification as to whether the data controller’s legitimate reasons prevail over those of the data subject.

5.3. How and where can I exercise them?

We will be happy to answer any queries or complaints you may have regarding data protection. Likewise, you may direct your claim or exercise your rights through any of the contact channels indicated in the heading of this data protection policy.
In the same way, you can also contact the supervisory authority you consider appropriate to lodge your complaint (for example, in the country where you have your habitual residence, place of work or where you consider that the alleged infringement has taken place). To the opportune effects, we inform you that in Spain the Control Authority is the Spanish Data Protection Agency, and you can exercise your rights through the forms that this entity has enabled for this purpose and that are available in its electronic headquarters.

5.4. How long does it take to process my request to exercise rights?

The reference period is one month from receipt of your request. However, this period may be extended by a further two months if necessary, taking into account the complexity and number of applications. the Responsible shall inform the person concerned of any such extension within one month of receipt of the request, stating the reasons for the delay.

5.5. Will exercising these rights cost me money?

The exercise of rights shall not entail a cost, except in cases in which manifestly unfounded or excessive requests are made, especially in the case of repetitive requests, the Controller may charge a fee to compensate for the administrative costs of attending to the request or refusing to act (the fee may not imply an additional income for the controller, but must effectively correspond to the actual cost of processing the request).

Version 1.0 – Updated May 23, 2018