It is a statement that informs the owner of the personal data: who collects (responsible), what they collect (information that is collected), what they collect for (the purposes of the treatment), how to limit the scope (use or disclosure,) how to revoke their consent, how to exercise ARCO rights (the means of access, rectification, cancellation, and opposition), how to communicate changes to the notice (procedure and means), if it is accepted or not that the data be communicated to third parties (transfers), where appropriate , if sensitive data is collected.
The main purpose of the privacy notice is to inform the owner of the personal data, first, that their personal information will be collected and used for certain purposes and, second, the characteristics of the treatment to which their personal data will be submitted. The foregoing in order for the owner to make informed decisions regarding his personal data and control the use of his personal information. Thus, the privacy notice allows the data controller to:
Make transparent to the owner the purposes and transfers to which his personal data are subjected.
Inform the owner how to exercise the rights granted by law.
In terms of articles 3, section I, 17 and 18 of the Law, and 14, 27 and 29 of its Regulations, the person in charge must make the privacy notice available to the owner at the following times:
I. When personal data are obtained directly or personally from the owner, the person in charge must make the privacy notice available to them prior to obtaining them;
II. When the personal data have been obtained indirectly from the owner, and these come from a consented transfer or one in which consent is not required according to article 37 of the Law; Or, from a publicly accessible source, the person in charge receiving or obtaining the personal data must make the privacy notice available to the first contact with the owner. In the event that the treatment does not require contact with the owner, the person in charge must inform him of the privacy notice prior to the use of personal data for the respective purpose, and
III.When the person in charge intends to process the personal data for a purpose other than that consented to by the owner, they must make available a new privacy notice with the characteristics of the new treatment, prior to the use of the personal data for the respective purpose.