Privacy Policy

In compliance with Regulation (EU) 2016/679, of the European Parliament and of the Council of 27 April 2016 (hereinafter RGPD), Catalana de Tractament d’Olis Residuals, S.A. (hereinafter CATOR) discloses the present Policy regarding the processing and protection of personal data.

Data of the person in charge of the treatment

Catalana de Tractament d’Olis Residuals, S.A.

TAX ID: A-60337854

Registered office: Ctra. Reus a Montblanc C-14z, Km 19,3 43460 Alcover (Tarragona)

E-mail: info@cator-sa.com

Scope of application

This Policy shall apply:

To those who visit CATOR’s website, www.cator-sa.com (hereinafter, any reference to it shall also include the Catalan, English and Spanish versions).
To those who voluntarily communicate with CATOR via e-mail or who fill out any of the data collection forms published on CATOR’s website.
To those who request information about CATOR’s products and services or who request to participate in any of CATOR’s commercial actions.
To those who formalize a contractual relationship with CATOR by contracting its products and services.
To those who use any other service present on the website that involves the communication of data to CATOR or access to data by CATOR for the provision of its services.
To any others who, directly or indirectly, have given their express consent for their data to be processed by CATOR for any of the purposes set out in this Policy.

The use of CATOR products and services requires the express acceptance of this Policy.

CATOR warns that, except for the existence of a legally constituted representation, no user and/or customer may use the identity of another person and communicate their personal data, so the data provided to CATOR must be personal data, corresponding to their own identity, adequate, relevant, current, accurate and true. In this sense, the user and/or customer shall be solely liable for any direct or indirect damage caused to third parties or CATOR by the use of data of another person or their own data when they are false, erroneous, not current, inadequate or irrelevant. Likewise, the user and/or customer who communicates the personal data of a third party shall be responsible for having obtained the corresponding authorization from the interested party, as well as for the consequences if this is not the case.

Likewise, the user and/or customer who communicates personal data to CATOR declares to be of legal age, in accordance with the provisions of Spanish law, refraining otherwise from providing data to CATOR. Any data provided about a minor will require the consent or prior authorization of their parents, guardians or legal representatives, who will be considered responsible for the data provided by the minors in their care.

This Policy will be of subsidiary application with respect to those other conditions on personal data protection that are established with special character and are communicated, without limitation, through the registration forms, contracts and/or conditions of the particular services, being therefore this Policy complementary to those mentioned in what is not expressly foreseen in the same.

Purposes of the collection and processing of personal data

CATOR, in its capacity as data controller, informs users of the existence of several treatments and files in which personal data communicated to CATOR are collected and stored.

The purposes of such collection and processing of personal data are as follows:

In relation to the “cookies” that CATOR uses in the navigation through its web pages (www.cator-sa.com), they are stored in the user’s terminal equipment (computer or mobile device) and collect information when visiting these web pages, in order to improve the usability of the same, to know the browsing habits or needs of the users in order to adapt to them, as well as to obtain information for statistical purposes. In the case of those users who are already CATOR customers, the information collected with the cookies will also be used to identify them when accessing the different tools that CATOR makes available to them for the management of the services. In any case, users can configure their browser to disable or block the reception of all or some of the cookies. The fact of not wishing to receive these cookies does not constitute an impediment to accessing the information on CATOR websites, although the use of some services may be limited. If, once you have given your consent to receive cookies, you wish to withdraw it, you must delete those stored in the user’s computer, through the options of the different browsers.
All the information about the cookies used by CATOR is published in its Cookies Policy, available for consultation at http://cator-sa.com/politica-de-cookies.
In the case of sending an e-mail to CATOR or communicating personal data through any other means, such as a contact form, the purpose of the collection and processing of such data by CATOR is to answer queries and requests for information about CATOR’s products and services.
In the case of sending an e-mail to CATOR related to its job offers, such data will be processed in order to participate in personnel selection procedures.
In the case of CATOR forms that the interested parties fill in to participate in any of CATOR’s commercial actions, the purpose will be to enable such participation, as well as the sending of commercial and advertising communications about CATOR’s services, unless the interested party expressly states its opposition at the same time of the collection of its data. Notwithstanding the above, the interested party may modify his or her decision at any time, as many times as he or she wishes, through the means provided by CATOR for this purpose.
When contracting the services offered by CATOR, only those personal data will be collected that are necessary to establish the contractual relationship and enable the provision of services and remuneration thereof by customers, such data being collected and processed for the following purposes:
The main purpose will consist of maintaining the contractual relationship established with the customer, in accordance with the nature and characteristics of the contracted services, contacting CATOR with the customer through the e-mail address, telephone or other means indicated by the latter.
For the sending of documentation and information related to the contracted services, as well as for the sending of commercial and advertising communications about the same or other similar services by CATOR, by post, e-mail, telephone, SMS or other means indicated by the customer, unless the customer expressly states his/her opposition at the time of contracting. Regardless of whether or not the customer has chosen to receive commercial information from CATOR, the customer may modify his/her decision at any time, as many times as he/she wishes, through the specific section available for this purpose in his/her Customer Area.
For the maintenance of historical records of commercial relations during the legally established periods.
In those cases in which CATOR must access and/or process personal data in respect of which the customer has the status of data controller or data processor, CATOR will process such data as data processor in accordance with the provisions of Article 28 of the GDPR and as indicated in the section entitled “CATOR as data processor”, included in this Policy.
For all other purposes expressly stated in the Specific Conditions applicable to the corresponding product or service contracted by the customer and expressly accepted by the customer.

Time period for the conservation of personal data

CATOR will keep the personal data for the time strictly necessary for the fulfillment of the purposes detailed above. CATOR may keep such data duly blocked during the period in which liabilities may arise from its relationship with the customer.

In the case of data subject to conservation in accordance with Law 25/2007, of October 18, 2007, on the conservation of data relating to electronic communications and public communications networks, the conservation period will be as detailed in the aforementioned regulations.

Recipients of personal data

The recipients of the personal data collected by CATOR will be the following:

CATOR’s own employees in the performance of their duties.
CATOR’s suppliers involved in the provision of the services, in the event that this is necessary for the provision of the services.
Companies belonging to the Group of Companies of which CATOR forms part, understood in the sense of article 42 of the Commercial Code, whose activity is the commercialization of services of an identical or analogous nature offered by CATOR, such as waste collection, management or treatment services.
Judicial or administrative bodies, as well as the State Security Forces and Corps, in the event that CATOR is required under current legislation to provide information related to its customers and services.
Any others that due to the nature of the service must access the data provided with the same, as detailed in the Specific Conditions that are applicable to the corresponding product or service contracted by the customer and expressly accepted by the customer.

User rights and the exercise of these rights

Users may exercise at any time the following rights recognized by the RGPD:

Right of access. Users have the right to obtain from CATOR information about whether personal data concerning them are being processed, to access them and to obtain information about the processing carried out.
Right to obtain a copy of your personal data.
Right of rectification. Users have the right to have CATOR rectify their personal data if it is inaccurate or incomplete.
Right of deletion. Users have the right to proceed to the deletion of data when they are no longer necessary for the purpose for which they were provided or when the other circumstances provided by law.
Right to limitation of processing. Users have the right to request a limitation in the processing of their personal data, so that the processing operations that should correspond in each case are not applied to them, in those cases provided for in art. 18 of the RGPD.
Right to portability. Users have the right to receive personal data concerning them in a structured format, provided that such data pertain exclusively to the user and have been provided by the user.

Users, whether they are CATOR customers or not, may exercise these rights by sending a communication by e-mail to the following address info@CATOR-sa.com or by sending a request accompanied by your ID card or valid document proving your identity, addressed to CATOR, S.A. C/ Puig i Cadafalch 17, 08191 Rubí (Barcelona) Spain, to the attention of the Commercial Department, specifying the right you wish to exercise.

In cases of manifestly unfounded or excessive requests due to their repetitive nature, CATOR reserves the right to charge a fee for the administrative costs involved or the right to refuse to act on them, in accordance with the provisions of art. 12.5 RGPD.

Supervisory authority

Users and/or customers may contact the appropriate local supervisory authority if they consider that the processing of their personal data has not been carried out in accordance with the legislation in force.

The data protection supervisory authority in Spain is the Spanish Data Protection Agency, whose contact details are available on its website, specifically at. http://www.agpd.es/portalwebAGPD/CanalDelCiudadano/contacteciudadano/index-ides-idphp.php.

International data transfers

In those CATOR products and services in which international transfers are required to enable the provision of such products and services, such circumstance shall be included in the Specific Conditions applicable to the corresponding product or service contracted by the customer and expressly accepted by the customer prior to such transfers.

CATOR as data processor

Pursuant to article 28 RGPD and concordant, CATOR will process the personal data for which the customer will be responsible or in charge of the processing, when it is necessary for the proper provision of the contracted services. In this case, CATOR will act as data processor, in accordance with the terms indicated below:

CATOR will only process the data in accordance with the instructions of the customer responsible or in charge of the processing, not using them for a purpose other than that stated in this Data Protection Policy and/or in the applicable contractual conditions.
Once the services that motivate the processing of personal data have been provided, they will be destroyed, as well as any support or documents containing any personal data or any type of information that has been generated during, for and/or due to the provision of the services that are the object of the corresponding Conditions. Notwithstanding the foregoing, CATOR may keep the aforementioned data duly blocked during the period in which liabilities may arise from its relationship with the customer.
In the event that CATOR uses the data for another purpose or communicates or uses them in breach of this Data Protection Policy and/or the corresponding Terms of Service, CATOR will also be considered responsible for the processing.
CATOR undertakes, in accordance with Article 28 of the RGPD, to maintain due professional secrecy with respect to the personal data to which it must access and/or process in order to comply in each case with the object of the Terms of Service applicable to it, both during and after the termination thereof, undertaking to use such information only for the purpose intended in each case and to require the same level of commitment from any person within its organization involved in any phase of the processing of personal data for which the customer is responsible.
In accordance with the provisions of the RGPD, the following rules shall apply in relation to the form and modalities of access to data for the provision of services:

In the event that CATOR must access the processing resources located on the customer’s premises, the customer shall be responsible for establishing and implementing the security policy and measures, as well as for communicating them to CATOR, which undertakes to respect them and to require compliance with them by the persons in its organization involved in the provision of the services.

When CATOR remotely accesses the customer’s data processing resources, the customer shall establish and implement the policy and security measures in its remote processing systems, being CATOR responsible for establishing and implementing the policy and security measures in its own local systems.

When the service is provided by CATOR on its own premises, CATOR will record in its Register of Activities the circumstances relating to the processing of data in the terms required by the RGPD, including the security measures corresponding to such processing.

The customer authorizes CATOR, in its capacity as data processor, to subcontract with third parties, in the name and on behalf of the customer, the services of storage, custody of backup copies of data and security, and those that were necessary to enable the provision of contracted services, respecting in any case the obligations imposed by the RGPD and its implementing regulations. At any time, the customer may contact CATOR to know the identity of the subcontracted entities for the provision of the services indicated, which will act in accordance with the terms provided in this document and after formalization with CATOR of a data processing contract in accordance with art. 28.4 of the RGPD.
The customer authorizes CATOR to perform the actions listed below, provided that they are necessary for the execution of the provision of the services. Such authorization is limited to the action(s) necessary for the provision of each service and with a maximum duration linked to the term of the applicable Contractual Conditions:

To carry out the processing of personal data on portable devices only by users or user profiles assigned to the provision of services.

To carry out the processing outside the customer’s or CATOR’s premises, only by the users or user profiles assigned to the provision of the services.

The entry and exit of media and documents containing personal data, including those included in and/or attached to an e-mail, outside the premises under the control of the customer responsible for the processing.

The execution of data recovery procedures that CATOR is obliged to carry out.

CATOR is not responsible for the non-compliance of the obligations derived from the RGPD or the corresponding regulations on data protection by the user and/or customer in relation to their activity and which is related to the execution of the contract or commercial relations that bind them to CATOR. Each party shall be liable for the liability arising from its own failure to comply with its contractual obligations and its own regulations.