Privacy Policy — Invopop

Controller for the Processing of Personal Data

The data controller for the processing of the personal data that the user provides when accessing and using the website, is, as owner, Invopop S.L., with registered office at Calle Pradillo 42, Madrid, Spain, with NIF B85905495, and which is registered in the Mercantile Registry of Madrid, in volume 27590, section 129, sheet M0497191, inscription 1, hereinafter Invopop.

Invopop informs the users of its website and associated applications in the domain invopop.com through this Privacy Policy about the processing and protection of their personal data, that can be collected through their navigation or contracting of services that they carry out in this portal. The use of this website by the user implies their acceptance of this Privacy Policy.

Invopop adopts the necessary measures to guarantee the security, integrity and confidentiality of the data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement thereof, and in that not foreseen by it by Organic Law 3/2018 of December 5, Protection of Personal Data and guarantee of digital rights, Royal Decree 1720/2007, of December 21, which approves the Regulations for the development of the Organic Law on Data Protection, and Law 34/2002, of July 11, Services of the Information Society and Electronic Commerce.

Through the registration forms of this website, the use of the APIs that are made available to users, or the sending of email, personal data of each user that are necessary for the management and maintenance of some of the services provided and whose treatment is governed by this Privacy Policy is collected and processed.

Invopop undertakes to apply the computer security measures provided for in the aforementioned regulations, with the aim of preventing access or improper use of the data, its manipulation, deterioration or loss.

Invopop as Data Processor

Invopop holds the status of data processor with respect to the personal data that its users enter on the platform and / or are included in the models managed through its services by its users. In this case, we must understand that Invopop, as a service provider, exercises the functions of data processor on behalf of its users in accordance with the provisions of article 28 of the General Data Protection Regulation.

Invopop, as the person in charge of the treatment, undertakes to guarantee the security of the personal data to which it accesses, adopting the appropriate technical and organizational measures to avoid its alteration, loss, treatment or unauthorized access, taking into account the state of technology at all times, the nature of the stored data and the risks to which they are exposed. Likewise, Invopop guarantees that its actions will seek the protection of the rights of the interested party.

The documents generated in the Invopop services by its users, as well as all the data associated with them (such as, among others, dates, observations, amounts, etc.) will be stored in the service providers through which the Invopop service is provided, in their condition as data processor, and will be processed only for the purpose of providing the Service.

Likewise, Invopop may extract information from documents in order to provide services such as collation or matching of documentation, search or management, among others, within the services it provides.

The ownership of the data processing referred to in this section, and therefore the responsibility for compliance with the legal obligations regarding them, as well as any results derived from the data processing that, in relation to them, Invopop carries out as processor in accordance with the agreed services, corresponds to the User.

Invopop, as the person in charge of the treatment, undertakes to use the personal data solely and exclusively for the performance of the agreed services and purposes and, in any case, in accordance with the instructions given by the controller, as well as to keep the duty of secrecy regarding them, even after the end of this contractual relationship.

If Invopop detects a personal data protection breach, it will inform the controller concerned about the case without delay.

Invopop, in accordance with article 28.3.h) of the General Data Protection Regulation, shall make available to the controller all the information necessary to demonstrate compliance with the obligations set out in Article 28, as well as to allow and contribute to the performance of audits, including inspections, by the controller or another auditor authorised by said controller.

The audit may only contemplate aspects of the services that are contracted to the controller, including any type of data and file, measures that guarantee the confidentiality of the information, data, records, procedure manuals, quality, service levels, etc. To carry out the aforementioned audits, the controller must notify the processor 3 months in advance of his intention to carry out an audit, and the final dates must be agreed by both parties. In this case, Invopop may pass on to the controller the costs derived from it, which must be paid in advance.

In the event that any deficiencies are detected during an inspection or audit, Invopop undertakes to eliminate them within the time specified by the controller, no later than 14 days.

The interested party can exercise the rights of access, rectification, opposition, deletion, as well as any other right that the data protection regulations grant him before the controller. In the event that those affected exercise their rights before the processor, he must transfer the request to the person responsible for the file within a maximum period of 10 days from its receipt.

The processor will keep the personal data to which he has had access by reason of the service provided, as well as any support or document in which they appear, only during the period of provision of said service or that to which he is obliged by the legislation.

Once the processing has been completed on behalf of the controller, Invopop undertakes to return or delete the personal data, unless European Union or Member State law applicable to the processor requires the retention of the data.

Information we Collect

We collect the information you provide to us when, for example, you create or modify your account, register to use our Site, purchase products or services through our platform, request information from us, communicate with customer service, or generally communicate with us. Such information may include, but is not limited to:

name
address
e-mail address
phone number
statistical financial information
details of your identity card or passport

Duration of Data Storage

Invopop, as controller, undertakes to store and manage the personal data and information collected through this website with due confidentiality while the professional relationship that has arisen is maintained and the interested party does not request its deletion, and where appropriate, for a period not exceeding 5 years, counting from the end of the commercial relationship established between the user and invopop.com to, among other purposes, the analysis and elaboration of profiles. However, the person responsible for the treatment may keep, duly blocked, the data to meet possible administrative or jurisdictional responsibilities.

Likewise, Invopop will proceed after the maximum period of data storage to the anonymization and grouping of the data to subsequently perform statistical and profiling analysis. These analyses will not allow the re-identification of the affected subjects.

Purposes of Data Processing

The operations, management and technical procedures, whether carried out in an automated or non-automated way, that enable the collection, storage, modification, transfer and other actions on personal data, are considered processing of personal data.

In Invopop we process the personal data that the user provides us for the provision of the services offered by the platform, which include among others the following:

Provision of the service: The data of registered users will be treated in order to provide the service, obtain payments, issue invoices, as well as for loading and sending of documents and the verification of subscription to the service. Likewise, the data incorporated in the documentation that is uploaded to the platform will be treated in the terms contemplated in the "Data Processor" section. Likewise, such data may be affected by internal audit functions of the service.
Contact with the user and / or support: The user's data will be used to provide the service and resolve the incident reported. The request for technical assistance may imply the need to obtain access to other data related to the user who notifies it, depending on the nature of the incident.
Sending commercial information and promotions: The user's data may be used to notify you of new functions incorporated into the system, as well as commercial information about the services offered by Invopop, including among other discounts and other offers.
Security audits: The data on the use of Invopop services may be analyzed internally to detect potential fraud and violations of the Terms and Conditions of the service, as well as to carry out the corresponding data processing that must be carried out by legal imperative.
Statistics: Usage profiles may be analyzed by Invopop to study behavior and preferences, with the aim of improving the user experience and its services.
Integration with third-party services: Invopop may process data of its users to give access to applications integrated with the service, such as the automated and / or direct sending of documents on the platform to third-party applications.
Other purposes: The use by Invopop of the user's personal data for purposes other than those indicated in this privacy policy will require that the user be informed and, if applicable, obtain their consent.

Likewise, these data will be processed to proceed with their subsequent anonymization and grouping in order to statistically analyze trends and group profiles for the improvement of the services offered by Invopop.

The fields in the form must be filled so that Invopop can fulfill the purposes mentioned above. In the event that there are optional fields on a form, they will be expressly indicated.

The user can object to the sending of commercial communications at any time by sending an email message to the address indicated above lines.

In addition to the specific treatments according to the service you request, Invopop may store the IP address of the user's device, only for technical and security reasons, and therefore, based on the legitimate interest of safeguarding the integrity and security of the service.

Lawful Bases for the Processing of Data

The processing of the personal data provided by the user is carried out based on the following lawful bases that legitimize it:

Through filling forms on the Web or by sending emails or any other type of request for information sent to Invopop, the interested party gives his express consent for the processing of his personal data. Likewise, the interested party gives his consent to share his data with third parties when it is necessary for Invopop to provide its services, encompassing activities such as allowing access to third parties, or the submission of documentation directly through the platform, among others.

For the processing of the data incorporated into the documents uploaded to the platform, it will be understood that such treatment is necessary to provide our services to the User, and that it is carried out by Invopop as data processor.

Likewise, your data may be processed based on the legitimate interest in promoting our services and disseminating our brand through marketing actions, provided that this interest does not prevail over that interest or fundamental rights and freedoms that require the protection of personal data.

The consent will be understood as free, specific, informed and unequivocal, since after reading this Privacy Policy the user is informed and, if satisfied, can accept it by means of a statement or a clear affirmative action, such as the marking of a box that is available for this purpose.

In no case, Invopop will use the personal data of the interested parties for purposes other than and incompatible with those mentioned above, and undertakes to maintain due professional secrecy and to establish the necessary technical and organizational measures to safeguard the information provided by its users.

Principles Applicable to Processing

In the processing of the personal data of its users, Invopop will apply the following principles that comply with the requirements of the new European data protection regulation:

Principle of legality, loyalty and transparency: Your consent will always be required for the processing of personal data, specifying one or more purposes of which you will be previously informed with absolute transparency.

Principle of data minimization: Only the data strictly necessary for the realization of the required purposes will be requested. Likewise, and in the case of optional additional data that may allow a greater personalization of the service, its optional nature will be expressly indicated.

Principle of limitation of the conservation period: the data will be kept for no longer than necessary for the purposes of the treatment.

Principle of integrity and confidentiality: Your data will be treated in a way that guarantees adequate security and guarantees its confidentiality.

Data Communication

In general, Invopop will not communicate personal data to third parties, with the exception that the provision of a service implies the need for a contractual relationship with a data processor and this is strictly necessary to manage and maintain the relationship between the user and the aforementioned company, with the prior express authorization of the user. This will be done only during the time necessary to enable the execution of the contract of order, and under the same conditions and with the same responsibilities that are required of the data controller. Once the order has been completed, the data processor will return the personal data to the Data Controller and delete any copies available to him.

On the other hand, only third parties with whom Invopop has a legal or contractual obligation to provide them, including, for example, the Ombudsman and Judges and Courts interested in the proceedings related to the complaints submitted, will have the right to access these personal data.

Rights of Interested Parties

The user may exercise at any time, in the terms established in current legislation, the rights of access, rectification or deletion of data, request that the treatment be limited, oppose it, request the portability of their data, as well as revoke the consent given, rights recognized in the aforementioned Regulation (EU). The exercise of these rights can be done by the user himself by contacting Invopop at the address of its registered office indicated above; by sending an email to the following address info@invopop.com or to the postal address Calle Pradillo 42, Madrid 28002, Spain.

Interested parties may access their personal data, as well as request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes that were collected. In certain circumstances, the interested parties may request the limitation of the processing of their data, in which case they will only be kept for the exercise or defence of claims that may occur.

Interested parties may also object to the processing of their data. In this case, Invopop will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims.

As a data subject, you have the right to receive your personal data, in a structured, commonly used and machine-readable format, and to transmit them to another controller when:

The treatment is based on consent
The data has been provided by the person concerned.
The processing is carried out by automated means.

When exercising your right to data portability, you have the right to have personal data transmitted directly from controller to controller where technically possible.

Regarding treatments based on the user's consent, you can withdraw said consent at any time. However, withdrawing your consent will not affect the lawfulness of the processing carried out under your consent prior to the withdrawal of your consent, and will not affect the lawfulness of the processing we continue to do under any other legal basis.

For the effective exercise of these rights, the user must prove their identity by providing their name and surname, photocopy of the DNI or equivalent identification document that proves their identity, request in which the request is specified, address for the purposes of notifications, and date and signature of the applicant.

Likewise, the user may complain to the Spanish Data Protection Agency (Competent Control Authority in this matter), especially when he has not obtained satisfaction in the exercise of his rights, by writing to it, C / Jorge Juan, nº 6, 28001 - Madrid, or through the web: https://www.agpd.es