| 1 - Name of the activity |
Supplier management |
| 2 - Responsible for the treatment / DPO |
COLEGIO PROFESIONAL DE DIETISTAS – NUTRICIONISTAS DE CANARIAS (CODINUISCAN) / Elena |
| 3- Purpose of the processing |
Tax, accounting and administrative management of suppliers
|
| 4- Legal grounds for the processing |
Provision of the service: GDP 6.1. b) execution of contract |
| 5- Categories of data subjects |
Suppliers, contact persons and/or legal representatives. |
| 6- Origin of the data |
The data subjects themselves or their legal representative. |
| Categories of personal data |
Identification and contact data; economic-financial and insurance.
|
| 7 - Identification data |
Identification and contact details: Name, surnames, identification documents (DNI, NIE or passport), address, telephone no., email. Name, surnames, telephone no. of contact persons. Name, surnames and signature of legal representatives
Economic-financial and insurance: Bank data.
|
| 8 - Processing system |
Mixed (IT systems and hardcopy documents). |
| 9- Data transfers |
Organisations or persons directly related to the controller. Competente Public Administrations.. Tax administration. Banking entities. Such cases as legally provided.
|
| International Transfers |
| 10- Country |
|
| 11 – Category of recipients |
|
| 12- Company |
|
| 13- Legal grounds |
|
|
| 14- Data erasure timeframes |
Data will be stored for the duration of the relation and, upon termination, will be stored for the legally required periods to address potential liabilities. |
| 15- General description of the technical and organizational security measures |
| FUNCTIONS AND OBLIGATIONS |
Deliver to all users in accordance with their user profiles, their functions and obligations relating to the security measures to be complied with and the consequences of any breach. |
| IDENTIFICATION AND AUTHENTICATION |
Individual identification and authentication Procedure for assigning and distributing passwords Password complexity and changes. |
| ACCESS CONTROL |
Updated list of authorised users and access. Access control allowed in keeping with the functions assigned and systems to prevent non-authorised access. Granting of access permits only for authorised personnel. Physical access control to the premises where the information systems are located. |
| BACKUP COPIES |
Frequency of backups Procedures for generating backup copies and data recovery. Remote backup copies systems. |
| MEDIA MANAGEMENT |
Inventory management and identification of media. Media stored under lock and key Log of incoming and outgoing media. Media destruction measures. |
| INCIDENT LOG |
Log containing the type, time detected, person reporting, effects and corrective measures of the incident. Notification procedure and incident management Data recovery procedures |
| OTHER TECHNICAL MEASURES |
Use of antivirus and firewalls.
Screen savers.
Remote access control
Standards of use of email and the internet.
Use of peripherals (printers, photocopiers and multi-function devices).
|
| NON-AUTOMATED PROCESSING |
Application of document filing criteria to facilitate consulting, locating and handling of Rights. Use of storage devices with locking systems (key, codes...). Custody of active documents to prevent non-authorised access. |
| DATA PROCESSORS |
List of data processors. Description of services rendered. Adoption of warranties by processors. |
|