In compliance with the provisions of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) we inform you of the following legal aspects:
1.- Responsible for the treatment
The data controller is Centro Criptológico Nacional (CCN)
CIF number S-2800155-J,
Registered office at C/Argentona 30, 28023 Madrid - Spain.
Telephone (+34) 91 372 50 00
2.- Purpose of the treatment
The collection and processing of personal data has as exclusive purpose the management, provision, expansion and improvement of the services requested at any time by the user, the sending of information, notices and alerts, as well as the monitoring of queries raised by users.
3.- Legitimacy of the treatment
The legal basis for the processing, according to article 6 of the RGPD, is based on the following conditions:
a) The processing is necessary for compliance with a legal obligation applicable to the Controller (CCN), as a result of the powers conferred on it by Royal Decree 311/2022, of 3 May, which regulates the National Security Scheme, Royal Decree 421/2004, of March 12, which regulates the National Cryptologic Center, under the provisions of Law 11/2002, of May 6, regulating the National Intelligence Center, within the framework established by the National Cybersecurity Strategy.
b) The processing is necessary for the performance of a contract to which the data subject is a party or for the implementation at his request of pre-contractual measures; According to the provisions of art.13.c of the GDPR, the processing based on consent shall imply that the existence of the right to withdraw the consent, at any time, shall not affect the lawfulness of the processing based on the consent prior to its withdrawal.
It should be noted that, in the event of requesting a service, this cannot be provided if the data necessary to carry it out are not provided. No automated decisions will be made based on your profile.
Cabe advertir que, en el supuesto de solicitar un servicio, este no podrá prestarse en caso de no ser facilitados los datos necesarios para poder llevarlo a cabo.
No se tomarán decisiones automatizadas en base a su perfil.
4.- Retention of data
In general, the personal data provided will be kept as long as the aforementioned legal obligation of the Data Controller or the aforementioned contractual relationship is maintained. When this relationship ceases, and in any case if the deletion of the data is requested, we will keep your personal data blocked for the periods established by law. Once these periods have elapsed, they will be deleted in accordance with current legislation.
5.- Recipients of assignments or transfers
The data may be transferred to legally authorized third parties, such as the Tax Administration or judicial bodies.
We also inform you of the existence of data processors with whom the appropriate contract for access to data on behalf of third parties is signed in accordance with art. 28 et seq. of the RGPD. Data processors will only be selected if they offer sufficient guarantees to implement appropriate technical and organizational measures to ensure that the processing complies with the legal requirements.
On the other hand, no international data transfers are foreseen.
6.- Rights of the persons concerned
Those affected, within the legal framework applicable in each case, shall have the following rights:
Right to withdraw consent at any time.
Right of access: they may request to consult their personal data.
Right of rectification: they may modify inaccurate personal data or complete incomplete personal data, including by means of an additional declaration.
Right of erasure: you may request the deletion of personal data concerning you.
Right to portability: you have the right to receive the personal data you have provided and to transmit it to another data controller.
Right to restriction: when certain conditions are met, the data subject has the right to obtain the restriction of the processing of his or her personal data.
Right to object to processing: you may request that your personal data not be processed.
Right to file a complaint with the supervisory authority (agpd.es) if you consider that the processing does not comply with the regulations in force.
To exercise any of these rights or to revoke consent you can do so by sending an email to . To exercise your rights you must accompany your request with a copy of your ID card or equivalent document.