Data Protection Policy

We value your privacy. Therefore, through this Privacy Policy and in compliance with the provisions of Regulation 2016/679, of the 27^th of April, General Data Protection and Organic Law 3/2018, of 5^th of December, on Data Protection and Guarantee of Digital Rights, we inform you of our practices with regard to the collection and processing of personal data carried out by GOYA EN ESPAÑA, S.A.U.

By providing us with your personal information, you agree and consent to the processing of your data in accordance with the following.

SUMMARY TABLE OF INFORMATION

What does processing of personal data mean?

The operations, management and technical procedures that are carried out in an automated or non-automated manner and that facilitate the collection, storage, modification, transfer and other actions on personal data are considered to be the processing of personal data.

What personal data do we collect?

You may use this website without disclosing who you are or without being required to disclose any personal information to us.

However, when you communicate with us by telephone, fax, post or email, or are asked to complete a form such as a contact form or registered user registration form available on the website, or by any other means made available to you, you may disclose information such as your name, email address and/or telephone number, which is necessary for us to provide you with the best service possible. In addition, where necessary, specific information may be required to process an order or make a delivery or invoice. In the event that the communication is made by e-mail, you will be informed, in the first e- mail, of the content of this privacy policy.

The personal information you provide will be incorporated into our files.

What purposes do we use your data for?

Acceptance of this privacy policy by checking the corresponding box before sending your data constitutes your express consent to the processing of your data for the following purposes:

• To manage and deal with queries and requests for information made to us through any of the forms of contact made available to the user.

• To provide you with the requested goods and/or services.

• Manage requests for information and, where appropriate, their registration as a registered user.

• In addition, each time you are asked to fill in a form, such as a contact form or to sign up as a registered user, you can check the option to receive commercial communications by electronic means, such as e-mail, SMS, our website or our social networks. Such commercial communications will be related to products or services offered by the Data Controller, special offers, new products and other advertising information that we consider relevant to you or that may be of benefit to you. These communications will be sent to the address you provide and may be cancelled at any time through the email address info@goyaspain.com, indicating as the Subject of your email “Unsubscribe Commercial Communications”.

• To inform of and offer promotions, discounts, and new services to customers who have purchased similar products or services; these communications may contain promotional content.

• Respond and send information to the data subject about our privacy policy or request to exercise their Data Protection rights.

• Manage our social networks with respect to the data of the people who become followers. In this regard, the processing of data is governed by the provisions of this Privacy Policy and by the terms and conditions, privacy policies and access regulations specific to each social network.

What is the basis of legitimacy for the processing operations?

The basis of legitimacy for the processing derived from contact by form or registration is the consent of the interested party by ticking the corresponding box.

For the sending of commercial information, the consent of the interested party is also obtained by ticking the corresponding box. In the case of sending information for promotions or offers on products similar to those previously purchased, where applicable, the basis of legitimacy is legitimate interest.

The basis of legitimacy for the processing of data arising from the purchase of products from the responsible company is the fulfilment of the contract between the responsible company and the interested party.

Do we cede the data?

The Data Controller undertakes not to disclose data to third parties without having obtained the express consent of the users. Data will only be communicated to the institutions or bodies to which we are obliged by law and to the data processors with which the corresponding document has been signed. However, the Data Controller may disclose metrics and analytics requested by IT tools installed on the website that are not owned by the Data Controller. Some of these services may be owned by third parties residing outside of the European Union.

The Data Controller uses secure tools whose servers are preferably located in Spain, or failing that, in a member state of the European Union, or that comply with European legislation in accordance with the guidelines and recommendations of the Spanish Data Protection Agency, the European Commission and the Community reference agreements on international data transfer, including obtaining DPF certification.

How long do we store data for?

The personal data provided to the controller will be deleted after the necessary period of time for the performance of the purposes and the period of time necessary to meet the deadlines determined by law with respect to possible claims. In cases where the processing is based on the consent of the data subject, the data will be kept until the data subject requests its deletion or cancellation, or withdraws his or her consent, or until it is no longer necessary for the purpose for which it was collected.

What do we do with data on social media?

The company maintains accounts on the social networks Facebook, YouTube, LinkedIn, Pinterest, Instagram and X with the purpose of publishing and disseminating information about the products offered through the corporate website, interacting with users and serving as a channel for attention and social interaction.

In the event that you access this website using an application that connects a social network with this website, you will be authorising the social network to share some data with the responsible party.

It is important for you to be aware that if you have geo-located social media accounts, your location information when sharing on social media will be visible to third parties with whom you share your information.

You can learn more about the use of your data on these social networks by consulting the privacy policy of each of them.

What rights do you have in relation to the processing of your data?

As the owner of the personal data, and subject to the exceptions and limits established in the applicable data protection regulations, you may exercise the following rights:

• The right to withdraw your consent to the processing of your personal data at any time;
• Right of access to information that we process about you;
• The right to rectify your data if it is inaccurate or incomplete;
• Right of erasure, inter alia, when your data are no longer required for the purposes for which they were collected;
• The right to object to the processing of your data for commercial purposes;
• The right to restrict processing where, among other conditions, rectification or opposition to processing is requested;
• The right to portability of the data you have provided to us in a structured, commonly used and machine-readable format;

The right to file a complaint with the Spanish Data Protection Agency if you consider that the processing does not comply with the regulations in force via the website www.aepd.es. You may also make use of the models and forms for the exercise of these rights available on the portal of the Spanish Data Protection Agency, which can be found at the following address: www.aepd.es.

To do so, you must send a signed request, indicating the right you are exercising, your name and surname, address for notification purposes  and a copy of your ID card or other valid document proving your identity.

This request should be sent to the Data Controller, GOYA EN ESPAÑA, S.A.U. at the following address: Carretera Sevilla-Málaga, km 5,4, Polígono Industrial La Red Sur, C/ 9 – nº 1, 41500, Alcalá de Guadaíra (Sevilla), or electronically at info@goyaspain.com.

Similarly, users may exercise their rights or unsubscribe from any of the subscription services by sending an e-mail to info@goyaspain.com identifying themselves by means of a copy of their ID card.

GOYA EN ESPAÑA, S.A.U. reserves the right to change the terms of this Privacy Policy at any time.