Last update March 4th 2021
1. Parties and subject
Barcelona Brands S.L. (hereinafter “HOLACAVA” or the “Data Controller”)
Avenida Port d’Aiguadolç, local 6, 08870 Sitges, Spain
Phone: +34 931 191 244
The term “User” refers to any user, either any natural or legal person, who visits or interacts in any way with the Site.
As such, HOLACAVA determines all the technical, legal and organizational means and purposes for processing Users’ personal data. HOLACAVA undertakes to take all the necessary measures to ensure that personal data is processed in accordance with the law of July 30, 2018, on the protection of individuals with regard to the processing of personal data (hereinafter: after, “the Law“) and to the European GDPR of April 26, 2016 on the protection of personal data with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR “).
HOLACAVA is free to choose any natural or legal person who processes the personal data of users at his request and on his behalf (hereinafter the “Subcontractor”). Where applicable, HOLACAVA undertakes to select a Subcontractor offering sufficient guarantees as to the technical and organizational security measures for the processing of personal data, with regard to the Law and the Regulations.
The Website is not intended for use by individuals under the age of 18 (or the applicable legal age for consuming the products in question). We do not knowingly collect Personal Data from individuals under the age of 18.
2. Processing of personal data
Use of the Site by Users may result in the communication of personal data. The processing of this data by HOLACAVA, in its capacity as Data Controller, or by service providers acting in the name and on behalf of HOLACAVA, will comply with the Law and the Regulations.
Personal data will be processed by HOLACAVA, in accordance with the purposes mentioned below, via:
- Sharing of free content;
3. Purpose of the processing of personal data
In accordance with article 13 of the GDPR, the purposes of the processing of personal data are communicated to the User and are as follows:
- Processing your order to be able to process your payment and to deliver the requested product or service to you; We need your name, e-mail address, telephone number (in case we need to communicate to you about your order), postal address of you or the recipient of our services (if different than yourself), your date of birth (as we are legally required to ask for before allowing you to visit our Website), payment information. This is also for our sales administration. Our online sales records will be retained by us for 7 years or longer if required by tax or corporate bookkeeping.
- For the technical management of the Website and its operational functions (including logistics), including solving any technical problems, statistical analysis, tests and research;
- To prevent or uncover fraudulent activities or misuse that is damaging to our website or threatening the security of the transactions;
- Sending commercial messages: We use multiple ways to send you commercial messages. You can subscribe to receiving commercial messages (e.g. newsletter), in that case we will use the contact details (such as your email address, social media account or phone number) you have provided to send you our commercial messages. If you no longer wish to receive any commercial messages from us, you can unsubscribe at any time by using the unsubscribe function in each e-mail message to fulfil the user’s requests;
- To manage promotions or contest as available from time to time on the Website;
- To communicate with the users for purposes related to the supply of the service;
4. Personal data likely to be processed
- Address and/or contact data (delivery address and invoice address);
- Date of birth;
- Telephone number;
- Username and log in data (passwords);
- Client number;
- IP address, browser type and model, time zone, the operating system language preferences;
- -All information concerning the pages the user has accessed the Site, including the URL, the navigation time …
- Payment data;
- Credit cards;
- Order history, including chosen delivery options;
The User has the right to withdraw his consent at any time. The withdrawal of consent does not compromise the lawfulness of processing based on the consent previously given.
6. Retention period of Users’ personal data
In accordance with article 13 §2 of the Regulations and the Law, the Data Controller only keeps personal data for the time reasonably necessary to allow the fulfillment of the purposes for which they are processed.
7. Recipients of the data and disclosure to third parties
We need to share Personal Data with third parties to help us provide services and products to you and to run our Website. These third parties are:
- Service providers where this is needed to provide us with a service or to deliver the service or product ordered by you on the Website (including our third party delivery provider) and to provide data analytics services. Service providers we work with: UPS;
- Adyen B.V., a payment service provider that will act as data controller in order to obtain and process payments made by you via the Website;
- First and third party advertising companies;
- Media agencies for marketing purposes and research purposes
- Social Media Providers, such as Facebook and Instagram;
In the event that the data is disclosed to third parties for direct marketing or prospecting purposes, the User will be informed beforehand so that he expresses his consent to the use of this personal data.
8. Data Protection Officer (DPO)
The following person is appointed Data Protection Officer (hereinafter “DPO”): Christel Weemaes
The role of the DPO is to ensure the proper implementation of the provisions national and supranational with regard to the collection and processing of personal data.
The DPO can be contacted as follows:
firstname.lastname@example.org /tel. +34 931 191 244
9. User Rights
At any time, the user may exercise its rights by sending an e-mail to following address: email@example.com, or a letter by post addressed, attaching a copy of his identity card to the following address: Barcelona Brands S.L., Avenida Port d’Aiguadolç, local 6, 08870 Sitges, Spain.
a. Right of access
In accordance with article 15 of the Regulations, HOLACAVA guarantees the right of access to the User to his personal data. The User has the right to obtain access to said personal data as well as the following information:
- The purposes of the processing;
- The categories of personal data concerned;
- The recipients or categories of recipients to whom the personal data have been or will be communicated, in particular recipients who are established in third countries or international organizations;
- Where possible, the planned retention period for personal data or, where this is not possible, the criteria used to determine this period;
- The existence of automated decision making, including profiling, referred to in Article 22 (1) and (4) of the GDPR, and, at least in such cases, useful information regarding the underlying logic, as well as the importance and the foreseen consequences of this processing for the data subject;
The Data Controller may require the payment of reasonable fees based on administrative costs for any additional copy requested by the User.
When the User submits this request electronically (through the electronic address for example), the information is provided in an electronic form in common use, unless the User requests otherwise.
The copy of his data will be communicated to the User no later than one month after receipt of the request.
b. Right of rectification
HOLACAVA guarantees the right of rectification and erasure of personal data to the user.
In accordance with article 16 of the GDPR, incorrect, inaccurate or irrelevant data may be corrected or deleted at any time. The User first makes the necessary modifications himself from his user / other account, unless these cannot be carried out independently, in which case a request can be made to HOLACAVA.
In accordance with article 19 of the Regulations, the Data Controller notifies each recipient to whom the personal data has been communicated of any rectification of the personal data, unless such communication proves impossible or requires disproportionate efforts. The data controller provides the data subject with information on these recipients if the latter so requests.
c. Right to erasure
The User has the right to obtain the erasure of his personal data as soon as possible in the cases listed in article 17 of the Regulations.
When the Data Controller has made the personal data public and is required to erase them under the previous paragraph, the Data Controller, taking into account the available technologies and the costs of implementation, takes reasonable measures , including of a technical nature, to inform other controllers who process such personal data that the data subject has requested the erasure by those controllers of any link to such personal data, or of any copy or reproduction thereof.
The two preceding paragraphs do not apply insofar as this processing is necessary:
- For the exercise of the right to freedom of expression and information;
- To comply with a legal obligation which requires the processing provided for by Union law or by the law of the Member State to which the controller is subject, or to perform a task of public interest or falling within the exercise of the public authority vested in the controller;
- To the establishment, exercise or defense of legal claims.
In accordance with Article 19 of the Regulations, the Data Controller notifies each recipient to whom the personal data has been communicated of any erasure of personal data or any limitation of the processing carried out, unless such communication proves impossible. or requires disproportionate effort. The data controller provides the data subject with information on these recipients if the latter so requests.
d. Right to limit the processing
The User has the right to obtain the restriction of the processing of his personal data in the cases listed in article 19 of the Regulations.
In accordance with article 19 of the Regulations, the Data Controller notifies each recipient to whom the personal data has been communicated of any limitation of the processing carried out, unless such communication proves impossible or requires disproportionate efforts. The data controller provides the data subject with information on these recipients if the latter so requests.
e. Right to data portability
In accordance with article 20 of the Regulations, Users have the right to receive from HOLACAVA personal data concerning them in a structured, commonly used and machine-readable format. Users have the right to transmit this data to another data controller without HOLACAVA obstructing it in the cases provided for by the Regulations.
When the User exercises his right to data portability in application of the previous paragraph, he has the right to obtain that the personal data is transmitted directly from one controller to another, when this is technically possible.
The exercise of the right to data portability is understood to be without prejudice to the right to erasure. This right does not apply to processing necessary for the performance of a task of public interest or relating to the exercise of public authority vested in the controller.
The right to data portability does not affect the rights and freedoms of third parties.
f. Right of opposition and automated individual decision-making
The User has the right at any time to object to the processing of his personal data due to his particular situation, including the automation of data carried out by HOLACAVA. In accordance with article 21 of the Regulations, HOLACAVA will no longer process personal data, unless there are legitimate and compelling reasons for the processing which prevail over the interests and rights and freedoms of the User, or for the establishment, exercise or defense of legal claims.
When personal data is processed for prospecting purposes, the User has the right to oppose at any time the processing of personal data concerning him for such prospecting purposes, including profiling to the extent where it relates to such prospecting.
When the data subject objects to the processing for prospecting purposes, the personal data is no longer processed for these purposes.
g. Right of complaint
The User has the right to lodge a complaint concerning the processing of his personal data by HOLACAVA with the Data Protection Authority. You can file a complaint with the competent Data Protection Supervisory Authority through from its website: www.agpd.es.
a. General principles
A “Cookie” is a file temporarily or permanently placed on the User’s hard drive when consulting the Website, with a view to subsequent connection. Thanks to cookies, the server recognizes the User’s computer.
Cookies can also be installed by third parties with whom HOLACAVA collaborates.
Some of the cookies used by HOLACAVA are necessary for the proper functioning of the Site, others allow the User experience to be improved.
The User can customize or disable cookies by configuring their browser.
By using the Website, the User expressly agrees with the management of cookies as described in this article.
b. Type of cookies and purposes pursued
Different types of cookies are used by HOLACAVA on the Site:
- Technical cookies: they are necessary for the operation of the Website, allow the communication of the data entered and are intended to facilitate the User’s navigation;
- Statistical and audience measurement cookies: these cookies allow the recognition of the User and are used to count the number of Users of the Website over a certain period. As long as they also indicate browsing behavior, they are an effective way to improve the User’s browsing experience, by showing him proposals and offers that may be of interest to him. They also allow HOLACAVA to identify possible bugs on the Website and to correct them;
- Functional cookies: these cookies facilitate the use of the Website by retaining certain choices made (for example, username or language);
- Tracking cookies: HOLACAVA uses tracking cookies via Google Analytics, to measure User interaction with the content of the Site and to produce anonymous statistics. These statistics allow HOLACVA to improve the Website. Google supports the explanation of these cookies at the following address: https://policies.google.com/privacy?hl=en&gl=be
c. Cookie retention period
Cookies are kept for the time necessary to fulfill the purpose pursued. The cookies likely to be stored on the User’s hard drive as well as their retention period are as follows:
__utma: This cookie is used to distinguish unique visitors to your site. The latter is updated on each page viewed. – 2 years
__utmb: This cookie is used to track visiting session of the user. This cookie expires as soon as the user remains inactive on your site for more than 30 minutes. The use of this cookie coupled with the utmc cookie makes it possible to track visits (sessions) on a given site. Note that the cookie lifespan can be adapted to your needs and specificities. To do this, you just need to call the _setSessionCookieTimeout () function. – 30 minutes
__utmc: This cookie works in addition to __utmb cookie to determine whether there is a new visit by the current single visitor. – Not defined. It expires at end of session
__utmz.This cookie stores all relevant information for the identification of a source of traffic. The following information is stored in this cookie: the source of traffic, the medium for this source of traffic, the keyword entered if the Internet user consults the site from a search engine, etc. By default, this cookie has a lifespan of 6 months, however, you can change this limit through function: _setCookieTimeout () – 6 months
__utmv: This cookie is not normally present in a configuration default tracking code. The __utmv cookie refers to the information entered when calling the _setVar () function. Note that the utmv cookie is an optional cookie. The latter is only used by the setVar function. – 2 years
__utmt: This internal cookie created by Google Analytics is used to process the request from the user and generate traffic statistics website. – 10 minutes
CONSENT: These third party cookies are used by Google Analytics to generate maps (for locating products) and to generate CAPTCHA images to help protect our spam sites. – All life
NID: These third party cookies are used by Google Analytics to generate maps (for locating products) and to generate CAPTCHA images to help protect our spam sites. – 6 months
1P_JAR Advertising Cookie Google used to track users and target ads. – 1 minute
d. Managing cookies
If the User disables certain cookies, he accepts that the Website may not function optimally. Certain parts of the Website may therefore not be usable, or may be partially.
If the User thus wishes to manage and / or delete certain cookies, he can do so by using the following link (s):
For Users having as a browser:
If the User refuses to allow Google Analytics cookies to be used, he is invited to configure his browser to this effect, on the following website:
11. Limitation of liability of the Data Controller
The website may contain links to other websites owned by third parties not linked to HOLACAVA. The content of these sites and their compliance with the law and Regulations are not the responsibility of HOLACAVA.
HOLACAVA is not responsible for the loss, corruption or theft of personal data caused in particular by the presence of viruses or following computer attacks.
The Controller implements organizational and technical measures to guarantee an appropriate level of security for the processing and collection of data. These security measures depend on the costs of implementation with regard to the nature, context and purposes of the processing of personal data.
The Data Controller uses standard encryption technologies within the IT sector when transferring or collecting data on the Site.
14. Applicable law and competent jurisdiction