In compliance with current personal data protection legislation, and more specifically with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to personal data processing and on the free movement of such data, repealing Directive 95/46/EC), set out below is information on the Personal Data Protection Policy of the Spanish National Securities Market Commission.
The owner of the personal data to be processed, in his or her capacity as the data subject, is recommended to read this information carefully each time he or she accesses this website so that he or she is aware of all matters related to the processing of personal data that may be provided through the website www.cnmv.es as well as through any other means or form made available for this purpose.
This Data Protection Policy disclosed to the data subject implies compliance by the Spanish National Securities Market Commission with its obligation to inform him or her, in accordance with the principle of transparency, of the circumstances and conditions of its processing of the personal data that the data subject provides it with through the forms made available to him or her on the Website, the forms used to browse the Website and any other data that may be provided through any other means or support, as well as the rights corresponding to the data subject.
Data controller
The data controller is the Spanish National Securities Market Commission (Comisión Nacional del Mercado de Valores), with Tax Identification Code (CIF) Q-2891005-G, domiciled at Calle Edison no. 4, 28006 Madrid, and telephone number 915851500.
Data Protection Officer contact details: according to the procedure detailed in the paragraph “Rights of data subjects” below.
Purpose of personal data processing
The purpose of data processing corresponds to each of the processing activities carried out by the Spanish National Securities Market Commission in order to comply with the legally established obligations incumbent upon the Spanish National Securities Market Commission, as well as the processing and management of requests, claims, complaints, enquiries, personnel selection processes, subscription to Education Programmes, news, publications, official announcements, regulations, relations with suppliers, statistical reports regarding access habits and the activity carried out by the data subject on the Spanish National Securities Market Commission’s website.
Legal basis
The data subject’s personal data is processed in order to comply with legal obligations incumbent upon the Spanish National Securities Market Commission, performance of tasks carried out in the public interest or in the exercise of the public powers vested on the Spanish National Securities Market Commission, and also when the purpose of the processing requires his or her consent, which must be given by means of a clear affirmative action.
Confidentiality
The personal data that may be collected directly from the data subject shall be treated confidentially and used for the purposes of the corresponding processing activity carried out by the Spanish National Securities Market Commission, adopting for this purpose the necessary technical and organisational measures to ensure the security of his or her data and prevent alteration, loss or unauthorised access, taking into consideration the state of technology, nature of the data stored and risks to which it is exposed.
Obligation to provide data
Unless otherwise stated on the forms on the website which the data subject accesses, the data requested on such forms is mandatory and strictly necessary to comply with the purposes established on them. Consequently, refusal to fill them in or their incorrect completion will make it impossible for the purposes pursued by these forms and requested by the data subject to be met.
Data retention
The personal data provided will be kept for the time necessary to fulfil the purpose for which it is collected and to determine any liabilities that may arise from such purpose, in addition to the periods established in the regulations on files and documentation.
Communication of data
In general, personal data will not be communicated to third parties, unless there is a legal obligation which requires the data to be communicated to administrative or judicial authorities, the Public Prosecutor´s Office, the European Securities and Markets Authority (ESMA), other regulators and supervisors, Parliamentary Research Committees and the Investor Guarantee Fund.
Personal data may only be disclosed to companies that provide services to the Spanish National Securities Market Commission under commission contracts entered into for the purposes of the maintenance and proper functioning of the services and activities of the Spanish National Securities Market Commission.
In the event that the recipients indicated in this paragraph are located outside the European Economic Area, international data transfers shall be duly legitimised.
Rights of data subjects
The data subject, in accordance with data protection regulations and with the requirements, purposes and limits established therein, may exercise the following rights before the Spanish National Securities Market Commission:
- Withdraw the consent that he or she has previously granted. When the processing of the data subject’s data by the Spanish National Securities Market Commission is based on the consent given by him or her, he or she may withdraw his or her consent at any time, without this affecting the lawfulness of the processing previously carried out. The consents obtained for the aforementioned purposes are independent, for which reason the data subject may revoke only one of them, without affecting the others.
- Obtain confirmation of the processing of his or her data that is carried out.
- Access his or her personal data.
- Request the rectification of the data that he or she considers inaccurate or incomplete.
- Request the erasure of his or her data be when its collection and processing are carried out on the basis of his or her consent. The Spanish National Securities Market Commission, in accordance with the provisions of data protection regulations, may not process requests for the deletion of data when it has been obtained and processed in compliance with a legal obligation or to fulfil a mission carried out in the public interest or in the exercise of public powers conferred on it.
- Request the restriction of processing his or her data when any of the conditions established in the data protection regulations are met.
- Request the portability of his or her data, through the method and under the terms established in the data protection regulations.
- Object to the processing of his or her data when any of the conditions established in the data protection regulations are met.
- Not to be subject to a decision based solely on automated processing of his or her data.
In order to exercise these rights, the data subject must download the appropiate forms, fill and sign them attaching a copy of his or her Spanish national identity document (DNI) (or any other document proving his or her identity), and send them to “Protección de datos”, by ordinary mail to CNMV address or through the CNMV virtual office.In the event that the data subject considers that the Spanish National Securities Market Commission has violated his or her rights to the protection of his or her personal data, he or she may file a complaint with the Spanish Data Protection Agency.Without prejudice to the foregoing, the data subject may also, prior to filing a complaint with the Spanish Data Protection Agency, contact the CNMV’s data protection officer, downloading the appropiate form , filling, signing and sending it to “Delegado de Protección de Datos”, by ordinary mail to CNMV address or through the CNMV virtual office.