Data protection

1. Controller and request channels

The controller is MAGNANIMITAS, S.L., tax ID B88815683. Rights may be exercised free of charge through legal@orvyon.io or by post to Calle Doctor Fleming, 44, 28036 Madrid, Spain.

Identify the data subject, the right concerned and the information needed to locate the relevant processing. A duly authorised representative may act on the data subject’s behalf.

2. Recognised rights

• Access (Article 15 GDPR): confirmation of processing and, where applicable, access to the data and required information.
• Rectification (Article 16): correction of inaccurate or completion of incomplete data.
• Erasure (Article 17): deletion where statutory conditions apply, subject to exceptions and any required statutory blocking.
• Restriction (Article 18): restriction of processing in the circumstances and under the conditions provided by law.
• Portability (Article 20): receipt or transmission of supplied data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
• Objection (Article 21): objection on grounds relating to a particular situation to legitimate-interest processing. Processing must cease unless overriding compelling legitimate grounds or the establishment, exercise or defence of legal claims is demonstrated.
• Withdrawal of consent (Article 7(3)): withdrawal at any time where consent is relied on, without affecting earlier lawful processing.
• Automated decisions (Article 22): applicable safeguards concerning solely automated decisions producing legal or similarly significant effects. The current Website does not make such decisions about visitors.

3. Identity checks and data minimisation

An identity document copy is not routinely required. Under Article 12(6) GDPR, additional information will be requested only where reasonable doubts arise and proportionate confirmation is necessary.

Do not send sensitive information or documents unrelated to the request. Checks will be limited to preventing unauthorised disclosure of third-party information.

4. Response period and format

Information on action taken will be provided without undue delay and within one month of receipt. A further two-month extension may apply because of complexity or the number of requests; notice and reasons must be provided within the first month.

If no action is taken, reasons and the possibility of a supervisory complaint and judicial remedy will be communicated within one month. Where a request is electronic, the response will be electronic where possible unless otherwise requested.

5. Fees and manifestly unfounded or excessive requests

Requests are free of charge. Only under Article 12(5) GDPR, with the controller bearing the burden of demonstrating a request’s manifestly unfounded or excessive character, may a reasonable administration-based fee be charged or action refused.

Assessment must be individual and must not generally obstruct the exercise of rights.

6. Erasure, statutory blocking and legal limits

Erasure is not absolute and may be limited by statutory retention duties or the establishment, exercise or defence of claims, among other legal exceptions.

Where Article 32 LOPDGDD applies, blocked data may not be ordinarily processed and are retained only for competent authorities during applicable liability limitation periods, after which they must be destroyed.

7. Complaints and judicial remedies

If you consider data protection law has been infringed, you may complain to the Spanish Data Protection Agency through www.aepd.es without first having to contact the controller.

This is without prejudice to administrative or judicial remedies and other applicable statutory rights.

8. Further information

The Privacy Policy details data categories, purposes, lawful bases, retention, recipients and international transfers. The Cookies Policy describes terminal storage and access technologies in the published version.