Madrid
This “Privacy and Data Protection Policy” of Mio Consulting Inteligencia de Negocio SLU (hereinafter Mio Consulting Inteligencia de Negocio), is established for the purpose of informing you about our practices regarding the collection and processing of your personal data. This policy is firmly aligned with the respect for fundamental rights, honor and individual freedoms, in strict compliance with the current regulations of the European Union and the Spanish Member State regarding the protection of personal data.
Under these regulations, it is our duty to inform you clearly and in detail about how we collect and process your personal data, including the specific purposes of these processes, which other entities may have access to your data and what your rights are as a data subject.
Compliance with these regulations does not always require your explicit consent, since certain data processing may be legitimized by other legal grounds, such as the need for the performance of a contract, legal obligations, legitimate interests pursued by the data controller, among others.
It is essential for transparency and the effective exercise of your rights that you read and understand our Data Protection Policy. We recognize the importance of your privacy and are committed to treating your personal data responsibly and in accordance with applicable laws.
The Data Controller is the entity that, either alone or jointly with others, determines the purposes and means of the processing of personal data, in accordance with the law of the European Union or of the Spanish Member State.
We have a person or entity specialized in data protection, which is responsible for ensuring proper compliance in our entity of the legislation and regulations in force. This person is called the Data Protection Officer (DPO) and, if needed, can be contacted as follows:
This Privacy and Data Protection Policy is developed based on the following data protection laws and regulations:
Personal data collected and processed through this Web site will be treated in accordance with the following principles:
Mio Consulting Business Intelligence has implemented all necessary measures to protect personal data. In addition, Mio Consulting Business Intelligence has adopted technical measures to prevent data loss, misuse, alteration, unauthorized access or data theft. However, it is important to remember that no Internet security measure is foolproof.
applies essential organizational and technical measures to ensure the security and privacy of your data, preventing its alteration, loss, processing or unauthorized access. These measures are adapted to the current state of technology, the nature of the data stored and the risks to which they are exposed. They highlight measures to ensure:
Mio Consulting Business Intelligence is committed to promote and support the establishment of the necessary organizational and technical measures to comply with the aforementioned security standards. In addition, it manages information systems based on the following principles:
The following are the uses and purposes foreseen:
Web inquiries and contacts
Management and contact with users
Response to queries received through the electronic form on the website
Cookies, pixels and tracking
Obtain statistical data on users’ browsing, identify problems and analyze their preferences.
Retain user preferences during their stay on a website.
Management of communications received through the complaints channel.
Establishing an internal communication channel to facilitate the delivery of information regarding irregular practices for correction and the rectification of any damages they may have caused
Informing employees and third parties about the existence of anonymous information systems on actions or omissions that may go against the legal system.
Protecting citizens who report actions or omissions that violate legal regulations, affect financial interests, or impact the internal market
Adequately protect those persons who, by communicating irregularities of which they become aware in their work or professional environment, publicize them through the organization’s whistleblower channel, thus enabling the public authorities to act and put an end to the illicit activity detected when it affects the general interest.
Investigation of complaints received
Creation of a procedure for managing incoming communications that identifies this channel, sending acknowledgement of receipt and informing the informant of actions or omissions carried out
Management of the logbook of communications received and of the internal investigations to which they give rise
Inform the person under investigation of his or her right to submit written allegations and of the processing of his or her personal data.
Conducting the necessary investigations to respond to the informant’s inquiry
We use your data for the time strictly necessary to fulfill the purposes indicated above. Unless there is a legal obligation or requirement, the retention periods foreseen are as follows:
Web inquiries and contactsFor a period of 1 year from the last confirmation of interest. The personal data provided will be kept for as long as their deletion is not requested by the interested party and is appropriate, and for as long as they are necessary – including the need to keep them during the applicable statute of limitations – or relevant for the purpose for which they were collected or recorded.
Cookies, pixels and trackingYou should access our cookie policy to know the retention time of each cookie as well as the information collected.
Management of communications received through the complaints channel. For a period of 10 years from the last confirmation of interest. After 3 months the data will be deleted if the complaint is unsuccessful. If the complaint is successful, the maximum term may not exceed 10 years.
All data processed and collected during the investigation phase are deleted after 3 months. If the complaint is successful, the maximum term may not exceed 10 years.
The collection and processing of your data is always legitimized by one or more legal bases, which are detailed below:
Occasionally, in order to comply with our legal obligations and our contractual commitment to you, we are faced with the obligation and need to transfer some of your data to certain categories of recipients, which we specify below:
Cookies, pixels and tracking: Companies dedicated to advertising or direct marketing
Management of communications received through the complaints channel.Other public administration bodies . External channel managed by the Independent Authority for the Protection of Whistleblowers or similar independent regional authorities with competence. Data will also be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation.
Investigation of complaints receivedOther public administration bodies . External channel managed by the Independent Authority for the Protection of Whistleblowers or similar independent regional authorities with competence. Data will also be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation.
We do not make international transfers of your data
The data processing activities carried out through https://mio.one/ are described below, specifying:
These are those data processing activities whose purposes are necessary for the provision of services.
MANAGEMENT OF COMMUNICATIONS RECEIVED THROUGH THE COMPLAINTS CHANNEL.
Legal basis
(Art. 6.1.c GDPR) Fulfillment of legal obligations of the Data Controller (Law regulating the protection of persons who report regulatory infringements and the fight against corruption); (Art. 6.1.e RGPD) Fulfillment of a public mission or exercise of public powers conferred to the Data Controller (RGPD and LOPDGDDD. Compliance with legal obligation: General Data Protection Regulation (GDPR) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDYGDD), Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation, and prosecution of criminal offenses and enforcement of criminal sanctions.)
Purposes
Create an internal communication channel to allow the delivery of information on irregular practices in order to correct them and repair any damage they may have caused; Inform employees and third parties about the existence of anonymous information systems on actions or omissions that may go against the legal system; Protect citizens who report actions or omissions that violate the legal system, affect financial interests or have an impact on the internal market.To protect citizens who report actions or omissions that violate the legal system, affect financial interests or affect the internal market; To adequately protect those persons who, reporting irregularities of which they become aware in their work or professional environment, publicize them through the organization’s whistleblower channel, thus enabling the public authorities to act and put an end to the illicit activity reported when it affects the general interest.
Data categories and groups
Informants internal complaints channel (Identification data; Criminal data; Other categories).Persons allegedly involved (Identifying data; Criminal data)
Data source
The data subject themselves or their legal representative; The data is communicated by the informant themselves through the organization’s whistleblowing channel; Other individuals besides the data subject or their representative; The data is provided by the informant or becomes known during the instruction and investigation process.
Category of recipients
Other bodies of public administration; External channel managed by the Independent Authority for the Protection of Whistleblowers or by similar autonomous regional independent authorities with jurisdiction. Data will also be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation.
International transfer
Not foreseen
Conservation period
For a period of 10 years from the last confirmation of interest. After 3 months the data will be deleted if the complaint is unsuccessful. If the complaint is successful, the maximum term may not exceed 10 years.
Safety measures
In order to safeguard the security of the personal data of the complaints channel, the organization undertakes to maintain the security and confidentiality of the data provided and, specifically, of the data of the Whistleblowers who make a communication through the internal complaints channel, preventing access to them by those who caused the communication due to the alleged commission of actions within the organization contrary to the Law or the Code of Conduct of the entity. The organization has adopted the legally required levels of security for the Protection of Personal Data and used the technical means at its disposal to prevent the loss, misuse, alteration, unauthorized access and theft of the same.
Likewise, the organization informs that all its staff, regardless of the processing phase in which they are involved, has adopted the commitment to treat your data with the utmost care and confidentiality.
INVESTIGATION OF THE COMPLAINTS RECEIVED
(Art. 6.1.c GDPR) Fulfillment of legal obligations of the Controller (Law regulating the protection of persons who report regulatory infringements and the fight against corruption); (Art. 6.1.e RGPD) Fulfillment of a public mission or exercise of public powers conferred to the Controller (Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and the execution of criminal sanctions).
Creation of a procedure for managing incoming communications that identifies this channel, sending acknowledgement of receipt and informing the informant of the actions or omissions carried out; Management of the logbook of incoming communications and the internal investigations to which they have given rise; Informing the person under investigation of his right to submit written allegations and the processing of his personal data; Carrying out the necessary investigations to respond to the informant
WEB INQUIRIES AND CONTACTS
(Art. 6.1.a RGPD) Consent of the data subject (LSSICE. Law 34/2002, of July 11, 2002, on information society services and electronic commerce, RGPD and LOPDGDD. Compliance with legal obligation: General Data Protection Regulation (RGPD) and Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (LOPDYGDD).
Management and contact with users; Response to queries received through the electronic form of the web site.
Web users (Identification data)
The interested party or his legal representative
For a period of 1 year from the last confirmation of interest. The personal data provided will be kept for as long as their deletion is not requested by the interested party and is appropriate, and for as long as they are necessary – including the need to keep them during the applicable statute of limitations – or relevant for the purpose for which they were collected or recorded.
COOKIES, PIXELS AND TRACKING
(Art. 6.1.a GDPR) Consent of the person concerned
Obtain statistical data on user navigation, identify problems and analyze their preferences; Retain user preferences during their stay on a website; Implement web analytics to understand how users search, access and navigate. To perform these analytics, personal data, such as the user’s IP address, connection location, navigation software and navigation functions, etc., may be processed.
Web users (Identifying data; Other categories)
Companies engaged in advertising or direct marketing
You should access our cookie policy to learn about the retention time of each cookie as well as the information collected.
Children under 14 years of age may not use the services offered through our website without the prior authorization of their parents, guardians or legal representatives. They shall be solely responsible for all actions carried out through the website by minors in their care, including the completion of online forms with the personal data of minors and, where appropriate, the selection of the corresponding checkboxes.
In accordance with the provisions of Article 8 of the RGPD and Article 7 of the LOPD/GDD, only persons over 14 years of age may give their consent to the lawful processing of their personal data by Mio Consulting Inteligencia de Negocio.
Web users
Informants internal complaints channel
Persons allegedly involved
Data protection regulations give you a number of rights regarding our use of your data. All these rights are personal and non-transferable, which means that they can only be exercised by you as the data subject, after verifying your identity.
The following are your rights:
To exercise any of these rights, you may contact Mio Consulting Inteligencia de Negocio using the following contact information:
You can also exercise your rights with the Data Protection Officer:
Email: dpo@mio.es -Telephone: 34 91 1134963
To exercise your rights of access, rectification, deletion, limitation or opposition, portability and withdrawal of your consent, you can do so by sending an email to these addresses: dpo@mio.es / info@mioconsulting.es or a postal mail to : Alfonso XI, 3. 28014, Madrid (Madrid), Spain
In addition to your rights, if you believe that your data is not being collected or processed in accordance with current Data Protection regulations, you may file a complaint with the relevant Supervisory Authority. Contact details are provided below:
For example, if you live in Germany, you can contact Berliner Beauftragte für Datenschutz und Informationsfreiheit. In Austria, the Österreichische Datenschutzbehörde is the appropriate entity. For the competent authority in other countries, please refer to section 2 of this policy where all the control authorities are listed along with their links.
This document, by being made available to you, indicates that you understand and agree to all of the terms of our privacy policy. However, acceptance is not always based exclusively on consent, but may be based on different legitimate grounds, such as the fulfillment of a contract, legitimate interests, legal obligations, among others. This is in line with the information principle pursuant to Article 13 of the GDPR.
Acceptance of our Privacy Policy is effected by checking the “Read and Accept” checkbox.
Mio Consulting Inteligencia de Negocio SLU reserves the right to modify this Privacy Policy, either on its own initiative or due to changes in legislation, jurisprudence or guidelines from the Spanish Data Protection Agency. Spanish Data Protection Agency or other European control authorities. Any change or update to this Policy that affects the purposes, retention periods, data transfers to third parties or international transfers, or any user rights, will be explicitly communicated.
This policy will be continuously maintained, updated and adapted to meet the needs of Mio Consulting Business Intelligence and its strategic risk management principles. It will be reviewed periodically or in the event of significant changes to ensure its adequacy and effectiveness.
Last update:January 25, 2024