Privacy policy

1. Data controller

Full legal name

José Antonio Vilumbrales Hernando

Spanish tax ID

13038911G

Address

C/ Vitoria 57 – Ground floor, 09004 Burgos, Spain

Email

hiedraregalos@gmail.com

Website

www.hiedraregalos.com

2. Applicable legislation

Our Privacy Policy has been drafted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), together with Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights and its implementing legislation.

The organisation may amend this privacy policy to reflect legislative or case-law developments or interpretations issued by the Spanish Data Protection Agency. These privacy terms may be supplemented by the Legal Notice, Cookie Policy and any General Terms governing the sale of particular products or services where access to them involves specific personal-data protection requirements.

3. Purposes of processing personal data

We process personal data for the following purposes:

1. To manage requests submitted through the contact form.
2. To perform a sales contract concluded through the website purchase form.
3. To send commercial information on the basis of a prior contractual relationship.

4. Legal basis for processing

1. Contact form: the legal basis is the User's express consent when providing the information, indicated by selecting the relevant acceptance box.
2. Purchase form: the legal basis is performance of the sales contract.
3. Commercial communications: the legal basis is our legitimate interest arising from a prior contractual relationship.

5. How long will we retain your data?

1. Contact form: personal data will be retained from the time consent is given until it is withdrawn or restriction of processing is requested. In those cases, the data will be blocked for the periods required by law.
2. Purchase form: personal data will be retained for as long as necessary to comply with the legal obligations arising from the sales process.
3. Commercial communications: personal data will be retained for this purpose until the data subject objects to the processing.

6. Disclosure of data

Your data will not be disclosed except:

• Where required to comply with legal obligations.
• To transport companies for the delivery of an order.

7. International transfers

No international data transfers will be carried out.

8. Security measures

As part of our commitment to ensuring the security and confidentiality of personal data, we have adopted the technical and organisational measures necessary to safeguard it and prevent unauthorised alteration, loss, processing or access, taking into account the state of technology, the nature of the stored data and the risks to which it is exposed. Users should nevertheless be aware that security measures on the Internet are not impregnable.

Further information about the security measures we apply may be obtained by contacting us through the channels listed at the beginning of this Privacy Policy in the section identifying the Data Controller.

9. Rights of the data subject

Data subjects have the following rights concerning the processing of their personal data and may exercise them by contacting the Data Controller:

• Where processing is based on consent, the right to withdraw that consent at any time, without affecting processing carried out before its withdrawal.
• The right to request access to personal data.
• The right to request rectification of inaccurate data or erasure where, for example, the data is no longer necessary for the purposes for which it was collected.
• The right to request restriction of processing where any of the statutory conditions is met, in which case the data will be retained solely for the establishment, exercise or defence of legal claims.
• The right to object to processing, including the sending of commercial information, in which case we will cease processing for that purpose unless compelling legitimate grounds exist or processing is necessary for the establishment, exercise or defence of legal claims.
• The right to data portability.
• The right to lodge a complaint with the Spanish Data Protection Agency, the competent data-protection supervisory authority, particularly where the exercise of rights has not been satisfactorily addressed: www.aepd.es.