Basic information on personal data protection. The data collected will be incorporated and processed within the processing activity relating to administrative management, for which the Excmo. City Council of San Cristóbal de La Laguna is responsible, for the purpose of handling the corresponding administrative procedure. Data subjects may exercise their rights of access, rectification, erasure and objection, and other data protection rights, by requesting them in person at the Citizen Assistance Service office, located at Calle San Agustín, 38 – P.C. 38201, and at the Deputy Mayor’s Offices, or electronically through the municipal electronic headquarters. Data processing is legitimized by legal obligation as well as by the data subject’s express consent through signing this document. The data will be communicated to the City Council’s administrative Services/Units competent in the matter related to the communication made and may not be transferred to third parties except in the cases provided for in the applicable personal data protection regulations. You may contact the City Council’s Data Protection Officer at the following email address: oae@aytolalaguna.es. You may also consult the additional information on personal data protection on the municipal website www.aytolalaguna.es. Signing this document constitutes proof of your explicit consent to the processing of your personal data.
| Introduction | This information has been prepared taking into account the provisions of Organic Law 15/1999, of December 13, on the Protection of Personal Data (LOPD), as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the GDPR). The purpose of this Privacy Policy is to inform personal data holders, from whom information is being collected, about the specific aspects relating to the processing of their data, including, among other things, the purposes of the processing, contact details for exercising their rights, data retention periods, and security measures.
This policy will apply both to information collected directly through the different services of the City Council of San Cristóbal de La Laguna, and through its website www.aytolalaguna.es and other municipally owned portals. |
||||||||||||||||||
| Processing | The personal data that may be requested, where applicable, will consist only of those strictly essential to identify and address the request made by the data subject (hereinafter, the interested party). Such information will be processed fairly, lawfully and transparently in relation to the interested party. Furthermore, personal data will be collected for specified, explicit and legitimate purposes and will not be further processed in a manner incompatible with those purposes.
The data collected from each interested party will be adequate, relevant and not excessive in relation to the purposes applicable in each case, and will be kept up to date whenever necessary. The data subject will be informed, prior to the collection of their data, of the basic and additional information on data protection required by Article 13 GDPR, so that they may give express, specific and unambiguous consent to the processing of their data, in accordance with the following aspects. The City Council of San Cristóbal de La Laguna, as the Data Controller, guarantees an adequate and consistent level of protection of the privacy and confidentiality of natural persons with regard to their personal data processed by the various municipal services of the City Council for administrative management within local competences. The privacy of all information—both that provided by the user through the different personal data request forms and that accessible through the City Council’s website—is governed by the GDPR. |
||||||||||||||||||
| Data controller | For data protection purposes, the City Council of San Cristóbal de La Laguna must be considered the Data Controller in relation to the files/processing activities registered in the Public File Register of the Spanish Data Protection Agency. The identifying details of the owner of this website, the Data Controller, are as follows: City Council of San Cristóbal de La Laguna. Postal address: Calle Obispo Rey Redondo, No. 1, 38201 San Cristóbal de La Laguna.
|
||||||||||||||||||
| Consent | As a general rule, prior to processing personal data, the City Council of San Cristóbal de La Laguna obtains the data subject’s express and unambiguous consent by including informed-consent clauses in the different information collection systems. The signature of the application by the interested party who is the holder of the data constitutes proof of their explicit consent to the processing of their data. However, where the interested party’s consent is not required, the legal basis for processing relied upon by the City Council of San Cristóbal de La Laguna is the existence of a specific law or regulation that authorizes or requires the processing of the interested party’s data.
The processing of personal data entails the interested party’s consent for one or more specific purposes. Likewise, processing will be lawful when necessary for compliance with a legal obligation applicable to the controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Consent of the interested party means any freely given, specific, informed and unambiguous indication of the interested party’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them. For the purposes of demonstrating consent, it will be understood to be proven by the interested party’s signature on the corresponding form, application, request or document. The interested party shall have the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Before giving consent, the interested party will be informed of this. |
||||||||||||||||||
| Purpose | The City Council will use the data for the purposes of handling, managing, monitoring and resolving inquiries and requests relating to procedures or services provided in administrative procedures within municipal competence. The data processed will be kept until the request has been processed and the inquiry resolved and, in any case, for the legally established retention and limitation periods.
The explicit purposes for which each processing activity is carried out are set out in the information clauses included in each data collection channel (web forms, paper forms, recordings or posters, and information notices). However, the interested party’s personal data will be processed solely for the purpose of providing an effective response and addressing the requests made by the user, as specified together with the option, service, form or data collection system used by the data subject. In general, the following are listed: General requests: The purpose of processing personal data refers to the registration, handling and management of people’s right to communicate with the city council, including the right of petition. Incidents, complaints, suggestions and requests: The purpose of processing personal data refers to the registration, handling and management of people’s right to communicate with the city council, including the right of petition. Transparency. Access to information. The purpose of processing personal data refers to the registration, handling and management of people’s requests for access to public information, as a subjective right held by all persons to access public information. Communications: The purpose of processing personal data refers to the management and processing of communications from citizens to the City Council for the purpose of contacting the City Council and enabling the various municipal services to address them. Certificates. The purpose of processing personal data refers to the processing and issuance of certificates requested by interested persons. Municipal Population Register. The purpose of processing personal data refers to the management of the administrative register listing the residents of the municipality, as well as the accreditation and determination of their domicile and habitual residence, and linking a person in the municipality as an integral part of its population. Complaints/Reports. The purpose of processing personal data refers to the registration, management and processing of complaints/reports within the scope of municipal competences. Municipal taxes. The purpose of processing personal data refers, in general, to managing the relationship between the taxpayer and the City Council and handling and managing the rights of taxpayers; specifically, to the management, assessment and collection of municipal taxes. Social Welfare. The purpose of processing personal data refers to the management and processing of the provision of assistance or treatment of a social nature. Education. The purpose of processing personal data refers to the management of the various activities involved in providing the public education service carried out by the City Council in the exercise of its educational competences and functions. Culture. The purpose of processing personal data refers to the organization and management of cultural and leisure activities in the municipality. Youth: The purpose of processing personal data refers to the promotion and actions in policies aimed at young people in the municipality. Incoming and outgoing document register. The purpose of processing personal data refers to the internal and external guarantee of documents submitted to the City Council and official documents sent to other bodies or individuals. Register of stable unions/partnerships. The purpose of processing personal data refers to the management of the register of stable partnerships. Register of domestic animals. The purpose of processing personal data refers to the registration, management and control of identification codes for domestic animals in the municipality. Register of potentially dangerous animals. The purpose of processing personal data refers to the registration, management and control of identification codes for dangerous animals and the suitability of owners, ensuring compliance with the required conditions. Public roads. The purpose of processing personal data refers to the processing and management of applications for authorizations and permits related to the occupation/affectation of public roads. Public health. The purpose of processing personal data refers to the management of municipal public health services, including public health surveillance and sanitary control. Municipal spaces: The purpose of processing personal data refers to the management of municipal facilities and spaces. Mobility. The purpose of processing personal data refers to the administrative management and processing of matters relating to citizens’ mobility. Cemetery. The purpose of processing personal data refers to the management of ownership of burial rights over niches and of burials and exhumations carried out in the municipal cemetery. Economic promotion. The purpose of processing personal data refers to the management of the promotion and boosting of commercial activity and the provision of commercial services in the municipality, as well as the management of the service promoting business creation and entrepreneurship, and the employment service for jobseekers. Environment. The purpose of processing personal data refers to the development of environmental activities and projects. Citizen participation. The purpose of processing personal data refers to the management of actions enabling people and civil society to participate in public decision-making. Register of entities. The purpose of processing personal data refers to the management of the municipal register of entities and the processing of notifications to the City Council regarding entities and associations. Staff selection. Processing and management of staff selection processes and job placement/provision. Economic and budgetary management. Management of expenditure files and budgetary control of the City Council. Access control. The purpose of processing personal data refers to ensuring the security of facilities, premises and people, as well as the registration and control of visits. Public safety. The purpose of processing personal data refers to the management of actions relating to the exercise of Local Police functions. Tourism. The purpose of processing personal data refers to the tourist promotion of the municipality. Handling of data subjects’ rights. The purpose of processing personal data refers to the registration, handling and management of requests to exercise data protection rights recognized for interested persons. Gender equality policies. The purpose of processing the data will be to disseminate actions linked to gender equality, as well as to provide information services to women and specialized support to those who are in a situation of gender-based violence. |
||||||||||||||||||
| Legal basis for processing | The legal basis for processing the data will depend on the intended purpose, in accordance with General Data Protection Regulation 2016/679, and may be the express and unambiguous consent given by the user, the performance of a contract, compliance with a legal obligation, the performance of a task carried out in the public interest, or the exercise of official authority. In general, these are:
Article 6(1)(a) GDPR. The data subject gives consent to the processing of their personal data for one or more specific purposes. |
||||||||||||||||||
| Source of the data | The personal data processed by the City Council for the performance of a task carried out in the public interest, in the exercise of official authority, or for compliance with a legal obligation comes directly from the data subjects, their legal representatives, or other public administrations in accordance with legal provisions. As a general rule, personal data is always collected directly from the data subject. However, in certain exceptions, data may be collected through third parties, entities or services other than the data subject. In this regard, this circumstance will be communicated to the data subject through the informed-consent clauses contained in the different information collection channels and within a reasonable period after obtaining the data, and at the latest within one month. | ||||||||||||||||||
| Data recipients | The personal data included in the corresponding forms, applications and requests will be communicated to the different Areas, Services and administrative Units of the City Council that are competent in the matter to which the communication relates. As a general rule, the City Council of San Cristóbal de La Laguna does not transfer or disclose data to third-party entities, except where legally required. However, should it be necessary, such transfers or disclosures are informed to the data subject through the informed-consent clauses contained in the different personal data collection channels. | ||||||||||||||||||
| Transfer of data | Personal data may not be transferred to third parties outside the City Council except in the cases provided for in the applicable personal data protection regulations, without the need for the data subject’s consent in the cases listed in Article 11.2 of Organic Law 15/1999, of December 13, on the Protection of Personal Data. | ||||||||||||||||||
| International data transfer | Not foreseen. | ||||||||||||||||||
| Data categories | Identifying data; data relating to personal characteristics: marital status, family, birth, place of birth, age, sex, nationality; academic and professional data or data relating to the job position; special categories of data; and other data that may be provided by the user, depending on the administrative procedure or municipal action. | ||||||||||||||||||
| Data Protection Officer
|
By Decree of the Councillor Delegate for the Presidency and Planning No. 838/2018, dated May 23, it was resolved to assign the functions of Data Protection Officer to the Head of the Planning, Organization, Quality and Inspection Service solely within the scope of the City Council, not including public bodies (autonomous bodies and commercial companies).
The contact email address for this purpose is: oae@aytolalaguna.es The postal address is: Data Protection Officer, Presidency and Planning Area of the Excmo. City Council of San Cristóbal de La Laguna, Calle Obispo Rey Redondo, No. 1, postal code 38201. Within the municipal scope, they perform the functions established in Article 39(1) of the: a) Inform and advise the controller or the processor and the employees who carry out processing of their obligations under the GDPR and other Union or Member State data protection provisions. b) Monitor compliance with the GDPR, other Union or Member State data protection provisions, and the controller’s or processor’s personal data protection policies, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits. c) Provide advice where requested regarding the data protection impact assessment and monitor its performance in accordance with Article 35 GDPR. d) Cooperate with the supervisory authority. e) Act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36 GDPR, and consult, where appropriate, on any other matter. The aforementioned decision also provided for the appointment of a substitute Data Protection Officer for cases of vacancy, absence or illness of the holder, appointing for this purpose the civil servant assigned to the Head of the Personnel Management Section and Acting Technical Secretary. |
||||||||||||||||||
| Rights |
Any person has the right to obtain confirmation as to whether or not the City Council of San Cristóbal de La Laguna is processing personal data concerning them. Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, data subjects may request the restriction of the processing of their data, in which case it will only be retained for the exercise or defense of legal claims. Likewise, for reasons related to their particular situation, data subjects may object to the processing of their data. The controller will cease processing the data, except for compelling legitimate grounds, or for the establishment, exercise or defense of possible legal claims. They also have the right to withdraw the consent granted, in which case it will be effective from the moment they request it, without retroactive effect, and the right to lodge a complaint with the Spanish Data Protection Agency. In this regard, pursuant to Article 13(2)(c), where processing is based on Article 6(1)(a) or Article 9(2)(a) GDPR, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. The exercise of all related rights must be requested by the data subject by means of a written request submitted in person at the offices of the SAC of this City Council; or electronically through the municipal electronic headquarters (https://sede.aytolalaguna.es/publico/procedimientos/ciudadano) under the category of personal data protection procedures. The catalogue of procedures on personal data protection is available both on the website and on the municipal electronic headquarters, where you will find an information sheet for each procedure and the standardized forms linked to each one: – Right of access: the right to obtain information about whether your own data is being processed, the purpose of the processing being carried out, the categories of data concerned, the recipients or categories of recipients, the retention period, and the source of such data. – Right to cancellation: the right to obtain the cancellation of your own data being processed. Cancellation will result in the blocking of the data, which will be kept only at the disposal of Public Administrations, Judges and Courts, for addressing any liabilities arising from the processing, during the applicable limitation period. Once that period has elapsed, the data must be erased. – Right to rectification: the right to obtain the rectification of inaccurate or incomplete personal data. – Right to erasure: the right to obtain the erasure of data in the following cases:
– Right to object: the right to object to certain processing based on the data subject’s consent. – Right to restriction: the right to obtain restriction of processing when any of the following applies: 1. When the data subject contests the accuracy of personal data, for a period enabling the controller to verify its accuracy. 2. When processing is unlawful and the data subject opposes the erasure of the data. 3. When the controller no longer needs the data for the purposes for which it was collected, but the data subject needs it for the establishment, exercise or defense of legal claims. 4. When the data subject has objected to processing pending the verification whether the controller’s legitimate grounds override those of the data subject. – Right to data portability: the right to receive the data in a structured, commonly used and machine-readable format, and to transmit it to another controller when: 1. Processing is based on consent 2. Processing is carried out by automated means – Right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency. If you do not agree with the resolution safeguarding your rights, you may lodge a complaint with the Spanish Data Protection Agency. More information on its website: www.agpd.es. If standardized templates are not used, in any case the request must include the following data: first and last name of the user, identification document number (ID card, passport or other document proving identity), address for notifications, and the specific content of the right being exercised. If the procedure is carried out in person, a photocopy of the identification document must be attached to the request. The request must clearly indicate in the subject: GDPR rights protection. The body competent to resolve procedures for exercising rights in the area of data protection is the Councillor Delegate for the Presidency and Planning. |
||||||||||||||||||
| Publication of personal data in electronic media | The resolutions and procedural acts arising from the administrative procedure to which the personal data in this application is attached, and under the terms established in the corresponding call, may be published on the City Council’s Official Notice Board, on the municipal website www.aytolalaguna.com, or on the municipal intranet. Publication in the different municipal electronic media will be blocked or cancelled once the publicity period for the corresponding administrative act has ended. | ||||||||||||||||||
| Data retention | The information collected from the data subject will be retained for as long as necessary to fulfill the purpose for which the personal data was collected, so that once the purpose has been fulfilled, the data will be cancelled. Such cancellation will result in the blocking of the data, which will be kept only at the disposal of Public Administrations, Judges and Courts, to address any liabilities arising from processing during the applicable limitation period. Once that period has elapsed, the information will be destroyed. For information purposes, below are the legal retention periods for information in relation to different matters:
|
||||||||||||||||||
| Security measures | The security measures adopted by the City Council of San Cristóbal de La Laguna are those required, in accordance with Article 32 GDPR. In this regard, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, the City Council of San Cristóbal de La Laguna has established appropriate technical and organizational measures to ensure a level of security appropriate to the existing risk.
In any case, the City Council of San Cristóbal de La Laguna has implemented sufficient mechanisms to: 1. Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. 2. Restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident. 3. Regularly test, assess and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of processing. 4. Pseudonymize and encrypt personal data, where appropriate. |
||||||||||||||||||
| Profiling | The processing of the data subject’s personal data does not involve automated decision-making, including profiling. | ||||||||||||||||||
| Browsing data | The City Council of San Cristóbal de La Laguna website uses its own and third-party cookies in order to improve the service provided to users. If you continue browsing, it is understood that you accept their use. It is also understood that you accept their use by clicking any button, checkbox or link, by downloading content, or by scrolling the page.
The City Council uses session and analytics cookies to facilitate user navigation within the different areas and to collect non-personalized data about website usage (times, browsers, etc.). It is important to note that in no case do the cookies used provide or store users’ personal data and they are not permanent: they are deleted when the browser is closed. You can allow, block or delete cookies installed on your device through your browser settings. Even if cookie installation is blocked, it does not prevent effective use of the website by the user. |
Data protection regulations grant a number of rights to data subjects or data holders, users of the website, or users of the City Council of San Cristóbal de La Laguna’s social media profiles.
List of rights. The rights available to data subjects are as follows:
- Right of access: the right to obtain information about whether your own data is being processed, the purpose of the processing being carried out, the categories of data concerned, the recipients or categories of recipients, the retention period, and the source of such data.
- Right to cancellation: the right to obtain cancellation of your own data being processed. Cancellation will result in the blocking of the data, which will be kept only at the disposal of Public Administrations, Judges and Courts, for addressing any liabilities arising from processing, during the applicable limitation period. Once that period has elapsed, the data must be erased.
- Right to rectification: the right to obtain the rectification of inaccurate or incomplete personal data.
- Right to erasure: the right to obtain the erasure of data in the following cases:
-
- When the data is no longer necessary for the purpose for which it was collected
- When the holder withdraws consent
- When the data subject objects to processing
- When the data must be erased to comply with a legal obligation
- When the data was obtained through an information society service based on the provisions of Article 8(1) of the European Data Protection Regulation.
- Right to object: the right to object to certain processing based on the data subject’s consent.
- Right to restriction: the right to obtain restriction of processing when any of the following applies:
-
- When the data subject contests the accuracy of personal data, for a period enabling the controller to verify its accuracy.
- When processing is unlawful and the data subject opposes the erasure of the data.
- When the controller no longer needs the data for the purposes for which it was collected, but the data subject needs it for the establishment, exercise or defense of legal claims.
- When the data subject has objected to processing pending the verification whether the controller’s legitimate grounds override those of the data subject.
- Right to data portability: the right to receive the data in a structured, commonly used and machine-readable format, and to transmit it to another controller when:
-
- Processing is based on consent
- Processing is carried out by automated means
- Right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency.
How to submit. Data subjects may exercise the indicated rights by contacting the City Council of San Cristóbal de La Laguna, by means of a written request including proof of identity, sent to the Citizen Assistance Service of the City Council of San Cristóbal de La Laguna, Calle San Agustín, No. 38, San Cristóbal de La Laguna, or to the Deputy Mayor’s Offices ( Deputy Mayor’s Office of La Cuesta C/ Abreu y Valdés, 1; Deputy Mayor’s Office of Taco C/ Los Charcos, s/n, Edificio Joy; Deputy Mayor’s Office of Tejina C/ Marina González González, 7; Deputy Mayor’s Office of Valle de Guerra C/ Calvario, 1 (Citizen Center), or through the Electronic Register accessible via the Electronic Headquarters of the City Council of San Cristóbal de La Laguna.
In this regard, the City Council of San Cristóbal de La Laguna will address your request as soon as possible and in accordance with the time limits established in data protection regulations.
Furthermore, it should be borne in mind that the data subject or data holder may at any time lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (more information at www.agpd.es).
More information on in-person procedure: http://www.aytolalaguna.com/tramites-y-gestiones.jsp
More information on electronic procedure: https://sede.aytolalaguna.es/publico/procedimientos/ciudadano
