Internal personal data procedure

How Pásame carries out its Personal data processing policy in practice. 1. Who. Pásame's controller handles requests personally and is the only person with access to the database and to the inbox where the forms arrive. 2. Receiving a request. It arrives through the contact form with the topic "My personal data". The arrival date is noted to count the deadlines (queries 10 business days, claims 15). 3. Knowing it is the data subject. A request is handled only if its email is the same as the one in the answers. If it does not match, we reply to that email asking for confirmation from the original one, without revealing any data. 4. Replying. Query: what we keep under that email is sent to the data subject's email. Correction: the data is updated and confirmed. Deletion or revocation: all their answers and messages are deleted from the database and the inbox, and it is confirmed. If they asked to stop receiving notices or news, that is recorded and they are not written to again for it. News: only sent to the emails that ticked that box (column news = 1). 5. Retention. Answers are deleted automatically after 12 months (a monthly task of the site). If the person asked for news, everything but their email is deleted, and the email is kept until they ask to stop. The copies in the inbox are deleted after 12 months. Every news mail says how to stop receiving them: reply to it, or write with the topic “My personal data”. 6. Security. The Cloudflare account and the inbox use two-factor authentication. The database is not public: it is only queried from the controller's account. No IP addresses or browser data are kept. 7. Incidents. If someone accesses the data without permission, the credentials are changed, the affected people are told by email, and the Superintendencia de Industria y Comercio is informed. 8. Review. This procedure is reviewed when what the site collects, or how it is kept, changes.