GDPR — Your Rights as a Data Subject

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) is the fundamental regulation governing the processing of personal data in the European Union, complemented in Spain by Organic Law 3/2018 on Personal Data Protection and digital rights guarantee (LOPDGDD). X4JX LAB SL is subject to the GDPR as a data controller established in Spain, a member state of the EU.

The competent supervisory authority overseeing X4JX LAB SL's GDPR compliance is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), headquartered at C/ Jorge Juan, 6, 28001 Madrid, Spain.

As a data subject whose data is processed by X4JX LAB SL, the GDPR recognises the following rights: (1) Right of access (Art. 15): obtain confirmation of whether we process your data and, if so, receive a copy along with information on purpose, categories, recipients and retention period. (2) Right to rectification (Art. 16): request correction of inaccurate data or completion of incomplete data. (3) Right to erasure or 'right to be forgotten' (Art. 17): request deletion of your data when, among other cases, it is no longer needed for the purpose for which it was collected. (4) Right to restriction of processing (Art. 18): request temporary suspension of processing while a dispute about accuracy or lawfulness is resolved. (5) Right to data portability (Art. 20): receive your data in a structured, commonly used and machine-readable format. (6) Right to object (Art. 21): object to processing based on legitimate interest, including profiling.

To exercise any of the described rights, contact our Data Protection Officer (DPO) through the following channels: (a) Email: privacy@4jlab.com (preferred channel — response in < 48 working hours); (b) Post: X4JX LAB SL, Attn: DPO, Calle Emilio Tuya 37, 4th Floor, Unit C, 33202 Gijón (Asturias), Spain.

Your request should include: full name, a clear description of the right you wish to exercise, and a copy of a valid identity document (you may redact non-essential data). We will respond within one month of receiving a complete request, extendable by two further months in complex cases, with prior notification.

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. For X4JX LAB SL, the lead authority is the Spanish Data Protection Agency (AEPD).

You can contact the AEPD at: Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, Spain. Web: www.aepd.es. Electronic site: sedeagpd.gob.es. You may also lodge a complaint with the supervisory authority of the member state where you reside or work, if different from Spain. We encourage you to contact us first to try to resolve the matter directly.

X4JX LAB SL has appointed a Data Protection Officer (DPO) responsible for overseeing GDPR compliance within the organisation. The DPO acts independently and is available to both data subjects and the supervisory authority.

DPO contact details: Email: privacy@4jlab.com. Address: Calle Emilio Tuya 37, 4th Floor, Unit C, 33202 Gijón (Asturias), Spain. The DPO handles enquiries in English, Spanish and Mandarin Chinese (the latter through the 4J Lab partner network).