This privacy policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and, where not contrary to the aforementioned regulations, with Organic Law 15/1999 on the Protection of Personal Data (LOPD) and its implementing regulations, and/or any future legislation that may replace or update them.
Our organization is committed to the privacy of your personal data. The personal data you provide is necessary for us to provide our services and is processed lawfully, fairly, and transparently, ensuring its adequate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage through the application of technical and organizational measures.
Through this document we want to offer you, in a transparent and fair manner, all the necessary information regarding the processing of your personal data by this organization.
I.-Controller of the processing
- Identity : Mengual Hats, SL
- CIF / NIF : B03691680
- ADDRESS : AVDA. LA PAU, 11, 03740 GATA DE GORGOS (ALICANTE)
- TELEPHONE : 965756007
- E-MAIL : Gestión@sombrerosmengual.es
- DATA PROTECTION OFFICER : gerencia@sombrerosmengual.es
II.-Recipients of personal data
- The personal data provided will not be transferred to any third party unless otherwise specified in the specific processing activities.
- Optionally, for the contracting of cloud computing services and/or services for sending emails, communication, as well as other related computer services, the personal data may be:
- Transferred to IT service companies located within the European Economic Area (EEA) or,
- Your data has been transferred to IT service providers located outside the EEA that are certified under the Privacy Shield framework. These providers have adequate safeguards in place to ensure the security of your personal data. You can find more information by visiting this link: https://www.privacyshield.gov/welcome
- Optionally, to administrations and other bodies when required in compliance with legal obligations.
III.-LEGAL BASIS THAT LEGITIMIZES THE PROCESSING OF PERSONAL DATA
In each specific processing of personal data, we will inform you of the legal basis that legitimizes it.
IV.-Rights
Right of access
It is the right to obtain from the controller confirmation as to whether or not they are processing personal data concerning the data subject and, where that is the case, the right of access to the personal data and the following information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the period for which the personal data will be stored or the criteria used to determine that period, the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing, the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the existence, where applicable, of automated decision-making, including profiling, where data are transferred to third countries, and the right to be informed of the appropriate safeguards applied.
Right of rectification
You have the right to request the correction of your personal data if it is inaccurate, including the right to complete any incomplete information. Please note that by providing us with your personal data through any means, you guarantee that it is true and accurate and agree to notify us of any changes or modifications to it. Therefore, any damage caused by the communication of erroneous, inaccurate, or incomplete information in the website forms will be the sole responsibility of the data subject.
Right of erasure
It is the right to request the deletion of your personal data when, among other circumstances, they are no longer necessary for the purpose for which they were collected, or are being processed in another way, or you withdraw your consent. It should be noted that deletion will not be permitted when the processing of personal data is necessary, among other cases, for compliance with legal obligations or for the formulation, exercise or defense of claims.
Right to limitation
It is the right to request the limitation of the processing of your personal data, which means that in certain cases you can ask us to temporarily suspend the processing of your personal data or to keep it beyond the necessary time when you may need it.
Right to withdraw consent
This is the right to withdraw the consent you provided by checking “I have read and agree to the privacy policy” at any time, as specified in the corresponding “Exercise of Rights” section or in the specific processing of commercial communications or newsletters. Please note that this right will not apply if, among other cases, the processing of personal data is necessary for compliance with a legal obligation, the performance and maintenance of a contract, or for the establishment, exercise, or defense of legal claims. Furthermore, the withdrawal of consent will not have retroactive effect; that is, it will not affect the lawfulness of processing based on consent before its withdrawal.
Right to portability
It is the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format, and to transmit it to another controller, provided that: the processing is based on your consent and is carried out by automated or computer means.
Right to object
This is your right to object to the processing of your personal data based on our legitimate interest. We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.
Right to lodge a complaint with a supervisory authority
If you believe that we are processing your personal data incorrectly, you can contact us or you also have the right to file a complaint with the Spanish Data Protection Agency (AEPD):
https://www.agpd.es/portalwebAGPD/index-ides-idphp.php
Exercise of rights
You can exercise your rights by sending a letter to the postal address indicated above or by sending an email to gerencia@sombrerosmengual.es , attaching in both cases a copy of your NIF/NIE/Passport or similar document.
V.-Processing of personal data
Generic provisions
The personal data requested in each of the specific processing activities are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, thus complying with the principle of data minimization.
The personal data requested in each of the specific processing activities are strictly necessary; refusal to provide them would mean that the requested service cannot be provided.
The communication of personal data provided for in each of the specific processing activities is in some cases necessary for the execution and maintenance of a contract and in other cases for compliance with a legal obligation applicable to the data controller.
DIGITAL ASSISTANT – “CHATBOT” or “ONLINE CHAT”
In the event that this website uses online chat software, provided as a self-service feature to facilitate a timely and appropriate response to frequently asked questions and to improve customer service for the benefit of website visitors, the following data will be processed during the conversation with the “chat bot”: IP address and other personal data entered into the chat bot's conversation function.
The data collected will not be used to personally identify the website visitor, and will not be merged with personal data about the bearer of the pseudonym, unless personal data is voluntarily provided when using the online chat.
The legal basis for this processing is set out in Article 6, paragraph 1, letter f) of the GDPR.
Contact form
Personal data will be processed to handle requests for information, suggestions, and complaints from users or customers.
The legal basis that legitimizes the processing of personal data is the express consent given by checking “I have read and agree to the privacy policy.”
Personal data will be kept for a period of two years from the moment it ceases to be processed, without prejudice to the exercise of the rights you have as an interested party.
Electronic commerce (E-commerce) form
Personal data will be processed to manage your online purchases by processing your orders and returns through our online services, sending you notifications about the delivery status or in case of problems with the shipment of items, managing your payments, handling any complaints or issues regarding the warranty of products or services, identifying you and validating your legal age to contract, as well as for, where applicable, the formulation, exercise or defense of claims
The legal basis that legitimizes the processing of personal data is the express consent by checking “I have read and accept the privacy policy” .
Personal data will be shared with the transport company in order to deliver your order to your home, as well as with payment service providers.
Personal data will be kept until you withdraw your consent, unless it needs to be kept for the maintenance of the relationship between the parties or for the years necessary for compliance with legal obligations.
Commercial Communications or Newsletter Form
Your personal data will be processed to manage your subscription to our newsletter, including sending you personalized or non-personalized information about our products or services through various means such as telephone, email, SMS, mobile applications, and any similar method. Please note that this type of data processing may involve analyzing your user profile to determine your preferences and provide you with information more relevant to your interests.
You can request to stop receiving this type of treatment, depending on the method used, as follows:
- Email: Through the link provided in each electronic communication or through an analogous procedure specified in the commercial communication.
- WhatsApp (other apps): Requesting to cancel the subscription.
- SMS: Requesting cancellation of subscription.
The legal basis that legitimizes the processing of personal data is the express consent given: by checking “ I have read and accept the privacy policy” on the website, through a physical document or through email, depending on the case.
It should be noted that if the medium used is WhatsApp, personal data will be transferred to WhatsApp Ireland Limited, which is located within the EEA.
Personal data will be kept until you withdraw your consent in the manner indicated in this section.