This privacy policy is in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of the 27th of April, 2016, concerning the protection of natural persons with regard to the processing of personal data and free movement of these data (RGPD), to Organic Law 3/2018, of the 5th of December, Protection of Personal Data and digital rights guarantee (LOPDGDD), as well as in what is not contrary to the regulations indicated, to the Law Organic 15/1999, Protection of Personal Data (LOPD) and its development regulations, and/or those that could replace or update in the future.
Our organisation is committed to the privacy of your personal data. The personal data provided are necessary to provide our services and are processed in a lawful, fair and transparent way, ensuring adequate security of them, including protection against unauthorised or illegal processing and against loss, destruction or accidental damage through the application of technical and organisational measures.
In this document we want to offer you, in a transparent and loyal way, all the necessary information related to the processing of your personal data that this organisation makes.
1.- RESPONSIBLE FOR THE PROCESSING
Identity: A GRATACOS, S.A.U.
V.A.T.: ESA08203259
Registered Office: Cl Modesto lafuente 35, 1Pta D, 28003 Madrid (Spain)
Legal address: Cl Còrsega 381-387, 2º 1ª, 08037 Barcelona (Spain)
Phone: (+34) 932 387 470
E-mail: shop@gratacos.com
2.- RECIPIENTS OF THE PERSONAL DATA
- The personal data provided shall not be subject to any transfer unless it is stated specifically in the specific processes.
- Optionally, for the contracting of computing cloud services and/or services for the sending of emails, as well as related services, the personal data can be:
- Transferred to businesses for digital services located within the European Economic Area (EEA) or,
- Transferred to businesses for digital services located outside the EEA under the protection of the Privacy Shield as they count on means of protection sufficient to guarantee the security of personal data. More information available following this link: https://www.privacyshield.gov/welcome
- Optionally, to administrations and other organizations when they are required in compliance with legal obligations.
3.- LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
In each case of processing of personal data collected concerning yourself, we will inform you of the legal basis that legitimizes the processing of your personal data.
4.- RIGHTS
Right to Access
The right to obtain confirmation of whether or not we are processing personal data concerning you, or not, and, in such case, right of access to personal data and the following information: the purposes of the processing, the categories of personal data in question, the recipients or the categories of recipients to whom the data were communicated or will be communicated. personal, period of conservation or the criteria used to determine this term, the existence of the right to request from the responsible the rectification or suppression of personal data or the limitation of the processing of personal data relative to the interested party or to oppose such processing, the right to present a claim before the Spanish Agency for Data Protection (AEPD), the existence, where appropriate, of automated decisions, including the preparation of profiles, when data is transferred to third countries the right to be informed of the appropriate guarantees applied.
Right to Rectification
You have the right to request the rectification of your personal data if these are inaccurate, including the right to complete data that is incomplete. We must bear in mind that providing personal data by any means, guarantees that they are true and accurate and agrees to notify us of any change or modification thereof. Therefore, any damage caused due to communication of erroneous, inaccurate, or incomplete information in the forms of the web, will be the exclusive responsibility of the interested party.
Right to Suppression
It is the right to request the suppression of your personal data when, among other assumptions, they are no longer necessary for the purpose for which they were collected, or they are being processed differently or you withdraw the consent. It must be borne in mind that the suppression will not proceed when the processing of personal data is necessary, among other assumptions, for compliance with legal obligations or for the formulation, exercise, or defense of claims.
Right to Limitation
You have the right to request that we limit our processing of your personal data, which means that in certain cases you can ask us to temporarily suspend the processing of your personal data or that we keep them beyond the necessary time when you may need it.
Right to Withdraw Consent
It is the right to withdraw the consent you have provided by checking "I have read and accepted the privacy policy" at any time and as specified in the corresponding section "Exercise of rights" or in the specific processing of commercial communications or Newsletter. It must be borne in mind that this right will not be effective if, among other cases, the processing of personal data is necessary for the fulfillment of a legal obligation, the execution, and maintenance of a contractual relationship, or for the formulation, exercise, or the defense of claims. Likewise, the withdrawal of consent will not have retroactive effects, it will not affect the legality of the processing based on the consent prior to its withdrawal.
Right to Portability
It is the right to receive the personal data that concern you and that you have given us, in a structured format, of common use and mechanical reading, and to transmit them to another responsible, as long as the processing is based on your consent and is carried out by automated or computerized media.
Right to Opposition
You have the right to oppose the processing of your personal data on the basis of your own legitimate interests. We will not continue processing the personal data unless we can show a compelling legitimate motive for this which overrules your interests, rights, and liberties, either for the formulation, the exercising or defense of grievances.
Right to File a Claim with a Control Authority
If you suspect that we are processing your personal data incorrectly, you can contact us or you also have the right to file a claim with the Spanish Data Protection Agency (AEPD):
https://www.agpd.es/portalwebAGPD/index-ides-idphp.php
Exercising of these Rights
You can exercise your rights by letter to the postal address indicated above or by e-mail shop@gratacos.com, attaching, in both cases, a copy of your NIF/NIE/Passport or similar document.
5.- PERSONAL DATA PROCESSING.
General Provisions
The personal data requested in each of the specific processings are adequate, pertinent, and limited to what is necessary for relation to the purposes for which they are processed, thus complying with the principle of data minimization.
The personal data requested in each of the specific processings are strictly necessary, the refusal to provide them would imply not being able to provide the requested service.
The communications of the personal data provided in each of the specific processings in some cases are necessary for the execution and maintenance of a contract and in other cases for compliance with a legal obligation applicable to the responsible.
Contact Form
Personal data will be processed to channel requests for information, suggestions, and complaints from users or customers.
The legal basis that legitimates the processing of personal data is the express consent when marking "I have read and accepted the privacy policy".
The personal data will be kept for a period of two years from the moment they stop being processed, without prejudice to the exercise of the rights that assist them as interested.
Electronic Commerce Form (e-commerce)
Personal data will be processed to manage your online purchases by processing your orders and returns via our online services, send notifications about the status of the delivery or in case of problems with the shipment of items, manage your payments, complaints, or questions about the guarantee of the products or services, identify and validate their legal age to hire, as well as for and, if applicable, the formulation, exercise or defense of claims
The legal basis that legitimates the processing of personal data is the express consent when marking "I have read and accepted the privacy policy".
Personal data will be transferred to the transport company to be able to get the order to your home, as well as, payment service providers.
The personal data will be kept, as long as, the consent is not withdrawn unless it should be kept for the maintenance of the relationship between the parties or during the years necessary for compliance with legal obligations.
Commercial Communications Form or Newsletter
Personal data will be processed to manage the subscription to our Newsletter, including the sending of personalized information, or not, about our products or services by different means such as telephone, email, or SMS. It must be borne in mind that this type of data processing may involve the analysis of your user profile to determine what your preferences are and thus be able to provide you with information that best suits your interests.
You can request the withdrawal for this type of processing, depending on the means used, as follows:
The legal basis that legitimates the processing of personal data is the express consent when marking "I have read and accepted the privacy policy".
It must be borne in mind that if the mean used is WhatsApp, personal data will be transferred to WhatsApp Ireland Limited which is located within the EEA.
Personal data will be kept as long as you do not withdraw the consent according to the form indicated in this section.