Privacy Policy

Aimed at users of the Explosives Precursor Application service (hereinafter APEx), where you can find all the information about the data collected in the application, how they are used and what control they have over them.

Who is responsible for processing your data as a user of APEx?

The controller of the processing Control of Explosives Precursors (APEx) of your data as user of the APEx App is:

• Name: Secretary of State for Security - Centre for Intelligence against Terrorism and Organised Crime (DIR3 E04726802)
• Email: citco@interior.es
• Address: C/ Josefa Valcárcel No. 28, 5th floor. 28027 Madrid

The unit responsible for the APEx service is the Centre for Intelligence Against Terrorism and Organised Crime (hereinafter CITCO), a leading body under the Secretariat of State for Security of the Ministry of the Interior.

What data do we process about you?

The information we process about you comes exclusively from APEx , with the exception of the information may be necessary to obtain your data in order to be able to generate licences for explosive precursors (hereinafter PEx ). Data or other data will be processed depending on the activities you do from APEx .

As a result of your inquiries and activities, your personal data that could be processed at APEx will be of one or more of the following types:

• Identification or contact details: first name, last name, ID address, postal address, telephone or email address, among others.
• Identification details of your device.
• Data concerning your citizenship: what is your autonomous community, province or municipality, etc.
• Data relating to documents of incorporation of your company, accreditation of your business, business or professional activity, through the delivery of a certificate of discharge in the Economic Activities Tax, Commercial Registration, other Official Register, or any similar official document certifying an economic activity, having in any case its name, tax address and identification number for the purposes of Value Added Tax.
• Details of your licence for explosives precursors, in terms of authorised precursor, concentration and quantity, as well as purchases made in different establishments, etc.

Additionally, to facilitate access to APEx , the user can use the biometric authentication mechanisms provided by the different mobile platforms (iOS and Android) that manage and store on your mobile device your biometric identification data, such as face recognition or fingerprint. We will never use or access such data.

How does APEx get your data and where does it come from?

The data is obtained when you provide them in the registration process, through the integration of APEx with the Cl@ve PIN service, or when you subsequently provide them to send a query or suggestion, or in the process of applying for a license from one of the PEx.  

In no case will we obtain your data without your consent.

• Once you access the application and accept the privacy policy and legal conditions, registration in it starts through the service Cl@ve PIN, of the program Cl@ve,  Electronic Identity for Administrations. This certifies your full identification and enables the collection of your basic identification  data (NIF, first name and last name).
• Once the basic registration is done through the Cl@ve PIN service, you will have to choose which of the possible roles you want to interact with   APEx . You have a full explanation of these  in  the FAQ document, which is  available prior to access to APEx. Depending on the chosen role, a series of necessary documents and data are provided, which are detailed  below
  • Expert.  Authorised in advance by the CITCO.
  • Economic  operator.  Until documents are forwarded and verified, discharge is suspended:
    • Certificate of discharge in the Economic Activities Tax, Commercial Register, other Official Register, or any similar official document certifying an economic activity, including in any case its business name, tax address and identification number for the purposes of Value Added Tax.
    • Scriptures constitution of society (if applicable).
    • Model 036 o 037 de la Tax Agency.
    • Contact telephone.
  • Professional  User.  Until documents are forwarded and verified, discharge is suspended:
  • • Receipt of Social Security for self-employed persons.
    • Scriptures constitution of society (if applicable).
    • Contact telephone.
  • Particular: The registration is done through the service Cl@ve PIN.

• With regard to the “Licenses” section  and  only applicable to users in the role of “private”, the very request for a PEx licence implies that a series of data are provided to the public, which are essential for a positive or negative assessment of the request. If the license is granted, your data will be displayed and updated in that paragraph.
• The information shown in the section  “Profile”,  which can be edited by the user, is stored in the system. It only affects the phone number, profile photo uploaded by the user (otherwise one is included by default) and email.
• In relation to the “Report” section,  which  is used to report theft, disappearances or suspicious transactions of PEx in cases where the user is required by law, a telephone number is required. The aim is to ensure an immediate means of communication between CITCO specialists and the communicator.
• As for the “Alerts” section,  APEx does not require data, issuing a notification from the application itself. The generation of such alerts will be limited to cases of need, such as proximity notices of the license expiration date, in case of users with the role of “private”.

All these services are provided from the mobile APP.

What is the legal basis for the processing of your data?

The processing of personal data that may be carried out by APEx is based: either on the fulfillment of a mission carried out in the public interest, or in the exercise of the obligations conferred on the controller in accordance with Article 6.1 a), c) and e) of the GDPR. Specifically, it would be the information integrated in the mobile APP itself, on the following data:

• Identifying data.
• E-mail address.
• Information on the services consulted.
• Profile picture, only in case you have added it personally in the "Profile" section.

In addition, we inform you that the regulations applicable to the services offered by APEx are as follows:

• Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights.
• Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations.
• Law 40/2015, of October 1, on the Legal Regime of the Public Sector.
• Regulation (EU) 2016/679, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
• Royal Decree 203/2021, of March 30, approving the Regulation on the performance and operation of the public sector by electronic means.
• Royal Decree 311/2022, of May 3, regulating the National Security Scheme.

Why and for what purpose do we use your data?

The objective of APEx is to facilitate your relationship with the public administration regarding the rights and obligations related to PEx, offering you a simple means to access the following services:

• Application for PEx licenses.
• Notification of reports related to the PEx in your possession. In relation to the role you have, you will be able to notify "suspicious transactions", "thefts" or "disappearances", as the case may be.
• Acquire PEx through APEx , facilitating absolutely the checks and records related to it.
• Fulfill PEx retail sales reporting obligations, with no interaction on your part.
• Serve as a forum for open discussion on PEx, for specialists and experts of the public administration on the subject

The information and data collected in "APEx " will be processed solely for the purpose of providing you with a personalized administrative service and information of interest to you. To this end, we use your data to offer you the following services:

• Receive notices (provided you give your prior consent) in your email or phone, if you apply for a PEx license.
• Receive notices through PUSH notifications when CITCO assesses that there may be an event of interest to you, for example, when your PEx license is about to expire. The information used to send you notices is only updated as defined in section 3 How does APEx obtain your data and where does it come from? of this document, so as indicated in that section, it is possible that, if you do not access it periodically, the notices you receive may not be up to date.
• Possibility of adapting the presentation of APEx according to your preferences and the role with which you access.

All the extensive information about data processing can be found in the Register of Activities of the Ministry of the Interior at the following web link: https://www.interior.gob.es/opencms/es/servicios-al-ciudadano/participacion-ciudadana/proteccion-de-datos-personales/tutela-de-los-derechos/

How long do we store your data?

The retention period will depend on the type of data:

• In relation to information relating to the "Profile" section of APEx , it will be automatically deleted if you do not access APEx for a period of two years from your last access to the service. However, you may withdraw your consent at any time, and such information will not be stored, in which case the operation of APEx , or the enabling of roles, may cease. In the event that you have or have had a PEx license, this period will be adjusted as indicated in the current regulations, always in order to ensure adequate access by individuals to PEx.
• With respect to the data relating to the various sections ("Licenses", "Purchases" and "Suggestions"), these are stored for the sole purpose of being able to monitor these circumstances, and to offer you the requested service.
• In relation to the information relating to the "Profile", including the user image, the data provided will be stored for a maximum period of two years from your last access to the service.

Who has access to your data?

Only you have access to your data.

Notwithstanding the foregoing, in certain cases (for example, to process a PEx license you request) it is necessary for us to access and share the strictly necessary data exclusively with the Police Force in charge of helping us to resolve the request. Likewise, to respond to your inquiries, or to ensure access permissions to the roles you have requested.

What are your rights and how can you control your data?

The regulations give you a number of rights in relation to the data and information we process about you. Specifically, the rights of access, rectification, deletion and portability of data, limitation and opposition to its processing.

For those data in which the SES is responsible for the processing, for example: identification data; e-mail; telephone number; profile picture; data in relation to the PEx or your license; information regarding your corporate data or being up to date with the payment of the receipt of self-employed; information about your professional qualification and employment, Unit to which you belong; information about the services consulted, etc., these rights will be exercised with the SES.

You can consult the full scope and detail of these rights on the website of the Spanish Data Protection Agency (AEPD).

You may exercise all these rights at any time and free of charge. You can contact the data controller in person at any of the offices of the registry assistance network or through the Electronic Headquarters of the Ministry of the Interior.

You also have the right to address as a point of contact or, if you are not satisfied with the resolution of the controller, to complain to the Data Protection Delegate of the Secretary of State for Security, in a prior and optional manner.

Data Protection Delegate (DPD)

• Data: Data Protection Delegate for the Secretary of State for Security (DIR3 E04625302)
• Email: ses.dpd@interior.es
• Address: C/ Amador de los Ríos, 2, 28010. Madrid.

Apart from all of the above, you have the right at all times to file a complaint with the Spanish Data Protection Agency.

Finally, it should be noted that if a user repeatedly fails to comply or engages in activities that alter the normal operation of both APEx and its management system (for example, repeated unjustified reports or communications), the PCN reserves the right to terminate the user's access to the service.

How do we protect your data?

The Secretariat of State for Security guarantees the security, secrecy and confidentiality of your data, communications and personal information and has adopted the most demanding and robust security measures and technical means to prevent their loss, misuse or unauthorized access.

The technical and operational security measures implemented correspond to those provided by the responsible and those provided for in Annex II (Security Measures) of Royal Decree 311/2022 of May 3, which regulates the National Security Scheme.

In addition, we are committed to act quickly and responsibly in the event that the security of your data may be at risk, and to inform you if relevant. We have security incident management protocols in place, which include notifications to supervisory authorities and to users in the cases provided for in the legislation.

Finally, we inform you that both the storage and the rest of the activities of the processing of your data will always be located within the European Union.

Cookie Policy

You can consult all the information related to the cookies used in this service in our Cookies Policy.

By accepting them, you confirm that you have read and accept these terms of use and privacy policy and consent to the processing of your personal data.