Legal information

I. INTRODUCTION

(hereinafter, the organization) reserves the right to modify this Policy in order to adapt it to legislative developments, case-law criteria, industry practices, or the entity's interests. Any modification thereto will be announced with due notice, so that you have full knowledge of its content.

In order to provide you with certain services, the processing of your personal data is necessary. To this end, such data will be incorporated into the corresponding processing activities of The organization, and will be processed for the specific purpose of each processing operation, in accordance, mainly, with the regulation established by Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, "GDPR"), applicable to users in the European Economic Area, and with the federal and state privacy laws of the United States —including the California Consumer Privacy Act as amended (CCPA/CPRA) and equivalent state laws—, applicable to United States residents.

II. GENERAL INFORMATION.

Below, The organization provides general information about the safeguarding of privacy and the protection of personal data applied to the processing activities it carries out at the level of the Portal, as well as by other means:

1.- Who is the Controller responsible for processing your personal data?

The organization holds the status of Data Controller

• The company's identification details appear further below in this policy.
• Contact email: [email protected]
• Our website: https://www.setroi.com/

2.- For what purposes do we process your personal data?

The purpose of the collection and processing of personal data, through the various forms owned by the organization and made available to Users, corresponds, depending on the specific case, to managing and attending to requests for information, queries, complaints, congratulations or suggestions regarding the publications or any services or activities, acts or events provided, offered, patronized and/or sponsored by the organization. Specifically, at the organization we process data for these purposes:

• Information and, where applicable, processing of the registration request and management of your status as a Member of the organization / Client of the organization.
• Economic, accounting, administrative and billing management in any of its capacities (Member of the organization / Client of the organization; publication orders; registrations).
• Management of subscription requests for the receipt of electronic communications and newsletters about the organization.
• Attention to, response to and management of requests for information or contact made to the organization.
• Sending of information about the organization's own services, conferences and events organized, including information about the organization's services.
• Carrying out market studies to measure the quality of the organization's services, through satisfaction surveys.
• In the case of purchases through the organization's website, the data collected therein will be used to manage the contractual relationship with the organization, as well as for the economic, accounting, administrative and billing management derived therefrom.
• Inclusion, where applicable, in the restricted-access area of the website.

3.- What is the legal basis that legitimizes the processing of your personal data? In other words, what grounds or authorizes us to process your personal data?

The legal basis that legitimizes us to process your personal data is the following; (I) the consent given by you through the signing or acceptance of the relevant forms, for one or several specific purposes (II) and, where applicable, the performance of a contract to which you are party, in the capacity of contractor or client.

4.- For how long do we retain your personal data?

We will retain your personal data for the corresponding period in order to maintain a service history and manage our services efficiently and as long as the data subject does not request its deletion. Even once deletion is requested, the data will be kept blocked for the necessary time, and limiting its processing, only for any of these cases: to comply with the legal/contractual obligations of any kind to which we are subject and/or during the legal periods provided for the limitation of any liabilities on our part and/or the exercise or defense of claims arising from the relationship maintained with the data holder.

5.- Who must keep the data up to date?

On the other hand, in order for the data held in our files, computerized and/or on paper, to always correspond to reality, an effort will be made to keep it up to date. Thus, to this end, the User must make the changes directly, when so enabled, or by communicating, by reliable means, to the corresponding area or department of the organization.

6.- Who may be assignees or recipients of your personal data?

Personal data will not be transferred or disclosed to third parties, except in the cases necessary for the development, control and fulfillment of the stated purpose(s), in the cases provided for by Law. Your contact details and/or bank information could be disclosed to your banking entity if we must consult with your entity any dispute or communication related to the payments for the service.

7.- Security of personal data.

The organization will adopt in its information system the appropriate technical and organizational measures, complying with the principle of proactive responsibility, in order to guarantee the security and confidentiality of the stored data, thus preventing its alteration, loss, unauthorized processing or access; taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as risks of varying likelihood and severity associated with each of the processing operations.

8.- What are your data protection rights and how can you exercise them?

You may exercise the rights of access, rectification, erasure, restriction, portability or, where applicable, objection. To this end, you must submit a written request to the organization, by email addressed to the following address [email protected] or to the postal address indicated above.

In the written request you must specify which of these rights you wish to be satisfied and, at the same time, you must show or, in the case of postal sending, attach a copy of an official identity document (passport or equivalent). In the event that you act through a representative, legal or voluntary, you must also provide a document accrediting the representation and an identification document of said representative. Likewise, if you consider your right to the protection of personal data to be infringed: if you reside in the European Economic Area, you may lodge a complaint with the supervisory authority of your Member State; if you reside in the United States, you may contact your state's consumer protection authority (for example, your state Attorney General's office).

Below, more information is provided about the exercise of your data protection rights:

• What are my rights?
• Who can exercise these rights before the organization?
• How and where can I exercise these rights?

9.- Applicable framework by place of residence (European Union and United States)

Users in the European Economic Area: your data is processed under the GDPR. You have the rights described in this policy and may lodge a complaint with the supervisory authority of your Member State.

United States residents: depending on your state of residence (for example, California under the CCPA/CPRA), you have the rights to know and access the data we process, to correct it, to request its deletion, to portability and not to be discriminated against for exercising those rights. The organization does not sell or share personal data within the meaning of the CCPA/CPRA. You may exercise these rights by writing to [email protected] or through the contact form.

Users in other countries: may exercise the same rights through the same channels, without prejudice to any additional rights granted by the laws of their country.

Where the data is processed: data may be processed in the United States and in the European Union. Transfers of EEA users' data outside the EEA are covered by the safeguards provided for by the GDPR, such as the standard contractual clauses approved by the European Commission.

Company

Your data may be disclosed to the other companies of the Group for internal administrative purposes and for the provision of the service, on the basis of the legitimate interest of the Group.

III. SUPPLEMENTARY INFORMATION ON RIGHTS.

a) What are my rights?

Data protection regulations allow you to exercise, before the data controller, the organization, the rights of access, rectification, objection, portability, erasure ("right to be forgotten"), restriction of processing and not to be subject to individualized decisions, in accordance with Regulation (EU) 2016/679, of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter "GDPR"), applicable to users in the European Economic Area; United States residents additionally have the rights described in section 9 of this policy:

Right of access.

You have the right to know:

• Whether or not we are processing personal data concerning you.
• The origin of your data, if you did not provide it to us.
• The purposes of the processing of your data.
• The categories of data concerned.
• The recipients or the categories of recipients to whom the personal data have been or will be disclosed.
• Where possible, the envisaged period for which the personal data will be stored (or, where not possible, the criteria used to determine that period).
• The right to lodge a complaint with a supervisory authority.
• Whether we make automated decisions -including profiling- using your personal data.

Right of rectification.

You have the right to have your personal data rectified:

• Completing it, if it is incomplete.
• Updating or rectifying it, if for any reason it no longer conforms to the current reality or is inaccurate.
• Through the exercise of the right of rectification, we will guarantee that all your personal data is accurate and complete.

Right of erasure.

You have the right to have your personal data erased when any of the following conditions are met:

• Such data is no longer necessary for the purposes for which it was collected or processed.
• You withdraw the consent on which we base the processing of your data and this cannot be supported on another basis of legitimacy.
• You have successfully exercised the right to object to the processing of your data.
• The personal data has been unlawfully processed.

Right to restriction of processing.

You have the right to have your personal data erased when any of the following conditions are met:

Right of objection.

You will have the right to ask us to stop using your personal data, for example, when you believe that the personal data we hold about you may be incorrect or you believe that we no longer need to use it.

Right of portability.

When the processing of your data is based on consent or is necessary for the performance of a contract or pre-contract and is carried out by automated means, you will have the right to the portability of your data, that is, to have it delivered to you in a structured, commonly used and machine-readable format, even to send it to a new controller; that is why the organization will facilitate the portability of your data to the new controller.

b) Who can exercise these rights before the organization?

You, as the data subject or holder of the personal data, acting in your own name and right.

Through another person who acts, duly accredited, as a legal representative (e.g., when the holders of parental authority or guardianship act on behalf of a person under 14 years of age or when acting as the legal representative of a person with functional diversity) or voluntary representative (a person to whom you have freely and voluntarily granted powers of representation to this end).

c) How and where can I exercise these rights?

• By postal mail:

• By internet:

You may submit the written request by sending an email to the following address [email protected]

In both cases, you must:

• Provide sufficient data and information to deal with the request.
• Sign the form by hand or, where applicable, and if you have a recognized digital certificate, sign it electronically.
• Attach a copy of your passport, identity card or other equivalent identification document.

In the event of acting on behalf of a third party, a copy of your ID card or equivalent identification document must also be included, as well as the document accrediting the representation of the data subject.

Send the form and documents accrediting your identity by any of the means mentioned above.

d) Supplementary information.

The organization will analyze whether or not the request complies with the law. It will communicate the decision adopted to the petitioner, proceeding accordingly: if it is upheld, it will adopt the appropriate measures according to the right exercised; if it is rejected, it will indicate the legally provided system of appeals. In the event that the requests are manifestly unfounded or excessive (e.g., repetitive in nature), The organization may: (I) Charge a fee proportional to the administrative costs incurred (II) Refuse to act.

For more information or clarification about your personal data protection rights, you may send a written request to the following email address [email protected]

IV. ADDITIONAL INFORMATION ON DATA PROTECTION.

1. CLIENTS AND MEMBERS.

Your data is processed by the organization as data controller.

Your personal data will be used for the purpose of maintaining relationships of any kind with our clients as a result of the contractual relationship we maintain, especially that referring to the economic, administrative and tax management, quality, and personalized attention necessary to fulfill the contractual relationship.

The lawfulness of the processing is based on Article 6.1.b) of the GDPR: the processing is necessary for the performance of a contract to which the data subject is party or for the application, at the request of the data subject, of pre-contractual measures, and 6.1c) of the GDPR: the processing is necessary for compliance with a legal obligation applicable to the data controller.

The retention period of your personal data will be, while the established relationship lasts and once it has ended, it will be kept on the basis of the legal retention periods in economic and tax matters, which, based on the type of document, may range from a minimum of 4 years to a maximum of 10 years.

2. SUPPLIERS.

The personal data of the signatory of the contract, as well as of the persons who participate or are in contact on the occasion of the provision of the service, will be processed by the organization, in its capacity as Data Controller.

The legal basis that legitimizes the processing of the data is the contractual relationship, for its formalization and performance.

The purpose of the processing is to maintain the contractual relationship, in the economic and technical aspects derived therefrom, as well as the development and control of the contracted service(s) and, where applicable, the sending of information about the incidents related to them.

The data will not be transferred to third parties, unless it is disclosed to the public or private entities to which it is necessary or obligatory to transfer it in order to manage the contractual relationship, as well as in the cases provided for by Law.

The data will be kept for the time necessary to fulfill the purpose for which it was collected and to determine the possible liabilities that could arise from said purpose and from the processing of the data, and may be required by the competent public authorities (Tax Agency, Courts or Tribunals).

3. SOCIAL NETWORKS.

The organization has different profiles on social networks to publicize its activities and interact with users. The users of said social networks who voluntarily decide to follow or become friends of the organization express their consent for the processing of their personal data relating to their profile in order to interact on the social network. The organization does not collect data from social networks for purposes other than those mentioned.

The use of social networks entails an international transfer of data for the provision of the service. This communication is carried out on the basis of the

adoption by the social network of standard contractual clauses, in accordance with Decision 2010/87 of the European Commission. At any time you may stop following or being a friend of the organization.

The user must respect the rights of third parties, especially rights of privacy and data protection, as well as intellectual and industrial property regulations, in all information published on the organization's website.

The publication of information that in any way undermines morality, public order, fundamental rights, public freedoms, with special attention to the honor, privacy or image of third parties and, in general, against human rights, is prohibited. The user of the website will be the sole party responsible for the information they publish.

We recommend that you review the privacy settings of the social network and we attach a link to the different privacy policies:

Twitter: https://twitter.com/es/privacy

Facebook: https://es-es.facebook.com/privacy/explanation

Instagram: https://es-es.facebook.com/help/instagram/519522125107875

Linkedin: https://es.linkedin.com/legal/privacy-policy

Youtube: https://www.youtube.com/intl/es/about/policies/#community-guidelines

4. EMAIL.

The personal data that we process as a result of the receipt and/or exchange of emails will be processed for the purpose of attending to and responding to your request for information or query, to maintain the commercial or professional contacts and relationships that arise as a result of it, or for the maintenance, where applicable, of a contractual relationship.