This policy expresses, in detail, how your personal data and the information you provide to LIDIA SÁNCHEZ-BRUNETE are treated, in order to protect your privacy in accordance with the provisions of Regulation (EU) 2016/679, General Data Protection Regulation – hereinafter, GDPR- and Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights – hereinafter, LOPD-GDD-.
- ACCEPTANCE AND CONSENT
By accepting this Privacy Policy, you give your express, informed, free and unequivocal consent for the Data you provide, and to which the technical and organisational security measures provided for in current legislation are applied, to be processed by LIDIA SÁNCHEZ-BRUNETE as data controller. Likewise, by providing your data through electronic channels, you guarantee that you are over 14 years of age and that the data provided are true, accurate, complete and up to date. To this effect, you confirm that you are responsible for the veracity of the data communicated and that you will keep this information suitably updated so that it corresponds to your real situation, and that you are responsible for any false or inaccurate data that you may provide, as well as for any direct or indirect damages that may arise. - WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?
Owner: Lidia Sánchez-Brunete Guillermo, hereinafter LIDIA SÁNCHEZ-BRUNETE
ID: 50907473D
Address: Plaza de España 6 45870 Lillo (Toledo)
E-mail: [email protected]
Website: www.ovillova.com
3. WHAT PERSONAL DATA IS COLLECTED ON THIS WEBSITE?
In accordance with the RGPD, only data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is held, which in turn must be: determined, explicit and legitimate (information on these purposes is provided below), may be processed.
LIDIA SÁNCHEZ-BRUNETE collects and processes the personal data detailed below, the collection of which will depend on the different services requested on this website:
Identification data: name, surname.
Contact details: postal address, email address, mobile phone number.
Contractual and billing data: data on contractual operations, ID number, services purchased, payment data.
Navigation data: IP address, type and identification of the device, type of browser, domain through which you access the Website, navigation data, activity on the Website. To find out clearly and precisely what cookies we use, you can consult the Cookies Policy.
4. HOW DO WE COLLECT THIS PERSONAL DATA? CAPTURE SYSTEMS
LIDIA SÁNCHEZ-BRUNETE collects your personal information through different forms (subscription, comments and purchase forms), but you will always be informed at the time of collection, by means of informative clauses about the data controller, the purpose and legal basis of the processing, the recipients of the data and the period of conservation of your information, as well as the way in which you can exercise your rights in terms of data protection.
In any case, in the following sections, reference is made to these elements.
In addition, LIDIA SÁNCHEZ-BRUNETE uses social networks to reach you and interact with you. The information collected through the messages and communications you post may contain personal information that is available online and accessible to the public. These social networks have their own privacy policies explaining how they use and share your information, so we encourage you to review them before using them to confirm that you are comfortable with how your information is collected, processed and shared.
Through this website, LIDIA SÁNCHEZ-BRUNETE collects personal information related to your browsing through the use of cookies. To find out clearly and precisely what cookies I use, what their purposes are and how you can configure or disable them, please consult the Cookies Policy.
- FOR WHAT PURPOSES WILL WE PROCESS YOUR DATA?
After telling you what data is collected and through which means of capture, I will detail the purpose for which this information is used.
Firstly, this website has different forms. In each of them, the information collected will be used in the following way:
Subscription forms for free resources: there are several forms to send you the free content indicated in each of them (usually guides or tools to help you knit our yarns). In this case, the data requested will be your name and email address, and will be used to send you the resource in question, as well as recommendations, news, discounts or other commercial communications, through my Newsletter.
Subscription forms to my Newsletter: where the name and e-mail address will be provided. This data will be used exclusively to send you the Newsletter and keep you updated on news and special offers, exclusively for subscribers to www.ovillova.com.
Comment forms, to be able to comment on the posts published on the blog. The personal data entered will be name, email and website (the latter is optional). These comments will be used exclusively to moderate and publish them.
Sales form: I also process data to manage the purchase of my wool and knitting or weaving-related products, including the management of the order, payment and all operations related to the contracting of the chosen product and/or service. This includes sending follow-up e-mails, replies, invoices, receipts, etc. The data requested will be name, surname, address, email, telephone and payment details.
Whatsapp: In addition, you can also contact me via Whatsapp, so I will treat as personal data your name, phone number and any other information you consider sharing with me. In this case, the purpose will only be to respond to your specific request or query; such data will not be used for any other purpose.
- ON WHAT LEGAL BASIS IS THIS DATA PROCESSED?
LIDIA SÁNCHEZ-BRUNETE processes your personal data on the following legal bases:
The execution of a contract with LIDIA SÁNCHEZ-BRUNETE, for the contracting and management of products and/or services.
The application of pre-contractual measures, to attend to your request for information or to send you commercial information that refers to products or services similar to those that were the object of the contract; as well as to manage your reservation for certain products and/or services that have this option enabled.
The user’s consent in relation to contact via whatsapp, subscription to content, blog comments and the sending of commercial communications (including the Newsletter); either via email, cookies or messaging systems.
The legitimate interest of the data controller to be able to offer the customer service requested (in case of requesting information or resolution of doubts or questions via Whatsapp or mail), and to protect users of the website www.ovillova.com from abuse and fraud in the use of my services.
- HOW LONG WILL THE DATA BE KEPT?
LIDIA SÁNCHEZ-BRUNETE will only keep your information for the period of time necessary to fulfil the purpose for which it was collected, to comply with the legal obligations imposed on us and to meet any possible liabilities that may arise from the fulfilment of the purpose for which the data was collected.
Specifically, the following terms are established according to the type of data in question:
Customer Data: As a general rule, I will keep your personal information for as long as there is a contractual relationship linking us or you do not exercise your right to erasure and/or limitation of processing.
In any case, the information will be blocked without being used beyond its conservation, and only as long as it may be necessary for the exercise or defence of claims or may derive some kind of legal responsibility that has to be attended to. The most common legal time limits are:
- 4 years: Law on Infringements and Penalties in the Social Order (obligations regarding affiliation, registrations, cancellations, contributions, payment of salaries, etc.); Arts. 66 et seq. Ley General Tributaria (accounting books…).
- 5 years: Art. 1964 of the Civil Code (personal actions without special time limit).
- 6 years: Art. 30 of the Commercial Code (accounting books, invoices…).
- 10 years: Art. 25 of the Law on the Prevention of Money Laundering and Financing of Terrorism.
Subscriber data: From the time the user subscribes until the user unsubscribes.
Data of potential customers who are not subscribers: the data will be kept in any case for the duration of the commercial relationship established and, once concluded, for two years, and will be deleted after this period if a contractual relationship has not been formalised or at the time of your request.
- WHAT ARE YOUR RIGHTS IN RELATION TO THE USE OF YOUR DATA? HOW CAN YOU EXERCISE THEM?
The Law grants you a series of rights as the owner of the personal data processed by LIDIA SÁNCHEZ-BRUNETE, which are as follows:
Right of access to your personal data.
The right to request the rectification of inaccurate data.
The right to request deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
The right to request the limitation of the processing of your data, in which case LIDIA SÁNCHEZ-BRUNETE will only keep them for the exercise or defence of claims.
The right to oppose the processing of your data.
The right to request the portability of your personal data to another data controller when technically possible.
The right not to be subject to automated individual decisions.
You also have the option to unsubscribe from any of the subscription services provided by clicking on the unsubscribe section in the newsletters sent by LIDIA SÁNCHEZ-BRUNETE.
These rights are characterised by the following:
Their exercise is free of charge, except in the case of manifestly unfounded or excessive requests (e.g. repetitive nature), in which case I may charge a fee proportional to the administrative costs incurred or refuse to act.
You can exercise your rights directly or through your legal representative or volunteer.
I must respond to your request within one month, although, taking into account the complexity and number of requests, the deadline may be extended by a further two months.
I am obliged to inform you about the means of exercising these rights, which must be accessible and without being able to refuse you the exercise of the right on the sole ground that you choose another means. If the request is made by electronic means, the information will be provided by electronic means where possible, unless you ask me to do otherwise.
If I do not comply with the request, I will inform you, at the latest within one month, of the reasons for my failure to act and of the possibility to complain to a supervisory authority.
In order to facilitate the exercise of these rights, I provide you with the link to the website of the Spanish Data Protection Agency where you can find additional information, as well as links to the application form for each of the rights: https://www.aepd.es/es/derechos-y-deberes/conoce-tus-derechos
Likewise, the consent given, both for the processing and for the transfer of the data of the interested parties, may be revoked at any time by notifying LIDIA SÁNCHEZ-BRUNETE in the terms established in this section. This revocation shall in no case be retroactive.
To exercise your rights, LIDIA SÁNCHEZ-BRUNETE offers you the following means:
- by written and signed request addressed to LIDIA SÁNCHEZ-BRUNETE, Plaza de España 6 45870 Lillo (Toledo), indicating as Ref. Ejercicio de Derechos LOPD.
- By sending a scanned and signed form to the e-mail address [email protected], indicating Exercise of LOPD Rights as the subject.
In both cases, you must prove your identity by attaching a copy of your ID card or equivalent document, in order to verify that I am only replying to the interested party. If you submit your request through a legal representative, you must also provide proof of representation.
Likewise, and especially if you consider that you have not obtained full satisfaction in the exercise of your rights, I inform you that you may lodge a complaint with the national supervisory authority by contacting the Spanish Data Protection Agency, C/ Jorge Juan, 6 – 28001 Madrid.
9. TO WHICH RECIPIENTS WILL YOUR DATA BE DISCLOSED?
In general, I do not share your personal information, except for those transfers that must be made on the basis of legally imposed obligations. In the event of transfer to a third party, you will be informed beforehand and your consent will be requested.
Although this is not a transfer of data per se, in order to provide you with the requested service, third party companies, acting as my suppliers, may access your information to carry out the service I have contracted with them (e.g. web development and maintenance company, hosting company, payment processing services, order processing, analytics, marketing campaign management, website management, and email distribution and other similar service providers). They access your data on my instructions and may not use it for any other purpose and will keep it strictly confidential.
Likewise, your personal information will be at the disposal of the Public Administrations, Judges and Courts, for the attention of possible responsibilities arising from the processing.
In compliance with the principles of information and transparency, I hereby inform you of the third parties that may access your data as data processors:
Automattic Inc,: provides the WordPress.com web platform, the data controller for Europe being Aut O’Mattic A8C Ireland Ltd, located at Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland. Here you have access to their privacy policy: https://automattic.com/privacy/
Raiola Networks, SL: provides web hosting and email. It is a Spanish company with C.I.F.: B27453489 and domiciled at Avda. de Magoi, 66, SS, Dcha., C.P. 27002 Lugo (Lugo), duly registered in the Lugo Mercantile Register in Volume 460, Folio 183, Page LU-17.342. Here you have access to its privacy policy: https://raiolanetworks.es/politica-de-privacidad/.
Gmail: is an email service. This service is provided by Google LLC, whose data controller in the European Economic Area and Switzerland is Google Ireland Limited, a company established and operating under the laws of Ireland (registration number: 368047). You can consult their privacy policy here: https://policies.google.com/privacy?hl=es
MailerLite Limited: e-mail marketing provider. It is an Irish company registered at Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland. You can consult their privacy policy at https://www.mailerlite.com/legal/privacy-policy.
Stripe: a tool used to manage debit and credit card payments on the website. The service is provided by Stripe Inc which is located in the United States. They have adopted data processing clauses approved by the European Commission which can be consulted at: https://stripe.com/es/guides/general-data-protection-regulation. For more information, please visit https://stripe.com/es/privacy.
Paypal: payment management tool whose controller in the European Economic Area is PayPal (Europe) S.à.r.l. et Cie, S.C.A., with registered office at 22-24 Boulevard Royal L-2449, Luxembourg. You can consult their privacy policy at: https://www.paypal.com/es/webapps/mpp/ua/privacy-full?locale.x=es_ES#2
Klarna: payment deferral tool for online shop customers. Klarna Bank AB (publ) is registered in the Swedish Commercial Register under company number 556737-0431 and has its registered office at Sveavägen 46, 111 34 Stockholm. You can consult its privacy policy here: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/es_es/privacy
Google Drive: a tool dedicated to backing up and easily accessing files in the cloud. This service is provided by Google, Inc. whose data controller in the European Economic Area and Switzerland is Google Ireland Limited, a company established and operating under the laws of Ireland (registration number: 368047). You can consult their privacy policy here: https://policies.google.com/privacy?hl=es
Google Analytics and Console: web analytics tools. This service is provided by Google, Inc. whose data controller in the European Economic Area and Switzerland is Google Ireland Limited, a company established and operating under the laws of Ireland (registration number: 368047). You can consult its privacy policy here: https://policies.google.com/privacy?hl=es
WhatsApp: tool used for communication with users, potential buyers and customers through the company WhatsApp Ireland Limited (for those located in Europe), which can be contacted through the link https://www.whatsapp.com/contact/?subject=messenger and its privacy policy can be found at https://www.whatsapp.com/legal?eea=1#privacy-policy.
Telegram: tool used for communication with users, potential buyers and customers, whose company has designated as data controller in the European Economic Area and Switzerland is Telegram UK Holdings Ltd (71-75 Shelton Street, Covent Garden, London, England, WC2H 9JQ). You can consult their privacy policy here: https://telegram.org/privacy
Seur, SA: Spanish courier company with N.I.F. A-28985992, located at C/Gamonal 6 (28031), Madrid, Spain. You can consult their privacy policy at the following link: https://www.seur.com/es/politica-de-privacidad-y-cookies/
Ainhoa Mateo: gestoría y asesoría on-line located at Avenida Celanova, 140, 32890 A Valenzá-Barbadás (Orense), Spain. Here you can consult their privacy policy: https://ainhoamateo.es/politica-de-privacidad/
Quipu App SL: online invoicing software whose registered office is at Calle Álaba, 61, 5-2, 08005 Barcelona, Spain. Registered in the Companies Register of Barcelona: Volume 43882, Folio 171, Page B 440915, Inscription 1. Here is their privacy policy: https://getquipu.com/es/politica-de-cookies
10. SEGMENTATION AND PROFILING
The registration of personal data provided at the time of subscription, contact, interaction with the website and any other data provided during browsing, including the information provided by cookies in relation to browsing habits, will be used in order to be segmented or categorised with the aim of applying them to the activity related to the management of general administration, information, analysis of proposals requested by users/customers, statistical study of the services and content used, tastes and preferences, and surveys or forms.
Profiling, through the analysis of your automated individual decisions, consists of the use of your Personal Data to evaluate certain personal aspects, such as the analysis and prediction of your economic situation, personal preferences, interests, behaviour, location, movements and attitudes. The logic applied to obtain these profiles is the use of statistical procedures and the consequences of this processing of your data by means of profiling are the sending of personalised communications of interest to you.
The legal basis for the processing of your data for the aforementioned purposes and the preparation of automated individual decisions by profiling is the consent given by ticking the box “I agree to receive personalised commercial communications” on the subscription forms, or by expressly accepting advertising cookies.
The data that we use in profiling and that we show to advertisers are not data that allow users to be identified, only the type of audience we have, their age, country, gender, etc. are shown in a graph.
11. SOCIAL PLUGINS
In www.ovillova.com you have links and services related to the different social networks, specifically, “Share” from Facebook, Pinterest, WhatsApp and Telegram in the blog posts, and “Save” from Pinterest in the online shop articles. If you are a member of these social networks and click on the corresponding link, the social network provider can link your profile data with information about your visit to this website.
You can access the privacy policies of the various social networks at any time and configure your profile to ensure your privacy:
Facebook: https://www.facebook.com/privacy/explanation/
Pinterest: https://policy.pinterest.com/es/privacy-policy
WhatsApp: https://www.whatsapp.com/legal/privacy-policy/?lang=es
Telegram: https://telegram.org/privacy
On the other hand, you can visit my social networks and interact with me in the Instagram and Whatsapp links that appear on my website. If you click on these links, you will be redirected to these applications, outside my website, so the privacy policies of these social networks will apply:
Instagram: https://www.facebook.com/privacy/policy/version/20220104/
Facebook: https://www.facebook.com/privacy/explanation/
Telegram: https://telegram.org/privacy
12. INTERNATIONAL DATA TRANSFERS
This party has contracted services to providers located outside the European Economic Area (“Third Countries”). By means of this policy we wish to mention that we proceed to carry out (in such cases) the relevant international transfers in order to carry out the service/functionality that you have requested, safeguarding at all times the security of your data and ensuring that they comply with the data protection requirements contained in the GDPR.
These suppliers have signed the corresponding confidentiality and data processing contracts required by the regulations for suppliers located in Third Countries, applying the necessary guarantees and safeguards to preserve your privacy. These guarantees and safeguards consist of European Commission adequacy decisions, standard contractual clauses (SSCs) approved by the European Commission or other legal mechanisms permitted by GDPR.
13. HOW DO WE PROTECT YOUR INFORMATION?
We are committed to protecting your personal information. We use reasonably reliable and effective physical, organisational and technological measures, controls and procedures to maintain the integrity and security of your data and to ensure your privacy.
In the case of the contracts we sign with our suppliers, we include clauses in which they are required to maintain the duty of secrecy regarding the personal data to which they have had access by virtue of the order made, as well as to implement the technical and organisational security measures necessary to guarantee the permanent confidentiality, integrity, availability and resilience of the systems and services for the processing of personal data.
This website includes an SSL certificate. This is a security protocol that makes your data travel in an integral and secure way; that is to say, the transmission of data between a server and the web user, and in feedback is totally encrypted or encrypted.
However, absolute security cannot be guaranteed and no security system is impenetrable so, in the event that any information under our control and under our control is compromised as a result of a breach of security, we will take appropriate steps to investigate the incident, notify the Supervisory Authority and, where appropriate, those users who may have been affected to take appropriate action.
14. CHANGES TO THE PRIVACY POLICY
LIDIA SÁNCHEZ-BRUNETE reserves the right to modify this policy to adapt it to new legislation or case law, as well as to industry practices. In such cases, we will inform you through the website or by other means, so that you can be informed of the new privacy conditions introduced.
This Privacy Policy was last updated on 02/06/2022.