Measures and Procedures for the Data Protection Law

In order to establish the functions attributed to each privacy role, BODEGAS BORDOY SL has defined them as described below:

• Delegate of Data Protection: will be responsible for coordinating the security measures defined in this manual of Measures and Procedures. This delegation, however, does not exempt from legal responsibility in terms of data security, which continues to fall on the person responsible for the data. Treatment.

Specific functions attributed:

• • Advise and inform BODEGAS BORDOY SL of the obligations incumbent upon it in matters of Privacy
  • Supervise the regulatory compliance of BODEGAS BORDOY SL in the processing of personal data
  • Supervise the implementation and application of BODEGAS BORDOY SL’s policies on data protection personal
  • Supervise the analysis of data processing operations personal
  • Supervise the analysis of the data categories covered by the Organization
  • Supervise the analysis of the risks that may arise from the treatment operations carried out by BODEGAS BORDOY SL
  • Provide advice to the Privacy Officer regarding the protection of data
  • To impart the training plan to the personnel of BODEGAS BORDOY SL that performs data processing
  • Intermediate between BODEGAS BORDOY SL and the Authority of Control
  • Perform the notifications required by the Authority of Control
  • Supervise the implementation of the Impact Assessment of data protection personal
  • Supervise the conduct of audits corresponding

• Responsible for Privacy or Security: will be the person designated by the Delegate of Data Protection or, failing this, by the BODEGAS BORDOY SL management to coordinate all the related aspects and defined in the present Measures and Procedures

Specific functions attributed:

• • Update the Manual of Measures and Procedures and its adaptation to current regulations
  • Implement the training plan on data protection for the employees
  • Adopt the necessary measures so that the personnel know the safety regulations that affect the performance of their functions and the consequences that may be incurred in case of breach
  • Adopt corrective measures as a consequence of the deficiencies detected in an audit process and approved by the entity
  • Maintain a list of authorized personnel to grant, cancel or alter access rights, in accordance with the criteria established
  • Maintain a staff relationship with authorized access to the place where the copies of security
  • Maintain a list of authorized personnel to access the premises where the systems are located. information
  • Establish communication protocols with the Data Protection Delegate on behalf of the employees
  • Adopt protocols for compliance with the measures of security
  • Perform protocols for the design of treatment flows of data
  • Report the consequences of non-compliance with the Measurement and Procedures

• Systems manager: will be responsible for managing or maintaining the operating environment of the data categories. These personnel were explicitly relate, since by their developed tasks can use management tools that allow access to data not required for their tasks, in the case of this role not been created within the entity, its obligations will fall on the Delegate of Protection of Data. These he relate in the Annexed D “ID Y authentication”.

Specific functions attributed:

• • It will be responsible for managing and maintaining the operating environment of the categories of data
  • Supervise the correct installation of the access software for the categories of data
  • Supervise the configuration of the organization’s computer system, with special attention to local network connections, as well as any other connection external
  • Establish mechanisms that prevent access to the system from any point, whether local or remote, unauthorized. Ensuring the implementation of as many security measures as those approved in this manual of Measures and Procedures
  • Maintain a list of authorized personnel with access to the system, noting the minimum requirements established in the Manual of Measures and Procedures
  • Implement all those necessary measures, foreseen in the Manual of Measures and Procedures, in what refers to tests with data real
  • Communicate to the Treatment Manager, or if applicable, the personnel to whom it has been delegated, all those changes that may be significant in the system’s environment computer

• Administrative managers of the treatment systems: they will be in charge of managing and coordinating compliance with technical and organizational measures, as well as any legal obligation arising from their treatment. In the case of not having created the present place of work, its obligations will fall on the Responsible of Privacy. These are listed in Annex D “Identification and authentication”.
• Users of the system: those who usually use the information system, both at the level of automated data and non-automated data, these are referred to in Annex D “Identification and authentication”.
• Employees without access to automated treatments: personnel who carry out tasks at BODEGAS BORDOY SL, but whose functions do not require access to the system computer

BODEGAS BORDOY SL will appoint a Data Protection Delegate, based on their professional qualities and specialized knowledge of the legislation and practices on data protection. In the absence of this position, its functions will be assumed by the Privacy or Security Manager or, failing that, by the legal representative of BODEGAS BORDOY SL.

In any case, the management of BODEGAS BORDOY SL will ensure and support that the Data Protection Delegate participates adequately and appropriately in all matters relating to the protection of personal data, providing both the resources necessary for the performance of these tasks, and the access to personal data and treatment operations, as well as to maintain their specialized knowledge.

Interested parties may contact the Data Protection Delegate to deal with all matters relating to the processing of data that corresponds to them and the exercise of the rights conferred by the current regulations on data protection.

Copies of the appointment of the Delegate for Data Protection are included in Annex A “Appointment of privacy roles”.

Certain of the functions attributed to the Data Protection Delegate may be delegated to other employees designated for that purpose, as long as the persons authorized to grant these delegations, as well as those authorized by them, are included in the Manual of Measures and Procedures. those that fall to that delegation. In no case this designation supposes a delegation of the responsibility that corresponds to the Responsible of Treatment.

Additionally, for those employees who develop roles different from those of the Data Protection Delegate and the Privacy Manager, BODEGAS BORDOY SL has issued an internal communication where the guidelines are established for the treatment by the staff of the data that can be treated as consequence of the development of their tasks within the company.

This release contains the main obligations regarding security of personal data, including the express prohibition of installing any type of application on computer equipment and the use of computer and non-computer resources for purposes other than strictly derived. of the development of their work activity, as well as the obligation to maintain the duty of confidentiality on all data processed in connection with the development of their job and not communicate this information to any person or entity without authorization relevant.

BODEGAS BORDOY SL has carried out an Impact Assessment and its respective risk map of its personal data processing procedures. Considering the results thereof, it has applied the appropriate technical and organizational measures to guarantee a level of security appropriate to the risk expressed in the Impact Assessment. These security measures consider, in particular, the following aspects:

• In particular, the risks presented by the data processing have been taken into account, in accordance with the treatments provided in Annex E “Register of treatment activities”, in particular as a consequence of the destruction, loss or accidental or unlawful alteration of personal data. transmitted, conserved or otherwise processed, or unauthorized communication or access to said data
• BODEGAS BORDOY SL has taken all necessary measures to ensure that anyone who acts under their authority and has access to personal data can only treat such data following the instructions provided in this document

In order to guarantee the adequate level of protection and required by current regulations on data protection, BODEGAS BORDOY SL will apply the following standards, procedures and standards related to the data security of BODEGAS BORDOY SL systems.

6.2.1 Access to data through communication networks

When in BODEGAS BORDOY SL there are Treatment Managers who have remote access to their information systems, these connections must allow the application of the same security measures, equivalent to a connection in a local area, measures described in these Measures and Procedures .

In Annex B “Access to Data through Communication Networks” all the Treatment Managers who have an authorized remote access to the information systems of BODEGAS BORDOY SL are listed.

6.2.2 Special categories of data

BODEGAS BORDOY SL does not deal with special categories of data through public networks or wireless electronic communications networks, which will not require the encryption of data in this regard. Likewise, at the time BODEGAS BORDOY SL treats personal data of a special nature, it will encrypt this data or use any other mechanism that guarantees that the information can not be understood or manipulated by third parties.

6.2.3 Regime of work outside the premises of location of the systems of treatment

In BODEGAS BORDOY SL there are no portable devices. In the event that portable devices are incorporated in BODEGAS BORDOY SL and that data processing is processed in their logical units, these treatments must be previously authorized by the Data Protection Delegate, and these will be related and authorized in the Annex H “Work Regime Outside the Location Locations of the treatment systems” and following the aforementioned policy continuation.

Employees of BODEGAS BORDOY SL that have a portable device assigned, will be informed of the prohibition, except authorized exceptions, of storing personal data in the logical units of the portable devices and of the obligation to work with personal data only. on the logical units defined in the local server. In addition, they will apply the security measures implemented in BODEGAS BORDOY SL, which are defined in the current security regulations.

It will be mandatory that in portable devices, the same established criteria for identification, authentication and access control are defined, defined in the security regulations, provided that they connect to the local network or access remotely.

In any case, the recording of special categories of data or of high level in the logical units of the portable devices will be allowed without their prior authorization.

6.2.4 Identification and authentication

The procedure followed in BODEGAS BORDOY SL for the identification and authentication of the users when they try to access the system, the network or the applications is based on the combination of a user identification code and a password that the computer system will collate in each attempt of access in order to verify that said access is authorized or not.

Each user has been assigned a unique and non-transferable identification for both access to the system and access to applications.

In BODEGAS BORDOY SL there is a policy of allocation, distribution and storage of users and passwords that guarantees their confidentiality and integrity, establishing in this policy also the periodicity in which the change of passwords will be required. This policy is found in Annex D “Identification and Authentication”.

6.2.5 Control of access

The users of BODEGAS BORDOY SL will receive their access rights following the policy of minimum privilege, assigning them a unique identification code. That is, they will only access those data and computing resources they need to carry out their functions.

The Privacy Manager or those employees that have been assigned this task, will determine the applications that will be accessible to each user.

Annex D “Identification and Authentication” indicates the procedure to be followed in order to obtain the list of users with authorized access to the network and the applications, as well as the rights granted to them.

In Annex D “Identification and Authentication”, the list of users with authorized access to each information system is included. In addition, the type of authorized access for each of them is included. This list will be updated by the Privacy or Security Manager, or by the staff to whom this task has been thin, each time a user receives new privileges or each time a new user is registered with access to data of a character personal.

When for the provision of a service to BODEGAS BORDOY SL by personnel of third companies, these personnel have access to the resources of BODEGAS BORDOY SL, will be subject to the same conditions and security obligations as the own personnel of BODEGAS BORDOY SL.

6.2.6 Management supports

In BODEGAS BORDOY SL, media containing personal data will be labeled allowing identification. In the same way, they will be inventoried and stored in the facilities where the information systems are located (servers and communication equipment). This place will be considered restricted access and can only be accessed by the personnel authorized by the Treatment Manager.

Likewise, BODEGAS BORDOY SL has different employee profiles. All employees who require access to computer media that contain personal data, is authorized at the time of signing the employment contract with the company. Even for the sending and receiving of emails with attached documents.

In this way, access to media will be understood as authorized from the moment the employee signs the employment contract with BODEGAS BORDOY SL.

This authorization will be understood as valid, provided that the employment contract remains in force. When the employment relationship with the employee ceases, the authorization will be understood as terminated.

6.2.7 Backup and recovery procedures

BODEGAS BORDOY SL has established a procedure for making backup copies with weekly minimum periodicity, unless in that period there was no update of the data.

The mentioned procedure for the recovery of the data must guarantee at all times its reconstruction in the state in which they were at the time of the loss or destruction.

Only, in the event that the loss or destruction, affect data categories or partially automated treatments and provided that the existence of documentation to achieve the objective referred to in the previous paragraph, will be manually recorded data.

The procedure establishes a verification at least every six months to ensure the correct definition, operation and application of the backup and recovery procedures of the data.

The architecture of the backup procedure is detailed in Annex I “Backup and Recovery Procedures”.

6.2.8 Inventory of computer applications

BODEGAS BORDOY SL has developed an inventory of computer applications in order to be able to manage and indicate the location of the existing data categories within the computer systems.

In Appendix J “Inventory of computer applications” is the list of computer applications used by BODEGAS BORDOY SL. This inventory will be updated by the Privacy or Security Manager, or by the personnel to whom this work has been thin, insofar as computer applications are replaced, deleted or added within the information management systems of the data categories.

6.2.9 Non- automated processing procedures

Non-automated treatment is understood as any set of personal data organized in a non-automated and structured manner according to specific criteria relating to natural persons, which allow disproportionate access to your personal data, whether centralized, decentralized, functionally distributed or geographic. In a generic way, non-automated treatment will be considered any document in which personal data are found in a non-computer format (invoices, budgets, delivery notes, contracts, CVs, etc.).

The security measures described above for the automated data categories will apply to the non-automated data categories. Additionally, Annex M “Non-automated treatment operations” describes the security measures applicable only to processing operations performed exclusively on paper.

6.2.10 Contracts for the provision of services

BODEGAS BORDOY SL has hired different service providers that perform data processing under their responsibility, BODEGAS BORDOY SL has documented in Annex G “Relationship of Treatment Managers” the updated list of all those service providers, that for the services that are being provided, have access to personal data under the responsibility of BODEGAS BORDOY SL.

These must include the following information:

• Manager Treatment
• Reason Social
• CIF
• Purposes of the treatment
• Categories of interested parties and categories of personal data
• Technical and organizational security measures

Incidents and violation of data security will be considered any situation that compromises the security of the personal data object of treatment, which causes the accidental or unlawful destruction, loss or alteration of personal data transmitted, conserved or otherwise processed, or unauthorized communication or access to said data.

In this sense, BODEGAS BORDOY SL will record the incidents that may affect the security of the information systems and that affect the personal data being processed. However, BODEGAS BORDOY SL will review any development regulations that could affect the current regulations in order to proceed to communicate these situations to the relevant Control Authority, without undue delay and, if possible, no later than 72 hours after having record of it; If it is not carried out within this period, it must be accompanied by a reasoned justification.

This communication must contain at least the following points:

• Description of the nature of the breach of security of personal data, including, where possible, the categories and approximate number of affected stakeholders and the categories and approximate number of data records of that data. try
• Name and contact information of the Data Protection Delegate and, in his absence, of the Privacy Manager
• Description of the possible consequences of the breach of security of personal data
• Description of the measures adopted or proposed by BODEGAS BORDOY SL, in order to correct this fall in security of the information systems, including, if necessary, those adopted to mitigate the possible negative effects
• If this is not possible, or to the extent that it is not possible to provide the information simultaneously, the information should be provided in stages without undue delay

In any case BODEGAS BORDOY SL will proceed to document any incident, breach or breach of security of the personal data, indicating its context, its effects and the corrective measures adopted. This documentation will be available to the Spanish Agency for Data Protection. This work will fall on the Delegate of Data Protection and, failing that, the responsibility of Privacy or Security will be held responsible.

In Annex C “Procedure for communication with the DPO”, there is the model for recording incidents and data security violations.

The procedure established by BODEGAS BORDOY SL will foresee those situations in which it is probable that the breach of security of the personal data will give rise to a high risk for the rights and freedoms of the interested parties. BODEGAS BORDOY SL will inform the interested party, without undue delay, of the breach of security of personal data.

It will describe in clear and simple language the nature of the breach of security of the personal data and will contain, at least, the information and the commented recommendations previously.

Likewise BODEGAS BORDOY SL will not proceed to this communication to the interested party when the following situations converge:

• BODEGAS BORDOY SL has instituted appropriate technical and organizational protection measures and these measures have been applied to personal data affected by the breach of security of personal data, in particular those that make data unintelligible for anyone who is not authorized to access them, such as encryption
• BODEGAS BORDOY SL has taken subsequent measures to ensure that it is no longer likely that the high risk caused by the security breach of the data

When this communication supposes a disproportionate work for BODEGAS BORDOY SL, it will opt for a public communication or a similar measure by means of which the interested parties are informed in an equally effective way.

The current data protection regulations regulate both the rights that can be exercised by the interested party and the mechanisms for exercising such rights before the person in charge of processing the data.

The rights that can be exercised by the data subject are the following:

• Right of access: it is the right of the interested party to obtain from the Treatment Manager confirmation of whether personal data concerning him is being processed or not, and in case of confirmation the treatment he you must of to ease the access to the data Y to theinformation of what has
• Right of rectification: the interested party shall have the right to obtain from the Person Responsible for Processing without unjustified delay the rectification of the personal data that concerns him when such data is inaccurate. In view of the purposes for which the data have been processed, the data subject will have the right to have personal data completed when they are incomplete, in particular through the provision of an additional declaration
• Right to limitation of treatment: it is the right to obtain from the Data Controller the limitation of the processing of personal data
• Right to deletion (“right to be forgotten”): refers to the right of the interested party to obtain from the Person Responsible for Processing the deletion of personal data concerning him without undue delay, and the Person Responsible for Processing will have the obligation to suppress personal data without unjustified delay when the requirements stipulated in Article 17 of the Regulation are met
• Right to data portability: it consists of the right to receive the personal data that concern you, that has been provided to a Treatment Manager, in a structured format and of habitual use and of mechanical reading and to transmit them to another Person in charge of Treatment without that is prevented by the Treatment Manager to whom the data
• Right of opposition: the interested party may object at any time, for reasons related to their particular situation, to the fact that personal data concerning him or her are subject to a treatment for the fulfillment of a public interest or for the satisfaction of a legitimate interest, including the profiling on the basis of those provisions

Response periods:

In this sense, during the transition period of 2 years for the full application of the RGPD, and as long as there are no national regulations in this regard, the rights of access, rectification, opposition and cancellation or deletion will be understood as valid. Likewise, the deadlines set by the Treatment Manager to resolve the exercise of the foregoing rights by the interested party are established. The terms are the following:

The Treatment Manager will provide the interested party with the exercise of their rights and information on the actions requested and carried out without delay and, at the latest, within one month for the right of access and ten days for the rights of rectification, opposition and cancellation or deletion, upon receipt of the request

The interested party may exercise their rights regarding data protection free of charge.

In these cases it will be BODEGAS BORDOY SL who will assume the burden of demonstrating the manifestly unfounded or excessive nature of the request.

In any case, any request must be accompanied by:

• Name, last name of the interested party and copy of the DNI. In the exceptional cases in which the representation is admitted, it will also be necessary the identification by the same means of the person who represents him, as well as the document accrediting the representation. The photocopy of the DNI may be substituted provided that the identity is accredited by any other means valid in law
• Petition in which the request is specified. (Exercise that is requested or information to which you want to access). If you do not refer to a specific file, you will be provided with all the information you have about the company in your name. If you request information from a specific file, only the information in this file. If you request information regarding a third party, it can never be provided. If you request it by phone you will be instructed to do so in writing and you will be informed of how you can do it and the address to which you have to send it. You will never be given information by phone
• Address for notifications effect
• Date and signature of applicant
• Documents accrediting the petition that formulates