Data Protection Policy

Why and for what purpose do we process your personal data? Below are the different purposes for which DPay processes your data:

• Processing carried out by the contract. These are necessary for signing the contract or providing the service you request.

We will process your data to inform you about the contracting of products and services, for their contracting, as well as to maintain and fulfill the contract.

To fulfill the contract, we may use external sources of information, such as newspapers and official bulletins, public registers, resolutions of the Public administrations, telephone directories, lists of members of professional associations, official lists for fraud prevention, social networks, and the Internet.

• Processing carried out with your consent. Provided that you have given your consent through the box enabled for this purpose on the form we will make available to you.
• Processing carried out for legitimate interest.
1. We will process your data for the development of commercial actions, both general and tailored to your commercial profile, to offer you products or services similar to those you have already contracted. Marketing actions may be carried out by any means, including electronic means (email, fax, SMS, social media, mobile applications, etc.).
2. We will process your data to conduct observations and recommend products and services. We will consult the information we have from managing the services we provide to you or the products you have contracted or continue to contract in the last year.

For these purposes, we will only be able to consult information from companies that provide information on solvency, delinquency, and, in general, risk indicators, if you have previously given us your consent.

Through the two (2) previous treatments, we pursue the legitimate interest of offering you the products and services that best suit your personal characteristics, as well as better conditions on products or services that you have contracted, or that you may contract in the future.

You may request to oppose any of the previous treatments based on legitimate interest and, where appropriate, exercise your right not to be subject to a decision based solely on automated processing. To do so, you must contact the Data Protection Officer/Privacy Office and explain why you object.

• Processing carried out to comply with a legal obligation.

We will process your data to comply with applicable legal and tax obligations, such as the prevention of money laundering and terrorist financing. This processing will continue even after the contractual relationship ends, if necessary.

How do we obtain your data? We must bear in mind that data that does not identify a natural or legal person will not be processed. We obtain your data through the following means:

• The information you provide us when you contract and maintain products and/or services with us, both directly and indirectly. Some examples are: through inquiries, transactions, operations, or contract requests.
• External sources of information, such as official newspapers and bulletins, public registries, public sources, resolutions of public administrations, official lists for fraud prevention, social networks and the Internet, as well as third-party companies to which you have given your consent to transfer your data to entities.
  In particular, the data we will process includes the following categories: identifying data, data relating to your personal characteristics and social circumstances, academic and professional data, commercial information.

Consent must be free, informed, specific, and unequivocal.

PURPOSES OF PROCESSING

Information about data processing for sending communications:

The legal basis for the aforementioned processing is the express consent granted by the data subject. For each of the communications received, you may opt out of receiving such communications using the mechanism enabled for this purpose. The data retention criteria will be based on your statement that you oppose the processing. In any case, you may exercise your rights of access, rectification, objection, erasure, portability, and restriction of processing, as well as any questions regarding the processing of your personal data, by emailing dpo@blue-hua.com.

To contact the Data Protection Officer, you may contact dpo@blue-hua.com. Data subjects may also file a complaint, in the event of dissatisfaction with the exercise of their rights, with the Spanish Data Protection Agency, through its electronic headquarters using the electronic complaint filing procedure.

How long will we retain the User's personal data?

Generally, the personal data provided will be retained for the time necessary to respond to the User's request or as long as its deletion is not requested by the Spanish Data Protection Agency. User.

What is the legitimacy for processing the User's personal data?

The legal basis for processing data is the legitimacy of the User's consent.

To which recipients will the User's personal data be communicated?

In those cases in which the User requests service proposals through the website.

Likewise, the data may be transferred to administrations and public bodies for the fulfillment of obligations directly enforceable by DPay.

What are the User's rights when they provide us with their personal data?

The User has the right to obtain confirmation as to whether DPay processes personal data that concerns them, as well as to access their personal data, request the rectification of inaccurate data, or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, the User may request the restriction of the processing of their data, in which case it will only be retained for the exercise or defense of legal claims.

In certain circumstances and for reasons related to their particular situation, the User may object to the processing of their data. DPay will cease processing the data, except for compelling legitimate reasons, or the exercise or defense of possible legal claims.

The User may exercise the right to data portability in a structured, commonly used, and machine-readable format, and to transmit it. to another data controller. Such action may entail a reasonable fee to be paid by the User, based on the administrative costs incurred in fulfilling the request, in accordance with the regulations.

The User may raise any questions they consider relevant in relation to this Policy and exercise their rights under the terms established by law. To do so, they must send a letter by post to: DPay Payment AND FINANCE, Calle Leganitos 47, 9th floor, 28013 Madrid, Spain, or by email to: dpo@blue-hua.com, indicating the corresponding request and accompanied by a copy of their ID or other document proving their identity.

If they do not obtain satisfaction in the exercise of their rights, they may file a complaint with the Spanish Data Protection Agency through its electronic office, filing a claim for the protection of their rights.