GDPR information

01Our GDPR commitment

FUNNELD LTD applies Regulation (EU) 2016/679 General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD) to all processing of personal data carried out in the course of its activity. This page summarises the safeguards we offer and the rights available to you.

02Controller and Data Protection Officer

03Legal bases for processing

Each processing activity relies on one of the legal bases provided in article 6 of the GDPR:

04Your rights in detail

As a data subject you have the following rights over your personal data:

• Right of access (art. 15 GDPR): obtain confirmation as to whether we are processing your data and, if so, access to it and to information about the processing.
• Rectification (art. 16): correction of inaccurate or incomplete data.
• Erasure / right to be forgotten (art. 17): deletion when no longer needed, when you withdraw consent or in the event of unlawful processing.
• Restriction of processing (art. 18): temporary blocking when you contest accuracy, object or processing is unlawful.
• Portability (art. 20): receive the data in a structured, commonly used format (JSON, CSV) or have us transmit it to another controller.
• Objection (art. 21): object to processing on grounds related to your particular situation, including direct marketing.
• Not to be subject to automated decisions (art. 22): including profiling, with legal or significant effects.
• Withdrawal of consent at any time, without retroactive effect.
• Complaint before a supervisory authority: Spanish Data Protection Agency (www.aepd.es).

05How to exercise your rights

To exercise any of your rights you may email dpo@funneld.net stating:

1. The right you wish to exercise.
2. Your first name, last name and company.
3. A copy of your ID (or an equivalent verification method) to prove your identity.
4. An address for notification.
5. Any additional data or document that helps locate the information.

Exercising your rights is free of charge. We will respond within a maximum of one month from receipt, extendable to two months when the request is particularly complex, and we will inform you of any delay in accordance with art. 12.3 GDPR.

06Security breaches

We apply detection, containment and notification processes for security breaches in accordance with articles 33 and 34 of the GDPR:

• Notification to the Spanish Data Protection Agency within a maximum of 72 hours of awareness, when the breach may pose a risk to the rights and freedoms of data subjects.
• Communication to affected data subjects when the breach entails a high risk to their rights and freedoms.
• Maintenance of an internal incident register with analysis, measures adopted and lessons learned.

07Privacy by design and by default

We apply the principle of privacy by design (art. 25 GDPR) in the development of new products, integrating protection measures from the planning stage. By default, we collect only the strictly necessary data and apply the most restrictive visibility levels.

08Processors and international transfers

For more information on our data processors, international transfers and applied security measures, see the Privacy policy and the Security policy.