Madrid
The purpose of this “Privacy Policy and Data Protection” is to inform you about the conditions that govern the collection and processing of your personal data by MEDIA INVESTMENT OPTIMIZATION, S.A in order to safeguard fundamental rights, honor, and freedoms, all in compliance with current regulations governing the Protection of Personal Data according to the European Union and the Spanish Member State.
In accordance with these regulations, we need to have your authorization and consent for the collection and processing of your personal data, so below, we indicate all the details of interest to you regarding how we perform these processes, for what purposes, that other entities may have access to your data and what your rights are.
For all of the above, once you have reviewed and read our Data Protection Policy, it is imperative that you accept it as proof of your agreement and consent.
Data Protection Authorities (other European countries):
Other International Data Protection Authorities :
The Data Controller is the natural or legal person, of a public or private nature, or administrative body, which alone or jointly with others determines the purposes and means of the processing of personal data; in the event that the purposes and means of the processing are determined by the law of the European Union or of the Spanish Member State.
In this case, our identification data as Data Controller are the following:
MEDIA INVESTMENT OPTIMIZATION, S.A CIF A87668190
We have a person or entity specialized in data protection, which is responsible for ensuring proper compliance in our entity of the legislation and regulations in force. This person is called the Data Protection Officer (DPO) and, if needed, can be contacted as follows:
Auratech Legal – CIF B87984621Email: dpo@mio.es- Telephone: 34 91 1134963
This Privacy and Data Protection Policy is developed based on the following data protection laws and regulations:
Personal data collected and processed through this Web site will be treated in accordance with the following principles:
MIO has taken all the required measures to protect personal data; likewise, MIO has adopted the available technical measures to prevent data loss, unfair use, alteration, unauthorized access or data theft. However, the user should bear in mind that Internet security measures are not completely indestructible.
MIO adopts the necessary organizational and technical measures to guarantee the security and privacy of your data, avoid its alteration, loss, treatment or unauthorized access, depending on the state of the technology, the nature of the data stored and the risks to which they are exposed.
Among others, the following measures stand out:
MIO assumes responsibility for supporting and encouraging the establishment of the organizational, technical and control measures necessary to comply with the above security guidelines.
On the other hand, MIO manages information systems according to the following principles:
The following are the uses and purposes foreseen:
Management of communications received through the complaints channel.
Investigation of complaints received
We use your data for the time strictly necessary to fulfill the purposes indicated above. Unless there is a legal obligation or requirement, the retention periods foreseen are as follows:
Management of communications received through the complaints channel. For a period of 10 years from the last confirmation of interest. After 3 months the data will be deleted if the complaint is unsuccessful. If the complaint succeeds, the maximum period of time may exceed 10 years.Handling of received complaints: All data processed and collected during the investigation phase are deleted after 3 months. If the complaint is successful, the maximum term may not exceed 10 years.
The collection and processing of your data is always legitimized by one or more legal bases, which are detailed below:
Occasionally, in order to comply with our legal obligations and our contractual commitment to you, we are faced with the obligation and need to transfer some of your data to certain categories of recipients, which we specify below:
Management of communications received through the complaints channel.Other public administration bodies . External channel managed by the Independent Authority for the Protection of Whistleblowers or similar independent regional authorities with competence. Data will also be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation. Investigation of complaints received : Other public administration bodies. External channel managed by the Independent Authority for the Protection of Whistleblowers or similar independent regional authorities with competence. Data will also be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation.
We do not make international transfers of your data
The data processing activities carried out through the Web site are detailed below, specifying each of the following sections:
These are those data processing activities whose purposes are necessary for the provision of services.
Legal basis (Art. 6.1.c GDPR) Fulfillment of legal obligations of the Data Controller (Law regulating the protection of persons who report regulatory infringements and the fight against corruption); (Art. 6.1.e GDPR) Fulfillment of a public mission or exercise of public powers conferred to the Data Controller (GDPR and LOPDGDD). Compliance with legal obligation: General Data Protection Regulation (GDPR) and Organic Law 3/2018 of December 5th on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), Organic Law 7/2021 of May 26th on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and enforcement of criminal penalties. Purposes: Create an internal communication channel to allow the delivery of information on irregular practices in order to correct them and repair the damage they may have produced; Inform employees and third parties about the existence of anonymous reporting systems on actions or omissions that may go against the legal system. To protect citizens who report actions or omissions that violate the legal system, affect financial interests or affect the internal market; To adequately protect those persons who, by reporting irregularities of which they become aware in their work or professional environment, publicize them through the organization’s complaints channel, thereby enabling the public authorities to act and put an end to the unlawful activity reported when it affects the general interest.Informants internal complaints channel (Identification data; Criminal data; Other categories). Persons allegedly involved (Identifying data; Criminal data) Origin of data The data subject himself or his legal representative; The data is communicated by the informant himself through the organization’s complaints channel. Other persons other than the data subject or his representative; The data is delivered by the informant or becomes known in the process of instruction and investigation. Category of recipients Other public administration bodies; External channel managed by the Independent Authority for the Protection of the Informant or by analogous autonomous independent Authorities with competence. Data will also be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation.International transferNot foreseen Storage period For a period of 10 years from the last confirmation of interest. After 3 months the data will be deleted if the complaint is unsuccessful. If the complaint is successful, the maximum term may not exceed 10 years. Security Measures
In order to safeguard the security of the personal data of the complaints channel, the organization undertakes to maintain the security and confidentiality of the data provided and, specifically, of the data of the Whistleblowers who make a communication through the internal complaints channel, preventing access to them by those who caused the communication due to the alleged commission of actions within the organization contrary to the Law or the Code of Conduct of the entity. The organization has adopted the legally required levels of security for the Protection of Personal Data and used the technical means at its disposal to prevent the loss, misuse, alteration, unauthorized access and theft of the same.
Likewise, the organization informs that all its staff, regardless of the processing phase in which they are involved, has adopted the commitment to treat your data with the utmost care and confidentiality.
Legal basis (Art. 6.1.c GRPD) Fulfillment of legal obligations of the Data Controller (Law regulating the protection of persons who report regulatory infringements and the fight against corruption); (Art. 6.1.e GRPD) Fulfillment of a public mission or exercise of public powers conferred to the Data Controller (Organic Law 7/2021, of May 26th, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and enforcement of criminal penalties.) Purposes Creation of a management procedure for communications received that identifies the present channel, sending acknowledgement of receipt and communication to the informant of the actions or omissions carried out; Management of the log-book of communications received and of the internal investigations to which they have given rise; Informing the person under investigation of his right to submit written allegations and of the processing of his personal data; Carrying out the investigations necessary to respond to the informant Categories of data and groups.Informants internal complaints channel (Identification data; Criminal data; Other categories). Persons allegedly involved (Identifying data; Criminal data) Origin of data The data subject himself or his legal representative; The data is communicated by the informant himself through the organization’s complaints channel. Other persons other than the data subject or his representative; The data is delivered by the informant or becomes known in the process of instruction and investigation. Category of recipients Other public administration bodies; External channel managed by the Independent Authority for the Protection of the Informant or by analogous autonomous independent Authorities with competence. Data will also be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation.International transferNot foreseen Storage period All data processed and collected during the investigation phase are deleted after 3 months. If the complaint is successful, the maximum term may not exceed 10 years. Security Measures
Minors under 14 years of age may not use the services available through the Website without the prior authorization of their parents, guardians or legal representatives, who shall be solely responsible for all acts performed through the Website by the minors in their care, including the completion of the telematic forms with the personal data of such minors and the marking, where appropriate, of the boxes that accompany them.
In compliance with the provisions of Article 8 of the GRPD and Article 7 of the LOPD/GDD, only those over 14 years of age may give their consent to the processing of their personal data in a lawful manner by MIO.
Management of communications received through the complaints channel. Informants internal complaints channel
Persons allegedly involved
Instruction of the complaints received Informants internal complaints channel
The current data protection regulations protect you in a series of rights in relation to the use we make of your data. Each and every one of your rights are unipersonal and non-transferable, that is to say, they can only be exercised by the owner of the data, after verifying his or her identity.
The following are your rights:
The interested party may exercise any of the aforementioned rights by contacting the Data Controller and prior identification of the User using the following contact information:
You can also exercise your rights with the Data Protection Officer:
Email: mdelapena@auratechlegal.es – Phone: 647633242
To exercise your rights of access, rectification, deletion, limitation or opposition, portability and withdrawal of your consent, you can do so as follows:
In addition to your rights, if you believe that your data is not being collected or processed in accordance with current Data Protection regulations, you may file a complaint with the Supervisory Authority, whose contact details are given below:
The acceptance and provision of this document indicates that you understand and accept all the clauses of our privacy policy and therefore authorize the collection and processing of your personal data under these terms. This acceptance is done by checking the “Read and Accept” checkbox in our Privacy Policy.
MIO reserves the right to modify this Privacy Policy, according to its own criteria, or motivated by a legislative, jurisprudential or doctrinal change of the Spanish Data Protection Agency or the rest of the European control authorities mentioned in the previous point. Changes or updates made to this Privacy Policy that affect the purposes, retention periods, data transfers to third parties, international data transfers, as well as any rights of the Website User, will be explicitly communicated to the user.
This policy will be maintained, updated and adapted to MIO’s needs and aligned with its strategic risk management principles. To this end, it will be reviewed at planned intervals or whenever significant changes arise to ensure its suitability and effectiveness.
Last update: December 21, 2023