Last updated: 24 January 2023
WHO IS THE DATA CONTROLLER FOR THE PROCESSING OF YOUR DATA?
The Data Controller for the processing of the personal data of the supplier is the contracting company “MANGO” or the “Company” (subsidiary of Mango MNG Holding), with whom it has signed a professional or commercial contract (the “Contract”). The identification data and the postal address to contact the organisation are set out in the Contract. You can also contact the organisation at the following e-mail address: eqp.creditors.data@mango.com.
The Data Subject is also informed that MANGO has appointed a Data Protection Officer to deal with any issue relating to the processing of their personal data. The Data Subject may contact the Data Protection Officer via the following contact details:
• e-mail address: dpo@mango.com.
• Postal address: Oficina DPO, carrer dels Mercaders 9-11 (Polígono Industrial Riera Caldes), 08184 Palau- solità i Plegamans (Barcelona, Spain).
WHAT TYPE OF PERSONAL INFORMATION DOES MANGO COLLECT?
The categories of personal data that MANGO may process about its suppliers (hereinafter, the “Data Subject”) are as follows:
i) Identification and contact data (for example, name, surname(s), telephone number, professional postal address, e-mail address, data relating to duties or position occupied, etc.).
ii) Financial data (for example, financial information about the Data Subject to prove its solvency).
All the aforementioned data have been obtained through the corresponding forms or through the presentation of a commercial offer or draft contract, or directly from the Data Subject providing us their identification and other data required to formalise the contractual relationship. It is the sole obligation of the Data Subject to provide us their updated information in the event of modification.
MANGO may also obtain data relating to the Data Subjects indirectly through an employer or external information sources.
FOR WHAT PURPOSE AND UNDER WHAT LAWFUL BASIS DO WE PROCESS YOUR PERSONAL DATA?
The Company will process the personal details necessary for the formalisation, execution, fulfilment, monitoring and supervision of the commercial or professional relationship, consequently the lawful basis for processing of your personal data is the execution of a contract, except where it is deemed that the Data Controller has legitimate interest that prevails over the interests, rights and/or basic freedoms of the Data Subject to process the data of the supplier, or where the processing is carried out in fulfilment of a legal obligation. In cases where the lawful basis is not the execution of a contract, this will be specifically indicated.
In this regard, the Company may process your personal data:
• To perform the administrative, commercial, tax and/or accounting procedures required for the execution of the contractual relationship.
• To evaluate any risks that may be derived from the services to be provided by the Data Subject.
• To respond to the exercise of privacy rights, in addition to queries and potential complaints on the part of the Data Subject.
o The lawful basis for the processing of your data is the fulfilment of a legal obligation, in accordance with the obligation contained in the General Data Protection Regulation.
• To extend and/or improve the quality of the services requested by MANGO in the execution of the commercial relationship.
• To conduct statistical studies that make it possible to design improvements to the requested services.
o Having considered your interests as an affected data subject, and those of MANGO as Data Controller, we consider that the Company has a legitimate interest to process the data in order to improve its procedures.
• To conduct audits.
o In cases where audits are conducted in compliance with the legislation, the lawful basis for processing your data is the fulfilment of a legal obligation in accordance with the legislation applicable to the area of compliance being audited.
o In cases where data is processed to conduct audits on the security of the IT systems of the Company, having considered your interests as an affected data subject, and those of MANGO as Data Controller, we consider that the Company has a legitimate interest to conduct audits for security purposes.
• To provide training and awareness sessions in relation to the services to be provided to MANGO.
• Sending of notifications that may be derived from the contractual relationship with the Data Subject.
• To maintain relationships of any nature with the legal person for which the Data Subject provides their services.
o Having considered your interests as an affected data subject, and those of MANGO as Data Controller, we consider that MANGO and the employer company have a legitimate interest to share information about their collaborators and employees, respectively, related to the service.
• Control of access and improper use of IT systems.
o Having considered your interests as an affected data subject, and those of MANGO as Data Controller, we consider that the Company has a legitimate interest to guarantee the security of the information stored on its systems, to which suppliers have access as a result of their work.
• Coordination of company activities.
o The lawful basis for the processing of your data is the fulfilment of a legal obligation, in accordance with the obligation contained in the Health and Safety at Work legislation.
o In cases where this aspect is not regulated by a legal provision, having considered your interests as an affected data subject, and those of MANGO as Data Controller, we consider that the Company has a legitimate interest to have health and safety control measures when another company provides services at our facilities.
HOW LONG DO WE KEEP PERSONAL DATA?
In order to guarantee that the personal data are appropriate, pertinent and limited to what is necessary for the purposes for which they are processed, MANGO will keep your personal data only for a period that is reasonably necessary to fulfil the purpose for which they were collected, given the requirements to respond to issues that are raised or to resolve problems, make improvements, and fulfil the requirements of the applicable legislation. This means that MANGO may conserve the personal data for a reasonable period of time, including after termination of the contractual relationship with the Data Subject. After this period, the personal data of the Data Subject will be blocked on all MANGO systems for the sole purpose of complying with legal obligations, or to attend to potential administrative or judicial responsibilities and the exercise of defence of claims. Once the blocking period for personal data has passed, they will be permanently deleted.
TO WHICH ADDRESSEES CAN WE COMMUNICATE THE PERSONAL DATA?
The Data Subject's personal data can be communicated to the following addressees:
• Data processing companies.
• Third-parties necessary for the execution of the Contract.
• Public Administrations and Bodies, including customs agents, whenever so required in the tax or any other applicable legislation.
• MANGO group companies, for internal administrative processes.
INTERNATIONAL TRANSFERS OF PERSONAL DATA
International data transfers may occur in cases where the destination companies are located outside the European Economic Area. These are lawful, since appropriate guarantees to protect your personal data have been established. In cases where the destination country is not covered by an adequacy decision, the relation with the third-party destination country shall be regulated by the Standard Contractual Clauses adapted by the European Commission, whose contents may be consulted via the following link https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. RIGHTS: In all cases, third parties sharing certain personal data will have previously accredited the adoption of suitable technical and organisational measures for the correct protection of the same.
WHAT ARE THE PRIVACY RIGHTS IN RELATION TO THE PERSONAL DATA?
The following privacy rights apply, which may be exercised via the e-mail address: eqp.creditors.data@mango.com
WHAT ARE THE PRIVACY RIGHTS IN RELATION TO THE PERSONAL DATA?
The following privacy rights apply, which may be exercised via the e-mail address: eqp.creditors.data@mango.com
Right of access:
You have the right to obtain confirmation whether we at MANGO are processing personal data that concern you, or otherwise, and to access the personal data MANGO possesses about you.
Right to rectification:
You have the right to request that MANGO rectifies personal data when they are incorrect or for them to be completed when they are incomplete.
Right of erasure:
You can request that your personal data is erased when, among other reasons, the data is no longer necessary for the purposes for which they were collected.
Right to restrict processing:
You have the right to request the restriction of the processing of your data, in which case we will only keep them for the exercise or defence of legal claims.
Right to data portability:
You have the right to receive personal data in a structured, commonly used and machine readable format, and to transmit them to another controller when the treatment is based on consent or a contract, and is transmitted electronically.
Right to object:
You can object to the processing of your personal details based on the public or legitimate interest pursued by MANGO, including the profiling of data. In this case, MANGO will stop processing the data, except for compelling legal grounds or the exercise or defence of possible legal claims.
Automated individual decisions:
Wherever this applies, you have the right not to be subject to a decision based solely on automated processing, including data profiling, which has a legal or similarly significant effect on you. However, it will not be possible to exercise said right in cases where the decision (i) is necessary for the formalisation or execution of a contract between you and MANGO, (ii) is authorised by the law applicable to MANGO whenever it establishes the appropriate measures to safeguard your rights, freedoms and legitimate interests, or (iii) where it is based on your explicit consent.
Right to submit a complaint:
You have the right to lodge a complaint before the Spanish Data Protection Agency or the competent local Supervisory Authority.
To make the request, we may ask you to accredit your identity.
