Privacy Policy

INDEX

1. Objective of the Privacy Policy
2. Definitions
3. Identity of the Data Controller
4. Applicable laws and regulations
5. Principles applicable to the processing of personal data
6. Data Processing Activities Performed
7. Necessary and up-to-date information
8. Personal data of minors
9. Technical and organizational security measures
10. Rights of interested parties
11. Complaints to the Supervisory Authority
12. Acceptance and changes to the Privacy Policy

1. OBJECTIVE OF THE PRIVACY POLICY

This “Privacy and Data Protection Policy” aims to inform you of the conditions governing the collection and processing of personal data by Grupo Inversor Monte Nevado SL, making every effort to ensure the
fundamental rights, honor and freedoms of the persons whose personal data is processed in compliance with current regulations and laws governing the Protection of Personal Data according to the European Union and the Spanish Member State and, specifically, the
expressed in the section “Processing Activities” of this Privacy Policy.

Therefore, in this Privacy and Data Protection Policy, users of the Website are informed https://campusdeljamon.com/ of all the details of interest to you regarding how these processes are carried out, for what purposes, that other entities may have access to your data and what the rights of users are.

2.- DEFINITIONS

«"Personal data"»: Any information about an identified or identifiable natural person (“the Website user”); an identifiable natural person is one whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
«"Treatment": any operation or set of operations performed on personal data or sets of personal data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available,
matching or interconnection, limitation, suppression or destruction.
«"Limitation of treatment": the marking of personal data stored with the aim of limiting its processing in the future.
«"Profiling": any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects of a natural person, in particular to analyze or predict aspects relating to that natural person's professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
«"Pseudonymization": the processing of personal data in such a way that they can no longer be attributed to a data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures
intended to ensure that personal data is not attributed to an identified or identifiable natural person.
«"File": any structured set of personal data, accessible according to certain criteria, whether centralized, decentralized or distributed functionally or geographically.
«"Data Controller"» or "responsible"«The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by the controller.
Union or Member State law.
«"Data controller" or "processor": the natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
«"Addressee": The natural or legal person, public authority, agency, or other body to whom personal data is disclosed, whether or not a third party. However, public authorities that may receive personal data shall not be considered recipients.
within the framework of a specific investigation pursuant to Union or Member State law; the processing of such data by those public authorities shall comply with the data protection rules applicable to the purposes of
treatment.
«"Third": natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons authorized to process personal data under the direct authority of the
responsible or in charge.
«"Consent of the interested party": any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, agrees to the processing of personal data relating to him or her.
«"Personal data security breach": any security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;
«"Genetic data": personal data relating to the inherited or acquired genetic characteristics of a natural person that provide unique information about the physiology or health of that person, obtained in particular from the analysis of a biological sample from that person.
«"Biometric data": Personal data obtained from a specific technical processing, relating to the physical, physiological or behavioral characteristics of a natural person that allow or confirm the unique identification of that person, such as images
facial or fingerprint data.
«"Health-related data": personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about their health status.
«"Main establishment"»: to) In the case of a controller with establishments in more than one Member State, the place of its central administration in the Union, unless decisions on the purposes and means of processing are
take such decisions in another establishment of the responsible party in the Union and the latter establishment has the power to enforce such decisions, in which case the establishment that has taken such decisions shall be deemed to be the principal establishment; b) in what
This refers to a processor with establishments in more than one Member State, the place of its central administration in the Union or, if it does not have one, the establishment of the processor in the Union where the main processing activities are carried out in the context of the activities of an establishment of the processor insofar as the processor is subject to specific obligations under this Regulation.
«"Representative": natural or legal person established in the Union who, having been designated in writing by the controller or the processor pursuant to Article 27 of the GDPR, represents the controller or the processor with regard to their respective obligations under this Regulation.
«"Company": natural or legal person engaged in an economic activity, regardless of its legal form, including companies or associations that regularly carry out an economic activity.
«"Control authority": The independent public authority established by a Member State pursuant to Article 51 of the GDPR. In the case of Spain, this is the Spanish Data Protection Agency.
«"Cross-border treatment"»: to) the processing of personal data carried out in the context of the activities of establishments in more than one Member State of a controller or processor in the Union, if the controller or processor is established in more than one Member State, or b) the processing of personal data carried out in the context of the activities of a single establishment of a controller or processor in the Union, but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
«"Information society service"»: any information society service, that is, any service normally provided for remuneration, remotely, electronically and at the individual request of a service recipient.

3.- IDENTITY OF THE DATA CONTROLLER

The Data Controller is the natural or legal person, public or private body, or administrative authority that, alone or jointly with others, determines the purposes and means of the processing of personal data; in the event that the purposes and
The means of processing are determined by European Union or Spanish Member State law.

In the aspects expressed in this Privacy and Data Protection Policy, the identity and contact details of the Data Controllers are:

Inverter Group Monte Nevado SL (B80852619)
Address: C/ San Ignacio, nº 6. 40270, CARBONERO EL MAYOR (Segovia), Spain
Contact: 921 560 030 – lopd@montenevado.com

MEAT INDUSTRIES EL RASILLO, SA ( A-40013237)
Address: AVDA SAN MAMES, 1. 26124, RASILLO (EL) (La Rioja) (La Rioja), Spain
Contact: 941462275

JAMONES SEGOVIA, SA (A-78024502)
Address: C/ San Ignacio, nº 6.. 40270, Carbonero el Mayor (Segovia), Spain
Contact: 921 560 030 – lopd@montenevado.com

4. APPLICABLE LAWS AND REGULATIONS

This Privacy and Data Protection Policy is developed based on the following data protection regulations and laws:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Hereinafter referred to as GDPR.
• Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights. Hereinafter LOPD/GDD.
• Law 34/2002, of July 11, on Information Society Services and Electronic Commerce. Hereinafter LSSICE.

5. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

Personal data collected and processed through this website will be processed in accordance with the following principles:

• Principle of lawfulness, fairness, and transparency: All processing of personal data carried out through this Website will be lawful and fair, and it will be fully clear to the user when their personal data is being collected, used, consulted, or processed. Information regarding the processing carried out will be provided beforehand and easily accessible.
  accessible and easy to understand, in simple and clear language.
• Principle of purpose limitation: All data will be collected for specific, explicit and legitimate purposes, and will not be processed subsequently in a manner incompatible with the purposes for which they were collected.
• Principle of data minimization: The data collected will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Principle of accuracy: Data will be accurate and, if necessary, updated, taking all reasonable steps to ensure that personal data that are inaccurate with regard to the purposes for which they are processed are deleted or rectified without delay.
• Principle of limitation of the storage period: Data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Principle of integrity and confidentiality: Data will be processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss or damage, through the application of appropriate technical and organizational measures.
• Principle of proactive responsibility: The entity that owns the Website will be responsible for compliance with the principles set out in this section and will be able to demonstrate it.

6.- DATA PROCESSING ACTIVITIES

The following details the data processing activities carried out through the website, specifying each of the following sections:

• Activity: Name of the data processing activity
• Purposes: Each of the uses and treatments carried out with the collected data
• Legal basis: The legal basis that legitimizes the processing of the data
• Data processed: Types of data processed
• Origin: Where the data is obtained from
• Retention: The period during which data is retained
• Recipients: Third-party persons or entities to whom the data is provided
• International transfers: Cross-border transfers of data outside the European Union

6.1 MAIN TREATMENT ACTIVITIES

These are data processing activities whose purposes are necessary and essential for the provision of services.

6.2 OPTIONAL TREATMENT ACTIVITIES (if the user has indicated their acceptance)

These are personal data processing activities whose purposes are not essential for the provision of the service and are only carried out if the user has indicated YES in the consent for the performance of these activities.

7.- NECESSARY AND UP-TO-DATE INFORMATION

All fields marked with an asterisk (*) on the Website forms must be completed, so that omitting any of them could make it impossible to provide you with the requested services or information.

You must provide truthful information, and to ensure that the information provided is always up-to-date and free of errors, you must notify the Data Controller as soon as possible of any changes or corrections to your personal data.
personal information that may arise can be sent via email to the address: lopd@montenevado.com.

Furthermore, by clicking on the "I Accept" button (or equivalent) incorporated in the aforementioned forms, you declare that the information and data you have provided in them are accurate and truthful, and that you understand and accept this Privacy Policy.

8.- DATA ON MINORS

In compliance with the provisions of Article 8 of the GDPR and Article 7 of the LOPD/GDD, only those over 14 years of age may give their consent for the processing of their personal data in a literal manner by Grupo Inversor Monte Nevado SL.

Therefore, children under 14 years of age may not use the services available through the Website without the prior authorization of their parents, guardians or legal representatives, who will be solely responsible for all actions taken through the Website.
Website by the minors in their care, including the completion of the online forms with the personal data of said minors and the marking, where appropriate, of the boxes that accompany them.

9.- TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

The Data Controller adopts the necessary organizational and technical measures to guarantee the security and privacy of your data, prevent its alteration, loss, unauthorized processing or access, depending on the state of technology, the nature of
the stored data and the risks to which it is exposed.

Among others, the following measures stand out:

• Ensure the ongoing confidentiality, integrity, availability, and resilience of treatment systems and services.
• Restore the availability and access to personal data quickly, in the event of a physical or technical incident.
• Regularly verify, evaluate and assess the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
• Pseudonymize and encrypt personal data, in case it is sensitive data.

On the other hand, the Data Controller has decided to manage the information systems in accordance with the following principles:

• Principle of regulatory compliance: All information systems will comply with the applicable legal, regulatory and sectoral regulations that affect information security, especially those related to the protection of personal data, security of systems, data, communications and electronic services.
• Risk management principle: Risks will be minimized to acceptable levels, and a balance will be sought between security controls and the nature of the information. Security objectives must be established, reviewed, and consistent with information security aspects.
• Principle of awareness and training: Training programs, awareness campaigns and awareness campaigns will be implemented for all users with access to information, regarding information security.
• Principle of proportionality: The implementation of controls that mitigate the security risks of assets will be carried out seeking a balance between security measures, the nature and information and risk.
• Principle of responsibility: All members of the Data Controller will be responsible for their conduct regarding information security, complying with the established rules and controls.
• Principle of continuous improvement: The effectiveness of the security controls implemented in the organization will be reviewed periodically to increase the capacity to adapt to the constant evolution of risk and the technological environment.

10.- RIGHTS OF INTERESTED PARTIES

Current data protection regulations grant users a series of rights regarding the use of their data. Each and every one of these rights is personal and non-transferable, meaning that they can only be exercised by the data subject.
of the data, after verifying their identity.

The following details the rights of website users:

• Right of access: This is the right of the Website user to obtain confirmation as to whether or not the Data Controller is processing their personal data and, if so, to obtain information about their specific personal data and the processing carried out or carried out by the Data Controller, as well as, among other things, information available on the origin of said data and the recipients of the communications made or planned in them.
• Right of rectification: This is the right that the user of the Website has to have their personal data modified if it is inaccurate or, taking into account the purposes of the processing, incomplete.
• Right to erasure: Commonly known as the “right to be forgotten,” this is the right of the Website user, provided that current legislation does not establish otherwise, to obtain the erasure of their personal data when it is no longer necessary for the purposes for which it was collected or processed; the User has withdrawn their consent to the processing and there is no other legal basis for it; the User objects to the processing and there is no other legitimate reason to continue with it.
  Likewise; the personal data have been unlawfully processed; the personal data have been obtained as a result of a direct offer of information society services to a child under 14 years of age. In addition to deleting the data, the Data Controller, taking into account available technology and the cost of implementation, will take reasonable steps to inform
  to other possible controllers who may be processing the personal data of the interested party's request for deletion of any link to that personal data.
• Right to restriction of processing: This is the Website User's right to restrict the processing of their personal data. The Website User has the right to obtain restriction of processing when they contest the accuracy of their personal data; the processing is unlawful; the Data Controller no longer needs the personal data, but the User needs it to...
  to make claims; and when the Website User has objected to the processing.
• Right to data portability: In cases where processing is carried out by automated means, the Website User has the right to receive their personal data from the Data Controller in a structured, commonly used and machine-readable format, and to transmit it to another data controller. Where technically feasible, the Data Controller will transmit the data directly to that other controller.
• Right to object: This is the User's right to prevent the processing of their personal data or to have the processing of said data by the Data Controller cease.
• Right not to be subject to automated decisions and/or profiling: The right of the Website User not to be subject to an individual decision based solely on the automated processing of his or her personal data, including profiling, existing unless otherwise provided by current legislation.
• Right to withdraw consent: This is the right of the Website User to withdraw, at any time, the consent given for the processing of their data.

The Website user may exercise any of the aforementioned rights by contacting the Data Controller and after
User identification using the following contact information:

• Responsible: Monte Nevado SL Investor Group.
• Address: C/ San Ignacio, nº 6. 40270, CARBONERO EL MAYOR (Segovia), Spain
• Telephone: 921 560 030
• E-mail: lopd@montenevado.com
• Website: https://campusdeljamon.com/

11.- RIGHT TO COMPLAIN TO THE SUPERVISORY AUTHORITY

The user is informed of their right to file a complaint with the Spanish Data Protection Agency if they believe that there has been an infringement of data protection legislation regarding the processing of their personal data.

Contact information for the supervisory authority:
Spanish Data Protection Agency
Email: info@aepd.es
Telephone: 900293183
Website: https://www.aepd.es
Address: C/. Jorge Juan, 6. 28001, Madrid (Madrid), Spain

12.- ACCEPTANCE AND CHANGES TO THE PRIVACY POLICY

It is necessary that the Website user has read and agrees to the data protection conditions contained in this Privacy Policy, as well as accept the processing of their personal data so that the Data Controller can proceed with it in the manner, timeframes and purposes indicated.

The Data Controller reserves the right to modify this Privacy Policy at its own discretion, or due to legislative, jurisprudential, or doctrinal changes by the Spanish Data Protection Agency. Changes or updates to this Privacy Policy that affect the purposes, retention periods, or transfers of data to
third parties, international data transfers, as well as any rights of the Website User, will be explicitly communicated to the user.

Version of March 4, 2026