In accordance with current data protection legislation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (hereinafter, LOPD-GDD), users are informed as set out in Article 13 of the GDPR and Article 11 of the LOPD-GDD:

1. DATA CONTROLLER

Who is the controller of your data?

• Company name: R&F LEGANÉS, S.L
• Tax ID (CIF): B88218615
• Address: ANTONIO LÓPEZ 18-A, 28224 POZUELO DE ALARCÓN
• Email: MARKETING@TWISTERROCK.ES

1. PURPOSE

For what purpose will we process your personal data?

R&F LEGANÉS, S.L processes your information in order to:

1. Maintain the business relationship and provide the contracted service.

1. Prepare a quote tailored to your needs.

1. Manage email communications with interested parties.

1. Carry out the company’s recruitment processes.

1. Manage the company’s employees and human resources.

1. Send commercial information related to our sector: RESTAURANT

1. Monitor the security of the premises (CCTV).

How long will we keep your data?

The personal data you provide will be kept for as long as the business relationship remains in force. However, in the interests of full transparency, the general periods we work with are:

• Generic identification data (email, first name, surname, telephone, etc.): for the duration of the business relationship or until consent is withdrawn. In any case, they will be deleted when they are no longer going to be used for the purpose for which they were collected.

• Accounting, tax and employment: six (6) years.

• Employment: ten (10) years.

• Recruitment processes: two (2) years from submission of the CV

• CCTV: thirty (30) days, except recordings of an offence and/or crime.

• Likewise, since commercial information is sent, even if the relationship between the parties ends, R&F LEGANÉS, S.L will continue to keep your information in order to send newsletters related to our products and services^[1]. You may always exercise the rights granted to you by current legislation by contacting us through whichever channel is most convenient for you.

Despite these general periods, we inform you that we will periodically review our systems in order to delete any data that is not legally required.

• LEGAL BASIS

What is the legal basis for processing your data?

Depending on the purposes for which your data is collected, processing is necessary for:

1. Managing the business relationship you have entered into and contracted with us.
   1. Performance of a contract (Article 6.1.b GDPR)
   2. Consent of the data subject (Article 6.1.a GDPR)

1. Prepare a quote tailored to your needs.
   1. Performance of a contract and/or pre-contractual relationship (Article 6.1.b GDPR)

1. Manage email communications with interested parties.
   1. Consent of the data subject (Article 6.1.a GDPR)
   2. Legitimate interest (Article 6.1.f GDPR)

1. Carry out the company’s recruitment processes.
   1. Consent of the data subject (Article 6.1.a GDPR)

1. Management of the company’s internal employees and human resources
   1. Performance of a contract (Article 6.1.b GDPR)

1. Sending commercial communications
   1. Consent of the data subject (Article 6.1 GDPR)
   2. Consent of the data subject (Article 20 LSSICE)
   3. Legitimate interest (Article 6.1.f GDPR)

1. Monitoring the security of the premises (CCTV)
   1. Legitimate interest (Article 6.1.f GDPR)

All the data collected is necessary to provide the service. Data marked with an asterisk (*) is mandatory. If mandatory data is not provided, R&F LEGANÉS, S.L will not be able to provide the contracted service.

1. RIGHTS OF DATA SUBJECTS

What rights do I have regarding data protection?

In accordance with Article 13 GDPR and Article 11.2.c) LOPDGDD, you may exercise any of the following rights by writing to the postal address ANTONIO LÓPEZ 18-A, 28224 POZUELO DE ALARCÓN or the email address MARKETING@TWISTERROCK.ES In any case, under current legislation you have the following rights, as set out in Articles 15 to 22 GDPR and 12 to 18 LOPDGDD:

• The right to request access to your personal data.

• The right to request rectification or erasure.

• The right to request restriction of processing.

• The right to object to processing.

• The right to data portability.

You may request the forms to exercise your rights from the Controller at the email address given in the controller’s details. You may also file a complaint with the Spanish Data Protection Agency (AEPD). More information in Section VII of this document.

1. RECIPIENTS

To which recipients will your data be disclosed?

You will always be informed and, where appropriate, your express consent will be requested before your personal data is transferred or international transfers are made in accordance with current legislation (Articles 13.1.e) and 44 GDPR, and Articles 11.1 and 40 LOPDGDD 3/2018). We therefore inform you that the third parties the Controller works with have their servers located within the EU, EEA or Switzerland, with adequate security measures to guarantee appropriate and confidential data processing.

Apart from the cases mentioned above and except where required by law, your data will not be transferred or disclosed to any third party, except in cases provided for by law or where strictly necessary to provide a service. In general, data may be disclosed to:

• Technology service providers.
• Payment service providers.
• Courier and parcel companies.
• Third parties or intermediaries acting as service providers on our behalf (accountants, advisers, freelance collaborators…).
• Your data is processed by the companies operating under the Twister Rock brand for the sole purpose of providing our services. Apart from these cases, it will only be disclosed where required by law or to third-party processors responsible for any of our services.

Data transfers will take place under the strictest confidentiality, using the necessary measures, such as signing confidentiality agreements or adhering to the privacy policies set out on their respective websites. Users may object to the transfer of their data to Processors by written request through any of the channels mentioned above. The controller will not transfer or disclose your data to any third party, except in cases provided for by law or where providing a service requires a contractual relationship with a Processor. Users therefore accept that some of the personal data collected may be provided to these Processors (payment platforms, accountants, intermediaries, etc.) where necessary to effectively provide a contracted service or purchased product. Users also accept that, where services are provided, these may be wholly or partly subcontracted to other persons or companies, who will be considered Processors and with whom the corresponding confidentiality agreement has been signed, or whose privacy policies, set out on their respective websites, have been adhered to. Users may object to the transfer of their data to Processors by written request through any of the channels mentioned above.

1. SOURCE OF YOUR DATA

How did we obtain your data?

The personal data used by R&F LEGANÉS, S.L comes from the data subject, in compliance with Articles 13 GDPR and 11 LOPDGDD mentioned above, or from group or partner companies, about which you can obtain more information by writing to MARKETING@TWISTERROCK.ES or at the Controller’s office at the postal address given in this document.

What categories of data do we handle?

The categories of personal data processed are:

Identification data

Name

Surname

National ID / foreigner ID / passport or equivalent document

Postal addresses

Email addresses

Sex

Date of birth

Place of birth

Contact telephone (mobile / landline)

Commercial information

Financial data

Bank account number

Credit card number

Curriculum vitae

Academic data

Qualifications

Hobbies

Membership of associations or clubs

CCTV

Image

Sensitive data will be processed in accordance with Articles 9 GDPR and 9 LOPDGDD, and the data subject will always be informed of which data will be used by the controller.

• SUPERVISORY AUTHORITY

At R&F LEGANÉS, S.L we make every effort to comply with data protection legislation, as it is our most valuable asset. However, if you believe your rights have been infringed, you may file a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6. 28001 Madrid. More information about the AEPD: http://www.agpd.es/ . Documentation prepared by LegalDPO. https://legaldpo.es/