Privacy policy

1. USER INFORMATION

 

Who is responsible for processing your personal data?

 

Susana Ranea Arroyo is responsible for processing the user‘s personal data and informs you that this data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD).

 

What type of data do we request and process?

 

Depending on the form or method used to obtain your data, we always request the minimum necessary to fulfill the purposes detailed in each case.

 

Why do we process your personal data?

 

Depending on the form through which we obtained your personal data, we will process it confidentially to achieve the following purposes:

 

In the Contact form

 

      • To respond to inquiries or any type of request made by the user through any of the contact methods available on the data controller’s website. (Based on the legitimate interest of the data controller, Art. 6.1.f GDPR)
      • To send commercial and advertising communications by email, fax, SMS, MMS, social media, or any other electronic or physical means, present or future, that allows for commercial communications. These communications will be sent by the data controller and will relate to its products and services, or those of its partners or suppliers with whom it has reached a promotional agreement. In this case, third parties will never have access to personal data. (Based on the data subject’s consent, Art. 6.1.a GDPR)
      • To conduct statistical analyses and market research. (Based on the legitimate interest of the data controller, Art. 6.1.f GDPR)

 

In the Newsletter form

 

      • To send newsletters, news, offers and online promotions. (with the consent of the data subject, 6.1.a GDPR)

 

In the Request a quote form

 

      • Sending commercial quotes for products and services. (For the performance of a contract or pre-contract, 6.1.b GDPR)
      • Sending commercial advertising communications by email, fax, SMS, MMS, social media, or any other electronic or physical means, present or future, that allows for commercial communications. These communications will be sent by the data controller and will relate to its products and services, or those of its partners or suppliers with whom it has reached a promotional agreement. In this case, third parties will never have access to personal data. (With the data subject’s consent, 6.1.a GDPR)

 

In the online forum form

 

      • Participate in the online forums proposed by the data controller. (with the consent of the data subject, 6.1.a GDPR)

 

In the Curriculum form

 

  • Involving the interested party in the personnel selection processes and analyzing the applicant’s profile with the aim of selecting a candidate for the vacant position of manager. (with the consent of the interested party, 6.1.a GDPR)

 

In the Testimonial form

 

      • Moderate and publish on the website the user’s experiences, opinions and suggestions about a product or service. (by consent of the interested party, 6.1.a GDPR)

 

In the Comments form

 

      • To moderate and publish on the website the opinions about a publication. (with the consent of the interested party, 6.1.a GDPR)

 

In the Ethics or Complaints Channel form

 

      • Properly manage the ethics hotline, processing the corresponding irregularities reported through it, and deciding on the appropriateness of initiating an investigation, in order to detect possible offenses and prevent the imposition of any type of liability, as well as to avoid any type of conduct contrary to the entity’s internal or external regulations. (for compliance with a legal obligation, 6.1.c GDPR)

 

In the user registration form

 

      • To manage the user’s account in order to provide them with personalized access to the website and the interactive services it offers. (with the data subject’s consent, 6.1.a GDPR)

 

In the E-commerce form

 

      • To manage your online purchase or order, process payment, and proceed with shipping or activation, based on the general terms and conditions. (For the performance of a contract or pre-contract, Article 6.1.b GDPR)
      • To manage, maintain, improve, or develop the services provided. (For the performance of a contract or pre-contract, Article 6.1.b GDPR)
      • To conduct satisfaction and quality surveys. (For the legitimate interest of the data controller, Article 6.1.f GDPR)

 

On the Loyalty Card form

 

      • Manage the loyalty card if requested. (Based on the data subject’s consent, Article 6.1.a GDPR)
      • Send commercial and advertising communications by email, fax, SMS, MMS, social media, or any other electronic or physical means, present or future, that allows for commercial communications. These communications will be sent by the data controller and will relate to its products and services, or those of its partners or suppliers with whom it has reached a promotional agreement. In this case, third parties will never have access to personal data. (Based on the data subject’s consent, Article 6.1.a GDPR)
      • Conduct statistical analyses and market research. (Based on the legitimate interest of the data controller, Article 6.1.f GDPR)

 

In the Draws and Promotions form

 

      • Participate in raffles, contests, promotions, or other services offered by the data controller. (with the data subject’s consent, Article 6.1.a GDPR)
      • Send commercial and advertising communications by email, fax, SMS, MMS, social media, or any other electronic or physical means, present or future, that allows for commercial communications. These communications will be sent by the data controller and will relate to its products and services, or those of its partners or suppliers with whom it has reached a promotional agreement. In this case, third parties will never have access to personal data. (with the data subject’s consent, Article 6.1.a GDPR)

 

In the Appointments form

 

      • Schedule appointments and meetings with the person in charge. (for the legitimate interest of the person responsible, art. 6.1.f GDPR)

 

In the Social Networks form

 

      • Contact via Social Media is used to maintain a relationship between the User and the Data Controller, which may include the following operations: – Processing requests and inquiries. – Providing information about activities and events. – Providing information about products and/or services. – Interacting through official profiles. The User has a profile on the same social network and has chosen to join the Data Controller’s social network, thus demonstrating interest in the information published therein. Therefore, by requesting to follow our official page, the User consents to the processing of their data. The User can access the social network’s privacy policies at any time, as well as configure their profile to ensure their privacy. Once the User becomes a follower or has joined the Data Controller’s social network, they may publish comments, links, images, photographs, or any other type of content supported by the platform. In all cases, the User must be the owner of the published content, hold the copyright and intellectual property rights, or have the consent of any affected third parties. – Sending commercial communications relating to the activities of the Group companies, as well as external companies with which commercial collaboration or intermediation agreements have been established. (with the consent of the interested party, 6.1.a GDPR)

 

In the Instant Messaging form

 

      • Scheduling appointments and meetings with the data controller. (Based on the legitimate interest of the data controller, Art. 6.1.f GDPR)
      • Sending commercial and advertising communications by email, fax, SMS, MMS, social media, or any other electronic or physical means, present or future, to clients, enabling commercial communications regarding products or services similar to those initially contracted by the client (Art. 21.2 LSSI). (Based on the legitimate interest of the data controller, Art. 6.1.f GDPR)
      • Managing, maintaining, improving, or developing the services provided. (For the performance of a contract or pre-contract, 6.1.b GDPR)
      • Managing your online purchase or order, processing payment, and proceeding with its shipment or activation, based on the general terms and conditions of sale. (For the performance of a contract or pre-contract, 6.1.b GDPR)
      • Sending commercial quotes for products and services. (For the performance of a contract or pre-contract, Article 6.1.b GDPR)
      • To send commercial advertising communications by email, fax, SMS, MMS, social media, or any other electronic or physical means, present or future, that allows for commercial communications. These communications will be sent by the data controller and will relate to its products and services, or those of its partners or suppliers with whom it has reached a promotional agreement. In this case, third parties will never have access to personal data. (Based on the data subject’s consent, Article 6.1.a GDPR)
      • To respond to inquiries or any type of request made by the user through any of the contact methods available on the data controller’s website. (Based on the legitimate interest of the data controller, Article 6.1.f GDPR)

 

In the Video Surveillance form

 

      • Purpose: Security and access control, labor and internal activity control. Legal basis: Public interest in security and access control and legitimate interest of the Controller based on Art. 20.3 of the Workers’ Statute. Retention: A maximum of 30 days (with the consent of the data subject, 6.1.a GDPR).

 

In the Images and Recordings form

 

      • File containing static and/or dynamic images. Includes publication in the media by the data controller or third parties. (with the consent of the data subject, 6.1.a GDPR)

 

In the Customers and Suppliers form

 

      • Commercial management with clients and suppliers (for the legitimate interest of the controller, art. 6.1.f GDPR)

 

In the Advertising Opt-Out form

 

      • Data management to prevent the sending of commercial communications to those who have expressed their refusal or objection to receiving them. (for compliance with a legal obligation, 6.1.c GDPR)

 

In the Commercial Advertising form

 

      • Advertising management and sales prospecting. Includes data from legitimate, publicly accessible sources. (based on the legitimate interest of the data controller, art. 6.1.f GDPR)

 

In the form for Web, app and other platform users of the responsible party

 

      • Identification data of users accessing the corporate website. (based on the legitimate interest of the data controller, art. 6.1.f GDPR)

 

In the form Training, courses, workshops, activities or similar

 

      • Management of access and usage conditions. (based on the legitimate interest of the controller, art. 6.1.f GDPR)

 

In the Wi-Fi Network Connection form

 

      • Conducting statistical analyses and market research. (based on the legitimate interest of the data controller, Art. 6.1.f GDPR)
      • Conducting satisfaction and quality surveys. (based on the legitimate interest of the data controller, Art. 6.1.f GDPR) (based on the consent of the data subject, Art. 6.1.a GDPR)

 

In the form Legal representatives and contact persons

 

      • If you are a legal representative or contact person for any of the entities or individuals with whom the Foundation interacts, the data controller will process your data to monitor the development of the intended relationship. (with the data subject’s consent, 6.1.a GDPR)

 

In the Telephone Calls form

 

      • To respond to inquiries or any type of request made by the user through any of the contact methods available on the data controller’s website. (based on the legitimate interest of the data controller, art. 6.1.f GDPR)

 

How long will we keep your personal data?

 

Your data will be kept for no longer than necessary to fulfill the purpose of the processing or as required by law. When it is no longer needed, it will be deleted using appropriate security measures to ensure the anonymization of the data or its complete destruction.

 

Who do we share your personal data with?

 

We do not share your personal data with third parties except, if necessary for the development and execution of the purposes of the processing, with our communications service providers, with whom we have signed the confidentiality and data processing agreements required by current privacy regulations.

 

Third-Party Data Provided by the User

 

If the USER provides personal data of third parties for any purpose, they guarantee that they have previously informed the data subjects and obtained their consent to share their data with the Data Controller.

 

The USER guarantees that the data subjects are of legal age and that the information provided is accurate and truthful.

 

The Data Controller may verify the consent of these data subjects through an initial email with non-commercial content requesting confirmation of the consent granted on their behalf by the USER.

 

If the USER is liable for any consequences arising from a breach of these conditions, they shall be responsible for such breach.

 

Do we make international transfers?

 

In accordance with Article 44 of the GDPR, authorization for the international transfer of data to a country not designated as having an adequate level of protection may only be granted if sufficient safeguards are in place. This authorization may be granted if the data controller provides a written contract between the data exporter and importer that includes the necessary safeguards for respecting data protection and guarantees the exercise of data subjects’ rights.

 

The data controller may use services from providers with servers or offices in other locations, and these transfers may therefore take place. For an updated list of providers, please contact the data controller or email susanaranea@gmail.com.

 

What are your rights?

 

The rights you have as a user are:

 

      • Right to withdraw consent at any time.
      • Right to access, rectify, port, erase your data, restrict or object to its processing.
      • Right to lodge a complaint with the supervisory authority (www.aepd.es) if you believe that the processing does not comply with current regulations.

 

Contact information to exercise your rights:

 

Susana Ranea Arroyo. Camí de la Vileta, 30 – 07011 Palma (Balearic Islands). Email: susanaranea@gmail.com

 

2. MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE USER

 

By checking the corresponding boxes and entering data in the fields marked with an asterisk (*) on the contact form or download forms, users expressly and freely and unequivocally accept that their data is necessary for the provider to process their request. Providing data in the remaining fields is voluntary. The user guarantees that the personal data provided to the data controller is accurate and is responsible for communicating any changes to it.

 

The data controller informs users that all data requested through the website is mandatory, as it is necessary to provide optimal service. If all the data is not provided, the provider cannot guarantee that the information and services provided will be fully tailored to the user’s needs.

 

If you provide us with personal data of other individuals through any means, the data controller advises that you must do so with their consent and after having informed them beforehand of the information contained in this Privacy Policy. Furthermore, the data controller undertakes to provide any third party whose data you provide us with the relevant information, in accordance with Article 14 of the General Data Protection Regulation (GDPR).

 

3. SECURITY MEASURES

 

In accordance with current regulations on personal data protection, the data controller is complying with all provisions of the GDPR and the Spanish Data Protection Act (LOPDGDD) for the processing of personal data under its responsibility, and specifically with the principles described in Article 5 of the GDPR, whereby data is processed lawfully, fairly, and transparently in relation to the data subject, and is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

 

The data controller guarantees that it has implemented appropriate technical and organizational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of users and has provided them with the necessary information to exercise those rights.

 

INTERNATIONAL DATA TRANSFERS

 

In the course of providing its services, some of the suppliers used by the data controller may be located outside the European Economic Area (EEA) or may process data from third countries.

 

In such cases, the data controller guarantees that these international data transfers are carried out in compliance with Regulation (EU) 2016/679 (GDPR), applying appropriate safeguards for the protection of personal data, such as the formalization of Standard Contractual Clauses approved by the European Commission, the existence of adequacy decisions by the European Commission, or other legal safeguards recognized by applicable regulations.

 

Users can request additional information on the specific safeguards applied to each international transfer by contacting the data controller at susanaranea@gmail.com.

 

For more information on privacy safeguards, you can contact the data controller through Susana Ranea Arroyo. CamÍ de la Vileta, 30 – 07011 Palma (Balearic Islands). Email: susanaranea@gmail.com

 

4. VALIDITY

 

This privacy policy is effective as of 06/03/2026

 

The person responsible reserves the right to modify this policy to adapt it to future legislative or jurisprudential updates that may be applicable, or for other technical, operational, commercial, corporate, etc. reasons. If, as a result of the changes, the rights of users are affected, the person responsible undertakes to inform about the reasons.

0
    0
    Cart
    LA CESTA ESTÁ VACIAVOLVER A LA TIENDA
    CONTINUE SHOPPING