By means of this notice, GREENERTIS CORP, S.L., registered in the Mercantile Register of Barcelona on Page B-617355, Electronic Volume, Electronic Folio (‘GREENERTIS’), in its capacity as owner of the website www.greenertis. com (the ‘WEBSITE’), in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (General Data Protection Regulation) and other applicable regulations, informs users of its personal data protection policy so that they may expressly, freely and voluntarily decide to provide GREENERTIS with the personal data requested of them in response to a request for information.

Unless specifically stated otherwise, it is considered necessary to complete all the data requested on the form or similar form in a true, exact, complete and up-to-date manner. Otherwise, GREENERTIS may, depending on the case, either not proceed with the user's registration or refuse the specific service requested. All data provided by the user/interested party will be processed in accordance with the characteristics detailed below.

Information regarding the processing of personal data

Identification of the data controller: GREENERTIS. Contact e-mail address: info@greenertis.com.

Purpose of processing:

All data provided will be processed for the following purposes:

• To respond to the requests made by the interested party;

• Maintenance of the relationship that may be established; and/or

• Commercial communications related to our activities.

The personal data provided will be kept for as long as the relationship is maintained, the interested party does not request their deletion or they are necessary for the purposes of processing. The data will not be destroyed when there is a legal provision that requires its conservation, in which case the data will be blocked, being kept only at the disposal of the Public Administrations, Judges and Courts, for the attention of possible liabilities arising from the processing, during the period of prescription of these.

At present, no automated decisions, including profiling, are made on the basis of your personal data. In the event that such automated decisions are to be made in the future, prior consent will be sought.

Legitimation of the processing:

All processing carried out on your personal data has been previously and expressly consented to by you. You are informed in advance of all those points required by law so that you can give informed consent.

You may revoke this consent at any time as detailed further on in this document.

Recipients, assignments and transfers of data:

Your data will not be transferred unless it is strictly indispensable for the fulfilment of the aforementioned purposes or legal obligation.

Likewise, your data will not be transferred to countries outside the European Union unless it is indispensable for the fulfilment of the aforementioned purposes and you expressly authorise us beforehand.

Rights of interested parties: You may exercise the rights detailed below at any time by sending an e-mail to info@greenertis.com. The request must contain name, surname(s) and documentation proving the identity of the interested party or their legal representative, as well as a document proving representation, the request specifying the request, address for notification purposes, date and signature of the applicant and documents proving the request being made. If the application does not meet the specified requirements, it will be required to be corrected.

The rights of data subjects are: access, rectification, limitation, portability, objection and erasure; and their definition, in accordance with the General Data Protection Regulation, is as follows:

Right of access (art. 15 of the General Data Protection Regulation):

1.- The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him/her are being processed and, if so, the right of access to the personal data and to the following information:

(a) the purposes of the processing;

(b) the categories of personal data undergoing processing; and

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third parties or international organisations;

(d) if possible, the intended period of retention of the personal data or, if not possible, the criteria used to determine this period;

(e) the existence of the right to request from the controller the rectification or erasure of personal data or the restriction or objection to the processing of personal data relating to the data subject; and

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data have not been obtained from the data subject, any available information concerning their origin;

(h) the existence of automated decisions, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, meaningful information about the logic involved and the significance and expected impact of such processing on the data subject.

2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

3. The controller shall provide a copy of the personal data undergoing processing. The controller may charge for any further copies requested by the data subject a reasonable fee based on the administrative costs. Where the data subject makes the request by electronic means, and unless the data subject requests otherwise, the information shall be provided in a commonly used electronic format.

Right of rectification (Art. 16 of the General Data Regulation):

The data subject shall have the right to obtain without undue delay from the controller the rectification of inaccurate personal data relating to him/her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data supplemented, including by means of an additional statement.

Right of erasure (art. 17 of the General Data Regulation):

1.- The data subject shall have the right to obtain without undue delay from the controller the erasure of personal data relating to him/her, who shall be obliged to erase the personal data without undue delay where any of the following circumstances apply:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws the consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) and the consent is not based on another legal ground;

(c) the data subject objects to the processing pursuant to Article 21(1) and no other legitimate grounds for processing prevail, or the data subject objects to the processing pursuant to Article 21(2);

(d) the personal data have been unlawfully processed;

(e) the personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the controller; or

(f) the personal data have been obtained in connection with the provision of information society services referred to in Article 8(1).

2. Where the controller has made public the personal data in respect of which the data subject has exercised his or her right to erasure, the controller shall, taking into account the technology available and the cost of its implementation, take reasonable steps to inform third parties who are processing such information of the request for erasure of the data, as well as of any link to such data or to any copy or replica thereof.

3.- This right shall be limited by other rights such as the right to freedom of expression and information, by compliance with any legal obligation, or when there are reasons of public interest.

Right to restriction of processing (art. 18 of the General Data Regulation):

1.- The data subject shall have the right to obtain from the data controller the restriction of the processing of the data when any of the following conditions are met:

a) the data subject contests the accuracy of the personal data, during a period of time that allows the data controller to verify the accuracy of the data;

(b) the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of their use;

(c) the controller no longer needs the personal data for the purposes of the processing but the data subject needs the personal data for the establishment, exercise or defence of claims; or

(d) the data subject has objected to the processing pursuant to Article 21(1), while it is being verified whether the legitimate grounds of the controller override those of the data subject.

2. Where the processing of personal data has been restricted pursuant to paragraph 1, such data may only be processed, with the exception of their retention, with the consent of the data subject or for the purposes of the formulation, exercise or defence of claims, or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a particular Member State.

3. Any data subject who has obtained the restriction of processing pursuant to paragraph 1 shall be informed by the controller prior to the lifting of the restriction.

Right to object (art. 21 of the General Data Regulation):

The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data relating to him or her on the basis of Article 6(1)(e) or (f), including profiling on the basis of those provisions. The controller shall cease processing the personal data unless he or she establishes compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of claims.

2. Where the processing of personal data is for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her, including profiling insofar as it is related to such marketing.

3. Where the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

4.- Where personal data are processed for scientific or historical research or statistical purposes in accordance with Article 89(1), the data subject shall have the right, on grounds relating to his or her particular situation, to object to the processing of personal data relating to him or her, unless processing is necessary for the performance of a task carried out for reasons of public interest.

Right to data portability (art. 20 of the General Data Regulation):

1.- The data subject shall have the right to receive personal data relating to him/her, which he/she has provided to a controller, in a structured, commonly used and machine-readable format, and to transmit them to another controller without being prevented from doing so by the controller to whom he/she has provided them, where:

(a) the processing is based on consent within the meaning of Article 6(1)(a) or Article 9(2)(a) or on a contract within the meaning of Article 6(1)(b), and (b) the processing is carried out by automated means.

2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have personal data transferred directly from controller to controller where technically feasible.

(3) The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. Such right shall not apply to processing which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Obligation of notification regarding rectification or erasure of personal data or restriction of processing: The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out pursuant to Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this is impossible or would involve a disproportionate effort. The controller shall inform the data subject of those recipients, if the data subject so requests.

Withdrawal of consent: The data subject who has given consent to the processing of his or her personal data may also withdraw such consent with equal ease. Withdrawal of consent shall not entail the unlawfulness of the processing previously carried out.

The data subject shall have the right to lodge a complaint with the competent supervisory authority.

If the personal data are to be further processed for other purposes, the data controller shall inform the data subject accordingly.

Security measures: GREENERTIS declares that it has adopted the necessary technical and organisational measures to guarantee the security of the data and to avoid its alteration, loss, processing or unauthorised access, taking into account the state of the technology, the nature of the data stored and the risks to which it is exposed, whether from human action or from the physical or natural environment.

The WEBSITE contains links to other websites that may be of interest to the interested party. GREENERTIS assumes no responsibility for these links, and no guarantee can be given regarding compliance with appropriate privacy policies, and therefore the interested party accesses the content of the aforementioned websites under the conditions of use set out therein and under their sole responsibility.

If you have any doubts, questions or recommendations about our ‘Privacy Policy’, you can contact us by e-mail at the following address: info@greenertis.com.

GREENERTIS CORP., S.L.
All rights reserved