Browsing this website implies acceptance in full of the following provisions and conditions of use.

The latest version of this privacy policy is the only one applicable while using the website until it is replaced by another version.

For further supplementary information on personal data protection we invite you to consult the website of the AEPD (Spanish Data Protection Agency) at https://www.agpd.es/portalwebAGPD/index-ides-idphp.php

Data controller

Controller: Asociación de Artesanos Creativos en Fuerteventura

N.I.F. (Tax code): G76368356

Contact: gest.artesanoscreativosftv@gmail.com

As a general rule the following data will be collected: forename and surname(s), address, email address, telephone number, date of birth and data related to forms of payment. Other types of data may be collected provided that the user is informed.

Purpose of processing

Personal data will be used for relations with the customer, via the website, and compliance with contractual obligations, if applicable, when they arise from a purchase in the online shop.

Merely accessing the Owner’s website does not require a transfer of personal data. Using and browsing the website may entail the use of cookies, regulated in our Cookie Policy.

When personal data are provided to establish a commercial relationship, they will be processed for the purpose of managing the commercial relationship, if applicable, with prior consent for this purpose, to be able to offer you products and services to suit your interests.

Specifically, the uses are as follows:

• access to and use of the website by the user.

• managing the operation of the website and optimizing it.

• organizing the conditions of use of payment services.

• verifying, identifying and authenticating the data sent by the user.

• implementing user assistance.

• personalizing services by showing advertisements based on the user’s browsing history, according to their preferences.

• preventing and detecting fraud, managing malware (malicious software) and security incidents.

• managing possible disputes with users.

• sending commercial and advertising information, according to the user’s preferences.

The data provided will be kept for as long as the commercial relationship is maintained, provided that the data subject does not request their erasure, or for the years necessary to comply with legal obligations.

Lawfulness of processing

When the data subject asks for information, or data processing is required in a preliminary framework to implement pre-contractual measures, at the user’s request, this will amount to justification of the lawfulness of processing, and such a request will constitute the legal basis for processing exclusively for that purpose.

The performance of the contract, if entered into, between the data subject and the controller will also be legitimate grounds for processing.

For commercial or promotional communications, considering these as independent of those inherent in compliance with a contract entered into between the parties, the data subject’s specific consent will be requested. Such consent will be asked for and granted in accordance with the principles established in national and supranational data protection legislation.

Within the framework of a contractual relationship data may be processed to comply with a legal obligation of the data controller established in law.

The above-mentioned consent may be revoked at the request of the data subject at any time, and the controller undertakes to respond to such a request within a maximum of 30 calendar days, without this implying any retroactive effects.

The legal grounds for processing your personal data are therefore as follows:

– Proper performance of or compliance with the contract, in cases where a contractual relationship is established, at the request of the data subject, through the purchasing process.

– Your consent, as user or customer, to the processing of your data.

– The legal obligations of the data controller, once a commercial relationship has been established.

Consent

When the legal basis for the lawfulness of processing is the consent of the data subject, such consent will be sought clearly and unequivocally, respecting the rights of the data subject. Such consent may be withdrawn at any time without needing to provide any reasons and as easily as it was given.

Forms are available both for freely giving consent and for withdrawing it. For withdrawal, any clear and unequivocal declaration will be accepted.

In addition, data subjects may exercise any of their rights through specific forms available to them.

Rights of data subjects

The data subject has the following rights:

– Access to personal data stored and/or processed by the controller.

– Rectification of incomplete or inaccurate data without undue delay.

– Erasure and Restriction: the right to obtain erasure of their data and restriction of the processing performed by the controller.

– Portability: the right to receive their personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller.

The controller facilitates the exercise of these rights by means of forms made available to the data subject and by processing them as quickly as possible.

Requests to exercise these rights do not involve any cost and must be made in writing accompanied by a copy of the subject’s identity document to the email address gest.artesanoscrativosftv@gmail.com .

The data subject has the right to present a claim both to the data controller and to the competent control authority (the Spanish Data Protection Agency).

Automated decision-making

The data controller does not carry out profiling activities and the user/subject will not be affected by automated decision-making.

Transfer or communication of data

In order to maintain the confidentiality of personal data in its organization and protect the rights and freedoms of natural persons, the data controller institutes and applies technical and organizational measures designed to implement data protection principles effectively.

Within the framework of the contractual relationship resulting from purchase transactions between the user and the owner, your personal data may be transferred to a transport company such as Correos, SEUR or Nacex.

Personal data may be shared with third parties in the following cases:

• When the user uses payment services, the website is in contact with third-party banking and financial institutions with which it has entered into contracts, in order to implement these services.

• When the user publishes information open to public access in the free comment areas of the website

• When the user authorizes a third-party website to access their data

• When the website uses service providers to provide the user with support, advertising and payment services, these service providers have limited access to the user’s data, in the context of providing these services, and are contractually obliged to use that data in accordance with the provisions of applicable personal data protection legislation and regulations.

Apart from the foregoing, no transfer or communication of data is made to third parties beyond the applicable legal obligations involving public authorities and in the circumstances established by law.

Obligatory data

Users interested in receiving information or commercial communications are only required to provide basic identification data (name, email address and/or telephone number).

To execute contracts full identification data will be required, as well as postal address and in certain circumstances bank data, depending on the payment method.

Under no circumstances will special categories of data or specially protected data be processed.