II.- PRINCIPLES UNDER THE EUROPEAN DATA PROTECTION REGULATION

We undertake to process the personal data (hereinafter the “data”) provided in accordance with the following principles set out in the General Data Protection Regulation (GDPR):

• Legality: we will only collect your personal data for specified, explicit and legitimate purposes, and we will not process your personal data in a manner incompatible with those purposes.
• Lawfulness: in accordance with Article 6 of the General Data Protection Regulation, your personal data will be processed provided that you give your express consent to the processing of such data as an expression of your free and informed will and consent. Your personal data may be necessary to formalise a contract, agreement or service to which the data subject is a party, to comply with legal obligations, to protect the vital interests of the data subject or of another natural person, to perform a task carried out in the public interest or in the exercise of official authority vested in the controller, or to satisfy the legitimate interests pursued by the controller where these do not infringe the fundamental rights and freedoms of the data subject or the protection of the data subject’s personal data.
• Fairness and transparency: in accordance with Article 5 of the General Data Protection Regulation, as an expression of transparency, as evidenced by the fact that the data subject is informed of the existence of the processing operation and its purposes.
• Data minimisation: we limit the collection of personal data to what is strictly relevant and necessary for the purposes for which it has been collected.
• Purpose limitation: we will only collect your personal data for specified, explicit and legitimate purposes, and we maintain this in the way we process it.
• Accuracy: we will keep your personal data accurate and up to date.
• Data security: we apply appropriate technical and organisational measures to ensure an appropriate level of security, taking into account the risks and nature of the data, in order to prevent the data from being disclosed or accessed by unauthorised personnel, or from being lost or altered. In short, any form of unlawful processing.
• Any person who, having given their consent to the collection of data, wishes to make any request regarding the processing is recognised as having, and may exercise, the rights of access, rectification, objection, erasure, restriction of processing, portability and not to be subject to automated individual decision-making. Exercising these rights is free of charge, and such requests will be dealt with within one month, which may be extended by a further two months in exceptional circumstances such as, for example, the number of requests, their complexity or other similar reasons.
• Principle of storage limitation: data will be kept for as long as necessary for the purposes of the processing without undue delay, and during that time the data of users and customers will be available to them whenever they request it.

III.- USER CONSENT: 

Completing our contact forms, after accepting this Privacy Policy, constitutes the user’s unequivocal consent to the automated processing of the data in accordance with the privacy conditions of the Website.

Consent will also be deemed to have been given if the user writes to us directly through other channels made available on the website, this being considered a clear affirmative act as regards such consent.

In all cases, the data collected are the minimum essential to respond to a request for information, to subscribe to certain offers or events, or to manage the user’s order and issue the corresponding invoice.  These data are therefore adequate, relevant and not excessive in relation to the specific scope and purposes. 

Notwithstanding the above, the data subject may withdraw such consent at any time by unsubscribing through any of the means made available to the user.

IV.- PURPOSES OF THE DATA PROCESSING.

How will we use the personal information we process?

• To respond to requests for information made by the user through the website. 
• In the event of a purchase of the products made available to users, after acceptance of the Terms and Conditions, to manage and track delivery of the product. 
• For the management, administration, invoicing, information, provision and improvement of the service.
• To send communications of interest relating to the company’s products, provided that the user has given their clear and express consent. In any event, where this is the case, the user may notify us at any time that they wish to unsubscribe from these communications. 

V.- HOW LONG WILL WE KEEP YOUR DATA?

Data will be kept for as long as is essential for the specific purpose, whether to provide information to the user or to manage the order. In the case of communications of interest, if the user has authorised their receipt, the data may be kept for this specific purpose for as long as the data subject does not express a wish to stop receiving such communications.  Once the data are no longer necessary for the purpose for which they were collected, and we do not have the user’s consent to keep them, we will keep your data blocked for the limitation periods of any obligations that may have arisen from the processing and/or the applicable legal periods, at the disposal of the competent authorities for the purpose of addressing any liabilities arising from the processing. 

Blocking of data, in accordance with Article 17(3) GDPR, means the right of “retention” as an exception to the obligation of erasure. This means that the data will not be used or be accessible to anyone, and will only be used in the event of a legal requirement or a claim for liability in relation to them. Once the legal limitation period has elapsed in each case, the data will be permanently deleted.

VI.- LEGAL BASIS

We process your data on the legal basis of your consent.

In any event, you will have full rights over your personal data and its use, and you may exercise them at any time.

Providing personal data is mandatory in order to contact us and for us to be able to deal with the request you send us. Likewise, failure to provide the personal data requested or failure to accept this Privacy Policy will make it impossible to process requests made on this website.

VII.– RECIPIENTS

To whom do we disclose your data?

The CONTROLLER will not disclose your data unless this is necessary for delivery of the order. This would be the case, for example, of courier companies engaged for this purpose, with which the corresponding confidentiality and data access agreements will in all cases be signed in accordance with Article 28 GDPR. 

Outside these cases, data will not be disclosed under any circumstances, except to the competent Public Bodies, the Tax Agency (Agencia Tributaria), the State Security Forces and Corps, and Judges and Courts, where there is a legal obligation to provide them.

VIII.- DATA PROTECTION RIGHTS

How can the rights be exercised?

We inform you that you may exercise your rights of access, rectification, objection, erasure, restriction of processing and portability by writing to the CONTROLLER at the address indicated above or to the email address: hola@quintocafe.es. 

 We also remind you that, if you are a customer, you may withdraw your consent or object to receiving commercial communications by any means and at any time by sending an email to the above address. 

If you consider that your request has not been properly handled or that your data are not being processed appropriately, you may file a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency), the supervisory authority in this area in Spain.

A)- RIGHT OF ACCESS

Article 15 of the General Data Protection Regulation recognises the right of the data subject to know whether or not their personal data are being processed and, if so, the purposes of the processing, the categories of data, the recipients, the source of the data, the retention period and the criteria for determining that period. Accordingly, the CONTROLLER will provide a copy of the personal data being processed in electronic format upon submission of a request.

Data subjects may likewise request from the CONTROLLER the rectification, erasure or restriction of their data and of the processing.

To make it easier for users to exercise this right, the form to be completed for the request is available at the following link:

B)- RIGHT TO RECTIFICATION AND ERASURE

Articles 16 and 17 of the General Data Protection Regulation provide, with regard to the rectification and erasure of personal data, that the customer or user may request the rectification of their personal data if they consider them inaccurate, or that they be completed or deleted if they are not necessary for the purposes for which they were collected and processed.

To make it easier for users to exercise this right, the forms to be completed for the request are available at the following links:

C)- RIGHT TO RESTRICTION OF PROCESSING

The data subject shall have the right to obtain from the controller restriction of the processing of the data where they contest the accuracy of the personal data. That is, the data may only be processed, with the exception of their storage, with the consent of the data subject, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of public interest of the Union or of a Member State. In addition, the data subject will be informed by the CONTROLLER before such restriction is lifted.

To make it easier for users to exercise this right, the form to be completed for the request is available at the following link:

D)- RIGHT TO DATA PORTABILITY

Article 20 of the General Data Protection Regulation recognises the right of the data subject to receive the personal data concerning them, that is, to have them transmitted directly from one controller to another where technically feasible, in a structured, commonly used and machine-readable format, without hindrance from the controller to which they were provided, where consent has been expressly given or there is a contract.

To make it easier for users to exercise this right, the form to be completed for the request is available at the following link:

IX.- MINORS

The content of the Website is not aimed at persons under 18 years of age. Likewise, and specifically with regard to the data provided by the user, only users aged 14 or over may give their free consent to the processing of such data.

In any event, the CONTROLLER will take all possible measures to verify the age of users, but cannot be held responsible for any non-compliance in this respect.

X.- LEVEL OF SECURITY

The CONTROLLER will implement the technical and organisational security measures necessary to guarantee the security of personal data in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (GDPR), thereby preventing their loss, alteration and unauthorised access.

In any event, if, despite complying with all necessary security measures, the Website suffers a security breach that may affect your legitimate interests or rights, the CONTROLLER undertakes to notify the Supervisory Authority, in this case the Agencia Española de Protección de Datos, within a maximum of 72 hours, as required by law, and to notify all users who may have been affected as soon as possible.  

If the user accesses a third-party website from the service itself, the CONTROLLER can in no way guarantee the security of such websites and is therefore exempt from all liability for any damage suffered by the user through the use of the website or link concerned. This Privacy Policy applies exclusively to the Website of the CONTROLLER and does not apply to any other site that the user accesses through links not belonging to the owner or through any other Internet channel.

XI.- CONFIDENTIALITY

Any personal data collected will be treated in the strictest confidence, with the CONTROLLER undertaking to keep them secret and guaranteeing the duty to safeguard them by adopting all measures necessary to prevent their alteration, loss and unauthorised processing or access, in accordance with applicable legislation.

To this end, the CONTROLLER guarantees that it will keep the corresponding confidentiality undertakings signed with any persons involved in any stage of the processing of the personal data collected.

XII.- INTERNATIONAL DATA TRANSFERS

An International Data Transfer means any communication of your personal data to countries located outside the European Union and, more specifically, outside the European Economic Area (EEA). There are exceptions for countries outside the European area that are not considered an international transfer, as the recipients are countries that the European Commission considers to provide an adequate level of protection because they meet European data protection standards.

Should the CONTROLLER transfer personal information outside the EEA, either because the data are stored on a server located outside the EEA or for any other reason, it guarantees that the contractual clauses governing such international transfer will be in place, ensuring that any provider that may host or process personal information meets the minimum security standards and principles set out in the GDPR.

XIII.- RESPONSIBILITY

The user shall be solely responsible for completing the forms with false, inaccurate, incomplete or out-of-date data. Please inform us of any change or error in your personal data as soon as possible by contacting us at the data protection contact point: hola@quintocafe.es.  

We will take the necessary measures to ensure that any incorrect information about your data is deleted or amended.

XIV.- CHANGES TO THE PRIVACY POLICY

The requirements of this Privacy Policy supplement, and do not replace, any other existing requirements under applicable data protection legislation. In the event of any conflict between this Policy and the requirements of applicable data protection legislation, the latter shall prevail.

The CONTROLLER reserves the right to modify its Privacy Policy at its own discretion or, in particular, as a result of changes to the Service or the Website, or of legislative or case-law changes or changes in the doctrine of the Agencia Española de Protección de Datos.

Any change to the Privacy Policy will be published at least ten days before it takes effect. When this happens, we will notify you of any change and ask you to reread the latest version of our Privacy Policy and confirm your acceptance. You can also check this Policy periodically on this Website, where it will be displayed.