1. DATA CONTROLLER

Who is responsible for your data?

• Owner : ACEITES ECHINAC SA (hereinafter the COMPANY)
• CIF : A 18047266
• Registered office : Polig. Industrial La Marcoba, block 5, Parc 7/8 – 18500 GUADIX (GRANADA)
• Public Registry :
• Contact phone number : +34 958 66 05 29

Data Protection Officer (hereinafter, “DPO” ):

Email: info@aceites-echinac.com

Web: www.aceites-echinac.com

1. PURPOSE OF DATA PROCESSING AND CATEGORIES OF DATA PROCESSED

What categories of data do we process?

Depending on the platform, the following data categories are processed:

• Identifying information: name, surname, postal address, email address, postal code, telephone.
• Academic and professional data: education/qualifications, student history, professional experience, membership in professional colleges or associations, in the case of selection processes.
• User identification codes or keys.
• Traffic and location data.
• Electronic communications metadata.
• Commercial information data.
• Economic, or financial, banking data

The personal data requested is mandatory, so refusal to provide it will make it impossible to carry out the provision of the contracted services.

If the user provides data belonging to third parties, they represent that they have the consent of those parties and undertake to provide them with the information contained in this clause, thereby releasing THE COMPANY from any liability in this regard. However, THE COMPANY may carry out checks to verify this fact, adopting the appropriate due diligence measures in accordance with data protection regulations.

Data that appears marked with an asterisk (*) in the forms provided by THE COMPANY through the Platform will be necessary to fulfill the established contractual or legal purpose.

Therefore, if the user does not provide them, it will not be possible to register them on the Platform or process their request.

For what purpose and for how long will we process your personal data?

The COMPANY will process the user’s data, manually and/or automatically, for the following specific purposes:

• Manage your registration as a user on the online platform owned by THE COMPANY (hereinafter, the “Platform” ). However, in all cases, the user must verify and validate their registration on the Platform by entering their username and password through consent.
• Manage the contracting of products and/or services that you make through the Platform, as well as the corresponding billing and delivery.
• To periodically send (via email, post and/or SMS) electronic communications with offers, promotions and news related to our online Platform, unless otherwise indicated or the user objects or revokes their consent.
• To periodically send commercial and/or promotional information related to the sector of products and services contracted through the Platform and of added value for end users, unless otherwise indicated or the user objects or revokes their consent.
• To produce anonymous statistical reports regarding access habits and activity carried out by users on the Platform.
• To create a commercial profile of the user and carry out commercial actions tailored to it, using their data derived from the management of the products purchased (browsing data, access habits, traffic), unless otherwise indicated or the user objects or revokes their consent.
• Only if the user has checked the corresponding box will THE COMPANY be able to create a commercial profile using information provided by third parties and offer products and services tailored to their interests, as well as improve their user experience. This may involve making automated decisions based on their preferences or personal interests, reliability or behavior, purchased products, etc. Based on the above, THE COMPANY may make specific offers and send marketing communications tailored to their profile. In any case, the user may object to or revoke their consent at any time.
• If you submit your CV or apply for any of our job openings, we will process your data to evaluate and manage your application and, if applicable, carry out the necessary steps for the selection and hiring of personnel, in order to offer you positions that match your profile. Unless otherwise indicated, providing the requested data is mandatory, and failure to do so will prevent the continuation of the selection process.
• To comply with legally established obligations, as well as to verify compliance with contractual obligations, including the prevention of fraud.

How long do we keep your data?

The Company will retain users’ personal data only for as long as necessary to fulfill the purposes for which it was collected, unless the user revokes their consent. Subsequently, if necessary, the information will be kept blocked for the legally established periods, in any case, a period of 5 years, or the period established by law for any action that may arise from the processing.

The data you provide regarding job offers you wish to subscribe to will be kept for 5 years from the date of the last update. After this period, if the data has not been updated, it will be deleted unless you instruct us otherwise.

What security measures do we implement to protect your data?

The COMPANY, in order to protect the different types of data reflected in this privacy policy, will carry out the necessary technical security measures to prevent their loss, manipulation, dissemination or alteration.

• Encryption of communications between the user’s device and the COMPANY’s servers
• Encryption of information on the COMPANY’s own servers
• Other measures to prevent third-party access to user data

In those cases where THE COMPANY has service providers for the maintenance of the platform that are located outside the European Union, these international transfers are regulated in accordance with THE COMPANY’s commitment to the protection, integrity and security of customers’ personal data.

III. LEGITIMACY

What is the legal basis for processing your data?

The legal basis for the processing of user data by THE COMPANY to carry out the registration and enrollment of the user on the Platform is found in the consent of the interested party , requested for the specific case.

For its part, the management of the contracting of products or services through the Platform, payment, invoicing and corresponding shipments, is legitimized by the execution of the contract itself .

The processing of data for the purpose of sending electronic newsletters with offers, promotions and news related to our Platform, commercial and/or promotional information, the preparation of anonymous statistical reports regarding access habits and activity carried out by users on the website and the preparation of commercial profiles using data derived from the management of products and services contracted with THE COMPANY, are based on the legitimate interest of THE COMPANY to carry out such processing in accordance with current regulations.

The consents obtained for the aforementioned purposes are independent, so the user may revoke one or more of them without affecting the others.

User information may also be used for the fulfillment of the COMPANY’s various legal obligations.

In the case of applications for published job offers, your data will be processed based on your consent, which you may withdraw at any time. However, withdrawing your consent would mean that your application could not be considered in our recruitment processes. Nevertheless, withdrawing your consent will not affect the lawfulness of any processing carried out beforehand.

1. DATA COMMUNICATIONS

To whom will your data be communicated?

• The State Security Forces and Corps by virtue of the provisions of the Law.
• Banks and financial institutions for the collection of payments for services offered.

1. OTHER DATA WE PROCESS

As part of THE COMPANY’s commitment to privacy and data protection, we inform you of other data processing activities that may be carried out in the context of customer relations, specifically in relation to telephone support services.

In this regard, THE COMPANY will process your data to improve the quality of our services, manage your request, and provide you with the requested services, if applicable. If you wish, you can contact us using the telephone numbers provided for this purpose. The legal basis for processing your data will be the adoption of pre-contractual measures or the performance of the contractual relationship itself, as well as, in certain cases, your consent.

The processing of call recording data is based on the legitimate interests of THE COMPANY and, in particular, on the need to detect and improve the service provided through the telephone channel. Data processing is also used to address your requests.

We also inform you that our stores have a system in place, operated by THE COMPANY, whose function is to guarantee the safety of people and facilities. We remind you that current regulations legitimize the processing of your data based on THE COMPANY’s legitimate interest in ensuring the security of the facilities, and therefore your image may be recorded simply by entering the building.

This information may be shared with law enforcement agencies if necessary. The images will be stored for a maximum of one (1) month from the date they are captured.

1. USER RIGHTS

What rights does the interested party have?

You can send us a letter to JOSE MARTIN GARCIA at Avda. Buenos Aires, 48, 18500 GUADIX (GRANADA). At any time and free of charge, you have the following rights:

• Revoke the consents given.
• Obtain confirmation as to whether or not THE COMPANY is processing personal data concerning you.
• Access your personal data.
• Correct inaccurate or incomplete data.
• Request the deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Obtain from THE COMPANY the limitation of the processing of data when any of the conditions provided for in the data protection regulations are met.
• In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. The company will cease processing the data, except for compelling legitimate grounds, or for the establishment, exercise, or defense of legal claims.
• To obtain human intervention, to express their point of view and to challenge automated decisions made by THE COMPANY, if applicable.
• Request the portability of your data.
• To file a complaint with the Spanish Data Protection Agency ( agpd.es ) when the interested party considers that THE COMPANY has violated the rights recognized by the applicable data protection regulations.