Purpose of the Privacy Policy
This Privacy Policy has been established with the purpose of providing concise and transparent information on how the Port Authority of Tarragona processes the personal data of individuals who interact with it, in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
Data Controller
PORT AUTHORITY OF TARRAGONA
Passeig de l'Escullera, s/n, 43004 Tarragona, Spain
Tax ID (NIF): Q4367131B
Tel.: +34 977 259 400
Passeig de l'Escullera, s/n, 43004 Tarragona, Spain
Tax ID (NIF): Q4367131B
Tel.: +34 977 259 400
Legal Basis for Data Processing
Any processing of personal data carried out by the Port Authority of Tarragona within the framework of an administrative procedure shall be based on at least one of the lawful bases set out in Article 6 of the GDPR:
• The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Processing is necessary for the performance of a contract to which the data subject is a party.
• Processing is necessary for compliance with a legal obligation to which the data controller is subject.
• Processing is necessary to protect the vital interests of the data subject or of another natural person.
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
Given its legal nature, the processing activities carried out by the Port Authority of Tarragona are primarily based on the performance of a task carried out in the public interest or on compliance with a legal obligation applicable to the data controller.
• The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Processing is necessary for the performance of a contract to which the data subject is a party.
• Processing is necessary for compliance with a legal obligation to which the data controller is subject.
• Processing is necessary to protect the vital interests of the data subject or of another natural person.
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
Given its legal nature, the processing activities carried out by the Port Authority of Tarragona are primarily based on the performance of a task carried out in the public interest or on compliance with a legal obligation applicable to the data controller.
Purposes of Data Processing
The main purposes of the processing of personal data carried out by the Port Authority of Tarragona are to provide public services to data subjects and to manage the administrative procedures in which they are involved.
Source of Personal Data
The personal data processed is obtained primarily from the data subjects themselves as a result of their interactions with the Port Authority of Tarragona.
Disclosure of Personal Data and International Data Transfers
No disclosure of personal data to third parties is envisaged, except where required to comply with a legal obligation or pursuant to a contract entered into with a Data Processor.
No international transfers of personal data are envisaged.
No international transfers of personal data are envisaged.
Data Retention Period
Personal data will be retained for as long as necessary to fulfil the purposes of the processing and to comply with applicable legal obligations. It may also be retained for a limited period for historical archiving or statistical purposes.
Data Security
The Port Authority of Tarragona is committed to implementing and complying with the security obligations applicable to the processing of personal data, as well as with the other obligations arising from data protection legislation, in accordance with Royal Decree 311/2022 of 3 May, which regulates the National Security Framework (Esquema Nacional de Seguridad – ENS), under which its information systems have been certified:
Certificate of Compliance with the National Security Framework (ENS).
Rights of Data Subjects
Data subjects have the following rights regarding their personal data, which they may exercise free of charge before the Port Authority of Tarragona:
• Right of access, consisting of the right to obtain a copy of the personal data being processed and all information relating to such processing.
• Right to rectification, where the personal data processed is inaccurate or incomplete.
• Right to object to processing, which may be exercised in certain circumstances:
o Where the processing is based on the performance of a task carried out in the public interest or on the legitimate interests of the data controller, including profiling.
o Where the processing is carried out for direct marketing purposes, including profiling.
• Right to erasure, consisting of the right to have personal data deleted, provided that there is no legal obligation requiring its retention.
• Right to restriction of processing, which may be exercised where one of the following conditions applies:
o The data subject contests the accuracy of the personal data, for a period enabling the data controller to verify its accuracy.
o The processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of its use instead.
o The data controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise, or defence of legal claims.
o The data subject has objected to processing pursuant to Article 21(1) of the GDPR, pending verification of whether the legitimate grounds of the data controller override those of the data subject.
• Right to data portability, consisting of the right to receive the personal data provided to a data controller in a structured, commonly used, and machine-readable format, and to transmit those data to another data controller.
• Right not to be subject to automated individual decision-making.
• Right to lodge a complaint with the competent supervisory authority. In the case of the Port Authority of Tarragona, the competent authority is the Spanish Data Protection Agency (AEPD), located at Jorge Juan Street, 6, 28001 Madrid, Spain. Website: Spanish Data Protection Agency (AEPD).
• Right of access, consisting of the right to obtain a copy of the personal data being processed and all information relating to such processing.
• Right to rectification, where the personal data processed is inaccurate or incomplete.
• Right to object to processing, which may be exercised in certain circumstances:
o Where the processing is based on the performance of a task carried out in the public interest or on the legitimate interests of the data controller, including profiling.
o Where the processing is carried out for direct marketing purposes, including profiling.
• Right to erasure, consisting of the right to have personal data deleted, provided that there is no legal obligation requiring its retention.
• Right to restriction of processing, which may be exercised where one of the following conditions applies:
o The data subject contests the accuracy of the personal data, for a period enabling the data controller to verify its accuracy.
o The processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of its use instead.
o The data controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise, or defence of legal claims.
o The data subject has objected to processing pursuant to Article 21(1) of the GDPR, pending verification of whether the legitimate grounds of the data controller override those of the data subject.
• Right to data portability, consisting of the right to receive the personal data provided to a data controller in a structured, commonly used, and machine-readable format, and to transmit those data to another data controller.
• Right not to be subject to automated individual decision-making.
• Right to lodge a complaint with the competent supervisory authority. In the case of the Port Authority of Tarragona, the competent authority is the Spanish Data Protection Agency (AEPD), located at Jorge Juan Street, 6, 28001 Madrid, Spain. Website: Spanish Data Protection Agency (AEPD).
Exercise of Data Subject Rights
Data subjects may exercise the rights described in the previous section through the Electronic Headquarters (e-Office) by using the procedure available at the following link: Exercise of Data Protection Rights.
Alternatively, data subjects may submit their request to exercise their rights by email to dpd@porttarragona.cat, by post to Passeig de l'Escullera, s/n, 43004 Tarragona, Spain, or in person at the Registry Office, located at the same address.
The request must specify the right being exercised and, where appropriate, include any documentation that may be useful or necessary for processing the request. Where the data subject acts through a representative, such representation must be duly evidenced, as applicable.
Data subjects may use the standardised data subject rights request form published below on this website or the official templates made available by the Spanish Data Protection Agency (AEPD).
The Port Authority of Tarragona shall respond to each request within a maximum period of one month from the date of receipt. This period may be extended by a further two months, where necessary, taking into account the complexity and number of requests received.
The request must specify the right being exercised and, where appropriate, include any documentation that may be useful or necessary for processing the request. Where the data subject acts through a representative, such representation must be duly evidenced, as applicable.
Data subjects may use the standardised data subject rights request form published below on this website or the official templates made available by the Spanish Data Protection Agency (AEPD).
The Port Authority of Tarragona shall respond to each request within a maximum period of one month from the date of receipt. This period may be extended by a further two months, where necessary, taking into account the complexity and number of requests received.
