This page informs about the privacy and data protection policy of the Government of Aragón, which has been adapted to “Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data ” (hereafter, GDPR) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights.
This policy applies to information collected through the different Government of Aragón Departments and through its website www.aragon.es and the rest of the portals that come under it.
The processing of personal data collected on this website and on the Government of Aragón's portals will be subject to current data protection legislation, the GDPR and other applicable regulations. In this way users' privacy and the security of their personal data are guaranteed at all times.
The Government of Aragón undertakes to keep strictly confidential all information that is provided and to use it solely for the purposes established in each case.
Responsibility for processing personal data.
The Government of Aragón has a database entitled “Register of Government of Aragón Processing Activities”. In it each Government of Aragón department indicates the processing activities carried out on each set of personal data. The data that are processed are those strictly necessary, appropriate and relevant to each purpose. The Government of Aragón is the personal data controller
To make the GDPR requirement for further information compatible with presenting it to citizens in a concise and understandable way, the Government of Aragón shows information in two phases (known as multi-layer or double layer presentation). When personal data are collected, first-level basic information is displayed. If additional information is required a second layer of information can be accessed, providing greater details. The public access to the "Register of Treatment of Activities of the Government of Aragon" is done through the following link: aplicaciones.aragon.es/notif_lopd_pub
Purposes and lawfulness of processing personal data
In accordance with the provisions of the GDPR, we inform you of the purpose for which we collect personal data and the lawfulness of doing it. Both the lawfulness and purpose are included in the "Register of Government of Aragón Processing Activities ", accessible to everyone.
The purpose of the data processing performed will be in accordance with the activities carried out by the Departments of the Government of Aragón. Information on the purpose will be given in the first-layer and second-layer clauses displayed when personal data are collected.
Data processing shall be based on the assumptions indicated in article 6 of the GDPR. In the case of the Government of Aragón processing is usually carried out:
- In fulfilment of legal obligations
- For the performance of tasks carried out in the public interest
- In the exercise of public powers.
When the purpose of processing requires the consent of the data subjects, such consent shall be given by means of a clear affirmative action by the data subjects in which they declare their freely-given, specific, informed, unequivocal wish to accept the processing of their personal data.
Communication of personal data
In general, personal data shall not be communicated to third parties, except by legal requirement. The data subject shall be notified of any transfers or communication of data through the information clauses that are displayed at the time when personal data are collected.
Storage of personal data
Personal data provided shall be stored for the time required to fulfil the purpose for which the data were collected and to determine any possible liabilities that might arise. In any event, the periods and terms established in regulations relating to files and documentation shall be taken into account.
Rights of data subjects
Everyone has the right to obtain information on the processing of their personal data carried out by the Government of Aragón. They may exercise the rights of access, rectification, erasure and portability of data as well as those of limitation and opposition to processing. They may also exercise the right not to be the subject of decisions based solely on automatic data processing, including profiling. Rights shall be exercised before the body that is responsible for processing.
A claim can also be presented to the Spanish Data Protection Agency if you consider that your data is not being processed adequately.
Personal Data Security
In compliance with the provisions of article 32 of the GDPR, the Government of Aragón will guarantee the permanent confidentiality, integrity, availability and resilience of processing systems and services. The level of security will be proportional to the risk in processing each type of personal data.