In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, the Directorate General for Gambling Regulation (hereinafter DGOJ) undertakes to comply with its obligation of confidentiality regarding personal data and its duty to process such data confidentially. For this purpose, it will adopt the necessary measures to prevent their alteration, loss, unauthorized processing or access.
Additionally, the following information is provided regarding the protection of personal data in the specific processing carried out by the DGOJ for the proper management of personnel serving this unit:
Who is the controller responsible for processing your data?
Directorate General for Gambling Regulation
c/Atocha 3, 28012 MADRID, Spain
dgoj.dgeneral@ordenacionjuego.gob.es
Data Protection Officer: Technical Office of the Undersecretariat for Social Rights, Consumer Affairs and the 2030 Agenda.
Paseo del Prado 18, 28014, MADRID.
dpd@dsca.gob.es
For what purpose will the DGOJ process your data?
At the DGOJ, we will process the personal data stored in the Human Resources database in order to manage the personnel serving this Directorate General, both civil servants and employees, including access control to assets, personnel records, time and attendance tracking, payroll, leave, holidays, absences, participation in courses and training, social benefits, management of trade union activities, occupational risk prevention, etc.
How long will my data be retained in the DGOJ systems?
The DGOJ will retain your data for as long as necessary to fulfill the purpose for which it was collected and to determine any potential liabilities that may arise from that purpose and from the processing of the data. The provisions set out in the regulations on archives and documentation will apply.
The financial data related to this processing activity will be retained in accordance with the provisions of Law 58/2003 of 17 December, General Tax Law.
What legitimizes the DGOJ to process your data for the purposes indicated?
The processing of your data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority by the DGOJ (Article 6(1)(e) of the GDPR), and is necessary for compliance with a legal obligation to which it is subject as the data controller (Article 6(1)(c) of the GDPR), as well as being necessary for the performance of a contract (Article 6(1)(b) of the GDPR), in accordance with the following regulations:
- Law 39/2015 of 1 October on the Common Administrative Procedure of Public Administrations.
- Law 40/2015 of 1 October on the Legal Regime of the Public Sector.
- Legislative Royal Decree 5/2015 of 30 October approving the Law of the Basic Statute of Public Employees.
- Legislative Royal Decree 2/2015 of 23 October approving the consolidated text of the Workers’ Statute Law.
The data processed and provided in each of the requests issued by the personnel management department are the minimum strictly necessary to fulfill the purpose of the processing.
To which recipients will your data be disclosed?
Your personal data will be communicated to the entities required in order to carry out the management and objectives pursued by the processing: INAP, Central Personnel Registry, the delegated Occupational Risk Prevention entity, AEAT (Tax Agency), trade union organizations, IGAE, Court of Auditors, Orphans’ Associations, TGSS, INSS and Muface, Directorate-General for Personnel Costs and Public Pensions, financial institutions, etc.
Furthermore, no international transfers of your data to third countries are foreseen.
What are your rights when you provide us with your data?
- Any person has the right to obtain confirmation as to whether or not the DGOJ is processing personal data concerning them.
- Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data.
- In certain circumstances and for reasons related to your particular situation, which must be stated in the request, you may object to the processing of your data. The DGOJ will cease processing your data unless compelling legitimate grounds for the processing are demonstrated which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
- You may request the restriction of the processing of your data when:
- The accuracy of the data is contested, for a period allowing the DGOJ to verify its accuracy.
- You request that we retain your data when it is no longer necessary for the purpose for which it was collected and prior to its deletion by the DGOJ; in this case, it will only be retained for the establishment, exercise, or defense of legal claims.
- Once you have exercised your right to object to the processing, while it is being verified whether the legitimate grounds of the DGOJ for processing your data override your own. - You may exercise these rights by submitting a request to the Directorate General for Gambling Regulation electronically, through this page.
or in person through the network of assistance offices for registrations by submitting this application form (editable and printable version) 
). - You may also lodge a complaint with the Spanish Data Protection Agency if you consider that your rights have not been satisfactorily exercised, either through its web form (Complaint Form of the Spanish Data Protection Agency), or in person at c/ Jorge Juan 6, 28001 MADRID.
