ANNEX I. DATA PROCESSING AGREEMENT

spanishpropertytaxes is a SaaS (Software as a Service) developed by E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.). GLOCATOR transfers and stores your data on the service provider's systems located in Orihuela (Alicante).

Through this notice, E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.), with registered address at Calle Médico Temístocles Almagro, nº 18, local 2, C.P. 03300, Orihuela (Alicante), informs consumers and users of the Website https://spanishpropertytaxes.com/ of its personal data protection policy, so that users may freely and voluntarily decide whether to provide E-PC DOCTOR with the personal data required to provide services, quotes previously requested by any means, or to respond to inquiries…

E-PC DOCTOR reserves the right to modify this Privacy Policy to keep it aligned with current data protection legislation. In such cases, E-PC DOCTOR will announce the changes introduced on this Website with reasonable notice before they take effect.

Visiting this Website does not imply that the user is obliged to provide any information about themselves. Should the user provide any personal information, the data collected on this Website will be processed fairly and lawfully, at all times in accordance with the principles and rights set out in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and applicable Spanish data protection legislation.

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Article 11 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights, we inform you that the data you provide will become part of a processing system whose controller is GLOCATOR - E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.)

CONTROLLER'S DETAILS

Data Protection Officer contact details:

PROCESSING ACTIVITY: CLIENTS

PURPOSE OF PROCESSING: Accounting, tax and administrative client management

CATEGORY OF DATA: Identification data, personal characteristics, social circumstances, academic and professional data, commercial information, financial and economic data, transactions of goods

RETENTION: We will keep your data while the contractual relationship remains in force and afterwards, during the applicable liability period.

LEGAL BASIS FOR PROCESSING:

• Performance of the employment contract (Article 6.1.b GDPR)
• Legitimate interest (Art 6.1.f GDPR)

RECIPIENTS OF DISCLOSURES:

• Banking entities
• Payment provider STRIPE
• Tax Administration

DATA PROCESSORS: Tax/accounting advisory firm: RODRIGUEZ Y ASOCIADOS S.L.

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA: The data subject or their legal representative.

PURPOSE OF PROCESSING: Advertising and commercial prospecting

CATEGORY OF DATA: Contact details

RETENTION: For as long as your consent remains valid, i.e. until you withdraw your consent or request its deletion.

LEGAL BASIS FOR PROCESSING: Legitimate interest (Art 6.1.f GDPR)

RECIPIENTS OF DISCLOSURES: None planned

DATA PROCESSORS: Email hosting: GRUPO LOADING SYSTEMS, S.L.

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA: The data subject or their legal representative

PURPOSE OF PROCESSING: Regulatory compliance

CATEGORY OF DATA:

• Data relating to compliance with data protection (LOPD/GDPR) and e-commerce (LSSI) regulations (GDPR consents, data relating to the exercise of data subjects' rights,
• Questions, queries, complaints or claims about regulatory compliance…)

RETENTION: Legally required period

LEGAL BASIS FOR PROCESSING: Regulatory compliance (Art 6.1.c GDPR)

RECIPIENTS OF DISCLOSURES: None planned

DATA PROCESSORS: Labor/tax advisory firm: RODRIGUEZ Y ASOCIADOS S.L

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA: The data subject or their legal representative

PROCESSING ACTIVITY: Website management

PURPOSE OF PROCESSING: Providing access to content, applying measures aimed at website security…

CATEGORY OF DATA: Web user data (IP, log ID…)

RETENTION: 1 year

LEGAL BASIS FOR PROCESSING: Legitimate interest in managing the services offered through the Website. (Art 6.1.f GDPR)

RECIPIENTS OF DISCLOSURES: None planned

DATA PROCESSORS:

• Web hosting provider: GRUPO LOADING SYSTEMS, S. L.
• Email hosting: GRUPO LOADING SYSTEMS, S. L.

INTERNATIONAL TRANSFER: Elementor, a cookie provider based in Israel, under standard contractual clauses (see the international transfers section of Elementor's Privacy Policy here).

SOURCE OF DATA: The data subject or their legal representative, cookie providers (Elementor installs a necessary cookie).

PURPOSE OF PROCESSING:

• Providing a communication channel between the user and GLOCATOR
• Advertising, online marketing, commercial…

CATEGORY OF DATA: User data, identification and contact data.

RETENTION: For as long as your consent remains valid, i.e. until you withdraw your consent, request its deletion, or object to the processing.

LEGAL BASIS FOR PROCESSING:

• Legitimate interest (Art 6.1.f GDPR)
• Express consent (Art 6.1.a GDPR)

RECIPIENTS OF DISCLOSURES: None planned

DATA PROCESSORS:

• Web hosting provider: GRUPO LOADING SYSTEMS, S. L.
• Email hosting: GRUPO LOADING SYSTEMS, S. L.

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA: The data subject or their legal representative.

PURPOSE OF PROCESSING: Compliance with personal data protection (GDPR), e-commerce (LSSI) and cookie (LSSI) regulations, and consumer and user protection regulations (LGDDCU and related regulations).

CATEGORY OF DATA:

• Data relating to compliance with LOPD/GDPR, LSSI regulations (GDPR consents, data relating to the exercise of data subjects' rights…), LGDDCU and related regulations.
• Questions, queries, complaints or claims about regulatory compliance…

RETENTION: Legally required period to comply with legal obligations and the applicable liability period.

LEGAL BASIS FOR PROCESSING: Regulatory compliance (Art 6.1.c GDPR)

RECIPIENTS OF DISCLOSURES: Public administration bodies where legally required, judges and courts, parties involved in proceedings arising from regulatory compliance claims.

DATA PROCESSORS:

• Web hosting provider: GRUPO LOADING SYSTEMS, S. L.
• Email hosting: GRUPO LOADING SYSTEMS, S. L.
• Website and IT maintenance: EPC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.).
• Personal data protection regulatory compliance services: ADMINDATOS-GPS,S.L.

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA:

• The data subject or their legal representative, administrative bodies, other parties involved…
• In compliance with the obligation to inform data subjects at the time of data collection, pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Article 11 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights, we inform you that, pursuant to Article 28 of the General Data Protection Regulation of the EU (GDPR) 2016/679 of the European Parliament and of the Council of 27 April 2016, GLOCATOR - E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) processes, as data processor, the data of employees of GLOCATOR's client company, with the client company acting as data controller for the data of its employees

PROCESSING ACTIVITY: G LOCATOR APP

PURPOSE OF PROCESSING: GLocator management

CATEGORY OF DATA: Identification data, mobile device ID, contact details

RETENTION: The retention period is four years

LEGAL BASIS FOR PROCESSING:

• Performance of the employment contract (Article 6.1.b GDPR)
• Satisfaction of legitimate interests pursued by the data controller (Article 6.1.f GDPR)

RECIPIENTS OF DISCLOSURES: Your data may be disclosed to public administration bodies with jurisdiction over the matter for regulatory compliance purposes, the Labour and Social Security Inspectorate, judges and courts, Social Security bodies, and other public administration bodies.

SUB-PROCESSORS: None planned

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA:

• From the data subject
• Data obtained from the G-LOCATOR application

PURPOSE OF PROCESSING: Profiles are created through location analysis (geolocation). No decisions are made based solely on automated processing of data.

CATEGORY OF DATA: Geolocation data (latitude, longitude…)

RETENTION: The retention period is 2 months

LEGAL BASIS FOR PROCESSING: Satisfaction of legitimate interests pursued by the data controller (Article 6.1.f GDPR)

RECIPIENTS OF DISCLOSURES: Your data may be disclosed to public administration bodies with jurisdiction over the matter for regulatory compliance purposes, the Labour and Social Security Inspectorate, judges and courts, Social Security bodies, and other public administration bodies.

DATA PROCESSORS: None planned

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA:

• From the data subject
• Data obtained from the spanishpropertytaxes.com application

PURPOSE OF PROCESSING:

• Regulatory compliance (labour, data protection regulations…)
• Document custody

CATEGORY OF DATA: Data necessary for compliance with certain regulations (personal data protection, labour regulations: compliance with Article 10 of Royal Decree-Law 8/2019 of 8 March amending the Workers' Statute, equality regulations…), always within the processing necessary for regulatory compliance (e.g. working-time record data, LOPD consents, exercise of data subjects' rights… If the Pro or Enterprise service is contracted, documents related to compliance with labour and Social Security regulations may be uploaded and downloaded (such as payslips, hiring/termination reports…), which involves processing identification data, personal characteristics, employment details, health data, and wage garnishment data…).

RETENTION: The retention period is four years

LEGAL BASIS FOR PROCESSING: Regulatory compliance (Art 6.1.c GDPR)

RECIPIENTS OF DISCLOSURES: Your data may be disclosed to public administration bodies with jurisdiction over the matter for regulatory compliance purposes, the Labour and Social Security Inspectorate, judges and courts, Social Security bodies, and other public administration bodies.

DATA PROCESSORS: Labour/tax advisory firm of the data controller

INTERNATIONAL TRANSFER: None planned

SOURCE OF DATA:

• From the data subject
• Data obtained from the spanishpropertytaxes.com application

spanishpropertytaxes.com - E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) does not process any data of minors either.

Should the user lack legal capacity, E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) warns that the informed consent of the holder of parental authority or guardianship, or of the user's legal representative, will be required for access to and use of E-PC DOCTOR's (GLOBAL PREVENCION y SALUD, S.L.) official website https://spanishpropertytaxes.com/ E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) is released from any liability that may arise from the use of its official website by minors or persons lacking legal capacity, such liability resting with their legal representatives in each case.

Special categories of data: It is not permitted to submit data containing information that is not relevant or necessary for the purposes of the website. In particular, it is strictly forbidden to send information (through the communication channels offered on the website, e.g. the contact form…, or the contact email protecciondedatos@epcdoctor.es, or any other email offered by E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) as contact to users of this website) containing special categories of data within the meaning of Article 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Article 9 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (data relating to political opinions, trade union membership, religious beliefs, philosophical convictions, racial or ethnic origin, health data, sex life, genetic data, biometric data, sexual orientation), or Article 10 GDPR and Article 10 LOPD 3/2018 relating to criminal offences, nor location data, financial data, or highly personal data, or any data exceeding the contact information necessary to request information or resolve queries about the products offered by E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.).

Profiling and automated decision-making: By accepting E-PC DOCTOR's privacy policy, you are consenting to profile analysis based on geolocation obtained from your mobile device's GPS.

Profiling and automated decision-making: By accepting E-PC DOCTOR's privacy policy, you are consenting to profile analysis based on geolocation obtained from your mobile device's GPS.

COOKIES: Regarding the information required in relation to informed consent for the use of cookies under the terms of Article 22.2 of Law 34/2002, on Information Society Services and Electronic Commerce (LSSI), in connection with Article 13 GDPR and Article 11 of LOPD 3/2018, this is set out in the Cookie Policy. GLOCATOR - E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) informs you that the cookies it installs https://spanishpropertytaxes.com/ are exempt from informed consent. Cookies used solely to enable communication between the user's device and the network, or those strictly providing a service expressly requested by the user, are exempt from the obligations set out in Article 22.2 of the LSSI. Necessary cookies are considered outside the scope of Article 22.2 of the LSSI, so it is not necessary to inform users of or obtain consent for their use ("Guide on the use of cookies" published in July 2020 by the AEPD and Opinion 4/2012 on the cookie consent exemption published by the WP29). https://spanishpropertytaxes.com/ they inform you that browsing the website will only install a necessary cookie related to the website's WordPress theme. This cookie allows the website owner, GLOCATOR - E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.), to implement or change the website's content in real time.

In accordance with Articles 7.3, 13, 14, 15 to 22 and 77 of REGULATION (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Articles 11, 12 to 18, 63, 94 and 95 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights, you may exercise the rights detailed below by sending a letter to the following address: E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.), address at Calle Médico Temístocles Almagro nº 18 lc 2, CP 03300, Orihuela (Alicante), in person at our offices proving your identity, or electronically proving your identity, at protecciondedatos@epcdoctor.es.

E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) informs the user that they have the following rights under applicable regulations:

• Right to be informed (Article 13 GDPR and Article 11 LOPD 3/2018): The data controller must inform the data subject, at the time the data is collected, of the controller's identity, the purpose of processing, the legal basis, retention periods, recipients, whether international transfers will take place, the existence and procedure for exercising the data subject's rights, and whether or not automated decisions, including profiling, are made.
• Right of access (Article 15 GDPR and Article 13 LOPD 3/2018): allows the data owner to obtain information about whether E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) is processing personal data concerning them and, if so, to obtain information about their personal data undergoing processing.
• Right to rectification (Article 16 GDPR and Article 14 LOPD 3/2018): allows you to correct errors and amend inaccurate or incomplete data.
• Right to erasure (Article 17 GDPR and Article 15 LOPD 3/2018): allows your data to be deleted and to stop being processed by E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.), unless there is a legal obligation to retain it and/or other legitimate grounds for processing prevail.
• Right to restriction of processing (Article 18 GDPR and Article 16 LOPD 3/2018): under the legally established conditions (a) the data subject contests the accuracy of the personal data, for a period allowing the controller to verify its accuracy; b) the processing is unlawful and the data subject opposes erasure and requests restriction of use instead; c) the controller no longer needs the personal data for processing purposes, but the data subject needs it for the establishment, exercise or defence of legal claims; d) the data subject has objected to processing under Article 21(1), pending verification of whether the controller's legitimate grounds override those of the data subject), this right allows processing to be halted, so that E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) does not process it further in future. When restriction is exercised by the data subject, E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) will only retain the data for the establishment or defence of claims.
• Right to data portability (Article 20 GDPR and Article 17 LOPD 3/2018): allows the data subject to receive their personal data and transmit it directly to another controller in a structured, commonly used, machine-readable format.
• Right to object (Article 21 GDPR and Article 18 LOPD 3/2018): in certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) will stop processing the data, unless there are compelling legitimate grounds, or for the establishment or defence of possible claims.
• Right not to be subject to automated decisions producing legal effects (Article 22 GDPR and Article 18 LOPD 3/2018):

You are informed that the processing of your data for the stated purposes will not involve E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) applying automated decisions producing legal effects for the data subject

• Right to withdraw your consent at any time (Article 7.3 GDPR), without affecting the lawfulness of processing based on consent prior to its withdrawal.
• Right to lodge a complaint with the supervisory authority (AEPD) (Article 77 GDPR and Article 63 LOPD 3/2018) if you consider that the processing does not comply with applicable regulations.

SENDING OF INFORMATIONAL COMMUNICATIONS

Regarding the sending of informational communications via email or other equivalent electronic communication means, since the user's email address is personal data when it allows them to be identified, by providing it in the online data form the user expressly authorizes E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) to send informational communications via email. However, you may revoke your consent to receive informational communications at any time (e.g. if, during registration or afterwards, you subscribed to a newsletter or other promotional material) by simply notifying our email address (protecciondedatos@epcdoctor.es) or calling 649 024 416.

E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) adopts appropriate technical and organizational measures to maintain the confidentiality of your personal data. We use several security procedures, taking into account industry standards, to try to protect the personal information you provide us and prevent unauthorized access. Our internal procedures include security measures for the storage and use of data by service providers acting as data processors.

Access to the digital platforms by website USERS https://glocator.es/ takes place in a secure environment. Users can verify they are within a secure environment by the «url» address shown in properties (by right-clicking with the mouse). That «url» address begins with «https», where the «s» indicates that content is being provided by a secure server.

Third-party websites and collection of third-party information:

• REDSYS SERVICIOS DE PROCESAMIENTO. SL, with registered address in Madrid, calle Francisco Sancha, número 12, and Tax ID number B-85955367. It is a Virtual POS that processes online payments. For more information you can consult its privacy policy by clicking here.
• Elementor: Elementor Ltd is an Israeli software company, the provider of the WordPress plugin used for visual page building. Elementor has access to the data you enter in the contact forms. For more information you can consult its privacy policy here. It installs necessary cookies.

E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) has subcontracted certain services in order to carry out its activity; accordingly, some external service providers with access to data have the status of data processors:

• E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) hosts its website in the cloud. The web hosting and email hosting provider - GRUPO LOADING SYSTEMS, S. L. — you may consult its privacy policy here if you wish. This service provider is based in a country within the EU or the European Economic Area.
• Company providing personal data protection regulatory compliance services: ADMINDATOS-GPS,S.L. (privacy policy here)
• Company providing personal data protection regulatory compliance services: ADMINDATOS-GPS,S.L. (privacy policy here)
• Labour, tax and accounting advisory firm: RODRIGUEZ Y ASOCIADOS ASESORES, S.L. (privacy policy here)

Data processing agreements are in place under the terms of Article 28 of the GDPR and Chapter II of Title V of LOPD 3/2018 (Article 33).

None planned

In compliance with the obligation to inform data subjects at the time of data collection, pursuant to Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Article 11 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights, we inform you of the existence of a personal data processing activity. DATA CONTROLLER: the CLIENT (the company that contracts the GLOCATOR SaaS in the context of the employment relationship with the employee). CATEGORIES OF DATA: Identification data, user and authentication data, personal mobile device ID, contact details, geolocation data (latitude, longitude…), data necessary for compliance with certain regulations (personal data protection, labour regulations: compliance with Article 10 of Royal Decree-Law 8/2019 of 8 March amending the Workers' Statute, equality regulations…), always within the processing necessary for regulatory compliance (e.g. working-time record data, LOPD consents, exercise of data subjects' rights… PURPOSE OF PROCESSING: GLocator management, labour control, regulatory compliance (labour, data protection regulations…). RETENTION PERIOD: For the duration of the contractual relationship and the applicable liability period. Geolocation data will be kept for a period of 2 months. PROFILING: Profiles are created through location analysis (geolocation). No decisions are made based solely on automated processing of data. LEGAL BASIS: Performance of a contract, legitimate interest and regulatory compliance. DATA PROCESSOR: E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.), GLocator API regulatory-compliance SaaS provider. RECIPIENTS OF DISCLOSURES: None planned. INTERNATIONAL TRANSFERS: None planned. SOURCE: the data subject themselves, data obtained from the GLOCATOR API. EXERCISE OF RIGHTS (of data subjects): You may exercise your rights of information, access, rectification, erasure, objection to processing, restriction of processing, data portability, not to be subject to a decision based solely on automated processing, including profiling, and to withdraw consent at any time by means of a letter, proving your identity, addressed to: the GLOCATOR client company, or electronically, proving your identity, at the email address of the GLOCATOR client company. You also have the right to lodge a complaint with the supervisory authority - the Spanish Data Protection Agency.

ANNEX II. DATA PROCESSING AGREEMENT

Pursuant to Article 13 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Article 11 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights, we inform you that the DATA CONTROLLER is E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.). Postal address: Calle Médico Temístocles Almagro nº 18 lc 2, CP 03300, Orihuela (Alicante). Email address: info@spanishpropertytaxes.com, Phone: 649 024 416, Tax ID: B54242870. PURPOSE OF PROCESSING: The development and performance of the contractual relationship-provision of SaaS services, regulatory compliance, and commercial prospecting.

Data will be kept for the duration of the contract and the period during which liability could be claimed. If you have given your consent to receive advertising, offers… by phone call, email, SMS, social media, postal mail…, we will keep your data until you withdraw your consent or exercise your right to object. No profiles are created. No decisions are made based solely on automated processing of data. LEGAL BASIS: Performance of a contract and compliance with legal obligations. RECIPIENTS OF DISCLOSURES: banking entities. EXERCISE OF RIGHTS to information, access, rectification, erasure, objection to processing, restriction of processing, data portability, not to be subject to a decision based solely on automated processing, including profiling, and to withdraw your consent at any time by means of a letter, proving your identity, addressed to E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) at the following address: Calle Médico Temístocles Almagro nº 18 lc 2, CP 03300, Orihuela (Alicante), or electronically, proving your identity, at protecciondatospersonales@epcdoctor.es. You also have the right to lodge a complaint with the supervisory authority - the Spanish Data Protection Agency.

In certain cases E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) has access to data of a data controller; for these purposes, the following clauses are valid as a data processing agreement. This agreement gives rise to access to data on behalf of a third party, not to a disclosure or communication of personal data, so that the data controller (the client) retains control over the uses and purposes of the processing.

The signatories to this agreement state that E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) will process personal data for which THE CLIENT is the controller, and therefore, in compliance with Article 28 and related provisions of the European Data Protection Regulation and Articles 28 to 33 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights, they agree to sign this

1. Purpose of the processing agreement

Through this data processing agreement, E-PC DOCTOR (GLOBAL PREVENCION y SALUD, S.L.) is authorized to process, on behalf of the client, the personal data necessary to provide the following service: GLOCATOR SaaS provider (working-time logging app, labour regulatory compliance, equality…).

The processing will consist of: provision of GLOCATOR platform SaaS services, maintenance, support, installation of updates… relating to the software covered by this agreement.

In performing its role vis-à-vis the controller, the processor may carry out the following actions:

Collection, Recording, Structuring, Modification, Storage, Extraction, Consultation, Disclosure by transmission, Interconnection, Comparison, Restriction, Erasure, Destruction, Retention, Communication, Publication.

2. Identification of the affected information

In order to perform the services arising from the purpose of this agreement, E-PC DOCTOR may, in the course of maintenance work, have access to the following processing activities:

• CLIENTS/POTENTIAL CLIENTS
• SUPPLIERS/COLLABORATORS
• FIRST AND LAST NAME
• ADDRESS
• EMAIL
• PHONE
• ID/NIE/TAX ID
• DATE OF BIRTH
• OTHER

Specifically, the following categories of data are processed:

• Contact details
• User data (IP, password IDs, log…)
• Identification data (first and last name, tax ID, phone, email, address, handwritten or electronic signature, image)
• Website visit data, cookies
• Analytics data
• Personal characteristics
• Transactions of goods and services
• Economic, financial and insurance data (banking data…)
• Employment details
• Commercial information
• Identification data
• Device ID
• Contact details
• Geolocation data (latitude, longitude…) of the clock-in
• Data necessary for compliance with certain regulations (personal data protection, labour regulations: compliance with Article 10 of Royal Decree-Law 8/2019 of 8 March amending the Workers' Statute, equality regulations…) always within the processing necessary for regulatory compliance (e.g. working-time record data, LOPD consents, exercise of data subjects' rights…

3. Duration

This agreement has a duration tied to the term of the contractual relationship. Once its term has ended, the processor must return to the controller the personal data and delete any copy in its possession.

4. Obligations of the data processor

The data processor and all its personnel undertake to:

• Use the personal data processed, or that it collects for inclusion, solely for the purpose of this agreement. Under no circumstances may it use the data for its own purposes.
• Process the data in accordance with the controller's instructions. If the processor considers that any instruction infringes the GDPR or any other EU or Member State data protection provision, it will immediately inform the controller.
• Keep, in writing, a record of all categories of processing activities carried out on behalf of the controller, containing:
• The name and contact details of the processor or processors and of each controller on whose behalf the processor acts and, where applicable, the representative of the controller or processor and the data protection officer.
• The categories of processing carried out on behalf of each controller.
• Where applicable, transfers of personal data to a third country or international organization, including identification of that third country or international organization and, in the case of the transfers referred to in the second subparagraph of Article 49(1) GDPR, documentation of suitable safeguards.
• A general description of the technical and organizational security measures relating to:
• The pseudonymization and encryption of personal data.
• The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
• A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
• Not disclose the data to third parties, unless expressly authorized by the controller, in legally permissible cases. The processor may disclose the data to other processors of the same controller, in accordance with the controller's instructions. In this case, the controller will identify, in advance and in writing, the entity to which the data must be disclosed, the data to be disclosed, and the security measures to be applied for the disclosure. If the processor must transfer personal data to a third country or international organization, under EU or Member State law applicable to it, it will inform the controller of that legal requirement in advance, unless such law prohibits this for important reasons of public interest.
• Possibility of subcontracting the processing agreement:
• The processor specifically undertakes not to subcontract any of the services covered by this agreement that involve the processing of personal data, except for the ancillary services necessary for the normal functioning of the processor's services.
• Should the processor need to subcontract any processing, this must be communicated in advance and in writing to the controller, with one month's notice, indicating the processing to be subcontracted and clearly and unambiguously identifying the subcontracting company and its contact details.
• In this case, subcontracting may only take place once the controller has authorized it in advance and in writing.
• The subcontractor, who will also have the status of processor, is likewise obliged to comply with the obligations set out in this document for the processor and the instructions issued by the controller.
• It shall be the obligation of the original processor to regulate the new relationship so that the new processor (sub-processor) is subject to the same conditions (instructions, obligations, security measures…) and the same formal requirements as itself, regarding the proper processing of personal data and the guarantee of the rights of affected persons. In the event of non-compliance by the sub-processor, the original processor shall remain fully liable to the controller for compliance with the obligations.
• Maintain the duty of secrecy regarding personal data to which it has had access under this agreement, even after its purpose has ended.
• Ensure that persons authorized to process personal data expressly and in writing commit to respecting confidentiality and complying with the corresponding security measures, of which they must be duly informed.
• Keep available to the controller documentation evidencing compliance with the obligation set out in the previous paragraph.
• Ensure the necessary personal data protection training for persons authorized to process personal data.
• Assist the controller in responding to the exercise of the rights of:
• Access, rectification, erasure and objection
• Restriction of processing
• Data portability
• Not to be subject to automated individual decisions (including profiling)
• The controller will address and resolve, within the applicable time and deadlines, requests to exercise the rights of access, rectification, erasure and objection, restriction of processing, data portability and not to be subject to individualized decisions; therefore, if the data subject exercises these rights before the processor, the processor is obliged to notify the controller by email at the address indicated by the controller immediately, and no later than the next business day following receipt of the request. In this communication, the processor must include all relevant information so that the controller can properly handle the data subject's request.
• Right to information

It is the controller's responsibility to provide the right to information at the time the data is collected.

• Notification of personal data breaches
• The processor will notify the controller, without undue delay, and in any case within a maximum of 48 hours from becoming aware of the incident, through a system that allows verification of receipt of the communication, of any personal data breaches under its charge of which it becomes aware, together with all relevant information for documenting and reporting the incident. Notification will not be necessary where it is unlikely that the security breach poses a risk to the rights and freedoms of natural persons.

If available, at least the following information will be provided:

• A description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects affected, and the categories and approximate number of personal data records affected.
• The name and contact details of the data protection officer or another contact point where more information can be obtained.
• A description of the likely consequences of the personal data breach.
• A description of the measures taken or proposed to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

If it is not possible to provide all the information at the same time, and to the extent that it is not, the information will be provided in phases without undue further delay.

• Support the controller in carrying out data protection impact assessments, where applicable.
• Support the controller in carrying out prior consultations with the supervisory authority, where applicable.
• Make available to the controller all information necessary to demonstrate compliance with its obligations, and to allow for and contribute to audits or inspections carried out by the controller or another auditor authorized by it.
• E-PC DOCTOR undertakes to adopt the technical and organizational measures appropriate to the level of protection of the data processed as established in the Regulation, in order to ensure the security of personal data and prevent its alteration, loss, unauthorized processing or access, taking into account the state of the art, the nature of the data stored and the risks to which they are exposed, whether arising from human action or from the physical or natural environment. It will implement security measures appropriate for a low risk level. When adopting the security measures the processor and controller consider appropriate, account must be taken of whether any of the circumstances described in Article 28.2 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data, likely to generate greater risks for data subjects' rights, are present.

In any case, mechanisms must be implemented to:

• Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• Restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
• Regularly test, assess and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
• Pseudonymize and encrypt personal data, where applicable.
• Appointment of a Data Protection Officer where any of the circumstances set out in Article 37 of the European Data Protection Regulation apply, in which case the processor must appoint a data protection officer and communicate their identity and contact details to the controller.
• Fate of the data once processing by the processor has ended: return to the controller the personal data and, where applicable, the media on which they are stored, once the service has been completed. The return must involve the complete deletion of existing data on the processor's IT equipment. However, the processor may keep a copy, with the data duly blocked, for as long as liability may arise from the performance of the service.

5. Obligations of the data processor

It is the controller's responsibility to:

• Provide the processor with the data referred to in clause 2 of this document.
• Carry out a data protection impact assessment of the processing operations to be performed by the processor.
• Carry out the applicable prior consultations.
• Ensure, both before and throughout the processing, the processor's compliance with the GDPR.
• Supervise the processing, including carrying out inspections and audits relevant to verifying such compliance.
• Compliance with data protection regulations with respect to the controller's employees: