The Management / Governing Body of DELUXE FUSION, S.L (SABBIA BY GABBEACH) (hereinafter referred to as the “Data Controller”) assumes the utmost responsibility and commitment to establishing, implementing and maintaining this Data Protection Policy, ensuring the continuous improvement of the Data Controller with the aim of achieving excellence in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119/1, 4 May 2016), as well as Spanish legislation on the protection of personal data (the Organic Law, specific sectoral legislation and its implementing regulations).

The Data Protection Policy of DELUXE FUSION, S.L is based on the principle of proactive accountability, whereby the Data Controller is responsible for complying with the legal and regulatory framework and case law governing this Policy and must be able to demonstrate such compliance to the competent supervisory authorities.

Accordingly, the Data Controller shall be guided by the following principles, which shall serve as a guide and frame of reference for all personnel when processing personal data:

1. Data protection by design: Both when determining the means of processing and when carrying out the processing itself, the Data Controller shall implement appropriate technical and organisational measures, such as pseudonymisation, designed to effectively implement data protection principles, including data minimisation, and to integrate the necessary safeguards into the processing.
2. Data protection by default: The Data Controller shall implement appropriate technical and organisational measures to ensure that, by default, only personal data necessary for each specific purpose of processing are processed.
3. Data protection throughout the information lifecycle: Measures designed to ensure the protection of personal data shall apply throughout the entire lifecycle of the information.
4. Lawfulness, fairness and transparency: Personal data shall be processed lawfully, fairly and transparently in relation to the data subject.
5. Purpose limitation: Personal data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner that is incompatible with those purposes.
6. Data minimisation: Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
7. Accuracy: Personal data shall be accurate and, where necessary, kept up to date. Every reasonable step shall be taken to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
8. Storage limitation: Personal data shall be kept in a form which permits the identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
9. Integrity and confidentiality: Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
10. Information and training: One of the key factors in ensuring the protection of personal data is providing information and training to personnel involved in its processing. Throughout the information lifecycle, all personnel with access to personal data shall receive appropriate training and information regarding their obligations under applicable data protection legislation.

The Data Protection Policy of DELUXE FUSION, S.L shall be communicated to all personnel of the Data Controller and made available to all interested parties.

Accordingly, this Data Protection Policy applies to all personnel of the Data Controller, who must be familiar with it and accept it as their own. Each member of staff is responsible for implementing the Policy and verifying compliance with the data protection rules applicable to their activities, as well as identifying and proposing any opportunities for improvement they consider appropriate, with the aim of achieving excellence in compliance.

This Policy shall be reviewed by the Management / Governing Body of DELUXE FUSION, S.L as often as deemed necessary to ensure that it remains fully aligned with the applicable legislation and regulations on the protection of personal data.