Privacy Policy

Introduction

This Privacy Policy has been developed in accordance with the provisions of the existing Organic Law on the Protection of Personal Data and with Regulation (EU) 2016/679 of the European Parliament and the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, from now on GDPR.

This Privacy Policy is intended to inform the subjects of personal data, whose information is being collected, the specific aspects regarding the processing of their personal data, including the purposes of the processing, the contact details for exercising their rights, the periods of conservation of the information and the security measures, among other things.

Responsible for the processing

In terms of data protection, CALZADOS ARRAYÁS, S.L., should be held responsible for the processing in relation to the files/processing identified in the present policy, specifically in the Data Processing section.

Identification data of the owner of this website:

Registered name: CALZADOS ARRAYÁS, S.L.
CIF: B-21.047.675
Address:  Pol. Ind. El Monete, 13- 21600 Valverde del Camino (Huelva) SPAIN
Phone: +34 959550511
Email: info@thehouseoftheboot.com

Data Processing

The personal data requested, if any, will consist only of those strictly necessary to identify and respond to the request made by the subject of the same, from now on the Interested Party. On the other hand, personal data will be collected for specific, explicit and legitimate purposes, not being further processed in a manner incompatible with those purposes.

The data collected from each subject will be adequate, relevant and not excessive in relation to the corresponding purposes for each case, and will be updated whenever necessary.

The data subject will be informed, prior to the collection of their data, of the general points in this policy so that they can provide express, precise and unequivocal consent for the processing of their data, in accordance with the following aspects.

Processing data purposes

The explicit purposes for which each of the processing are carried out are included in the informative clauses appearing in each of the data collection ways (web forms, paper forms, voiceovers or posters and informative notes).

However, the personal data of the interested party will be processed for the sole purpose of providing an effective response and to meet the requests made by the user, specified together with the option, service, form or data collection system used by the subject.

Lawfulness

Generally, prior to the processing of personal data, CALZADOS ARRAYÁS, S.L. obtains the express and unequivocal consent of their owner, by incorporating informed consent clauses in the different data collection systems.

However, if the consent of the data subject is not required, the legitimate basis for the processing on which CALZADOS ARRAYÁS, S.L. relies is the existence of a specific Law or regulation that authorizes or requires the processing of the subject's data.

“In accordance the Article 6 (1)(a) of GDPR, in the event that we have previously obtained your express consent to the registration to our newsletter, we will use the data necessary for this purpose to send commercial communications in accordance with such consent. You can unsubscribe from the newsletter at any time by sending a message to our contact address described here or by clicking on the link provided for this purpose in the e-mail with such commercial communication. After unsubscribing we block your e-mail address for this use, provided that you have not given your express consent to the continued use of the data, or we reserve the right to continue to use your data in cases permitted by law and about which we inform you in this document."

Recipients

Generally, CALZADOS ARRAYÁS, S.L. does not transfer or communicate data to third parties, except those legally required, however, if necessary, such transfers or communications of data are informed to the person concerned through informed consent clauses contained in the different ways of collecting personal data.

How we collect your information

Generally, personal data are always collected directly from the data subject, however, in certain exceptions, data may be collected through third parties, entities or services other than the data subject. In this regard, this will be communicated to the data subject through the informed consent clauses contained in the different information collection ways and within a reasonable period of time, once the data has been obtained, and at the latest within one month.

Duration of the treatment

The information collected from the interested party will be stored as long as it is necessary to fulfill the purpose for which the personal data were collected, so that, once the purpose is fulfilled, the data will be cancelled. Such cancellation will result in the blocking of the data being retained only at the disposal of the public administrations, Judges and Courts, to meet the possible liabilities arising from the treatment, during the period of prescription of these, fulfilled the said period shall be the destruction of the information.

For information purposes, the legal periods of conservation of the information regarding different subjects are presented hereafter:

DOCUMENT: Documentation of employment nature or related to social security
PERIOD: 4 years
LEGAL REF.: Article 21 of the Spanish Royal Legislative Decree (Real Decreto Legislativo) 5/2000, of August 4, passing the consolidated text of the Infringements and Sanctions in the Social Order Law (Ley sobre Infracciones y Sanciones en el Orden Social).

DOCUMENT: Accounting and fiscal documentation for business purposes.
PERIOD: 6 years
LEGAL REF.: Art. 30 Spanish Commercial Code.

DOCUMENT: Accounting and fiscal documentation for tax purposes.
PERIOD: 4 years
LEGAL REF.: Articles 66 to 70 of the General Taxation Law (Ley General Tributaria).

DOCUMENT: Building access control
PERIOD: 1 month
LEGAL REF.: Instruction 1/1996 of the Spanish Data Protection Agency (AEPD).

DOCUMENT: Video surveillance
PERIOD: 1 month
LEGAL REF.: Instruction 1/2006 of the Spanish Data Protection Agency (AEPD) Organic Law 4/1997.

Browsing data

Related to the browsing data that may be processed through the website, in case data submitted to the regulations are collected, we recommend consulting the Cookies Policy published on our website.

In case the owner withdraws the Subject’s Rights

The data protection regulations bestow to the interested parties or data owners, users of the website or users of CALZADOS ARRAYÁS, S.L.'s social network profiles a number of rights.

The rights which attend the interested parties are:

- Right of Access: right to obtain information about the state of their own data; if they are processed, the purpose of the processing, the types of data that are processed, the recipient or types of recipients, the conservation period and the origin of the data.

- Right of rectification: right to obtain the rectification of inaccurate or incomplete personal data.

- Right of erasure: right to obtain the erasure of the data in the next scenarios:

•    When the data are no longer necessary for the purpose for which they were collected.
•    When the data owner withdraws the consent.
•    When the interested party refuses the processing.
•    When the data must be erased in compliance with a legal obligation.
•    When data have been obtained under an information society service on the basis of the article 8(1) of the European General Data Protection

Regulation.

-Right of objection: right to object a particular processing based in the interest party’s consent.
-Right of limitation: right to obtain the limitation of the data processing in the next scenarios:

•    When the interested party contests the accuracy of the personal data for a period of time that allows the company to verify it.
•    When the processing is illicit and the interested party objects to the erasure of the data.
•    When the company no longer needs the data for the purposes for which they were collected, but the interested party needs them for the formulation, the exercise or the defense of claims.
•    When the interested party objects to the processing while it is verified if the company’s legitimate causes prevail against the interested party.

- Right of portability: right to obtain the data in a structured, commonly used and machine-readable form and to communicate it to another processing controller when:

•    The processing is based on consent.
•    The processing is done by automated means.

- Right to file a claim on the competent supervisory authority.

The interested parties may exercise the mentioned rights in writing, addressing CALZADOS ARRAYÁS, S.L. and sending to the following address: info@thehouseoftheboot.com, indicating the right that they want to exercise in the Subject line.

CALZADOS ARRAYÁS, S.L. will respond your application as soon as possible, considering the deadlines set out in the regulations of the data protection.

Security

The security measures adopted by CALZADOS ARRAYÁS, S.L. are those required, in accordance with the terms of the article 32 of GDPR.

Accordingly, CALZADOS ARRAYÁS, S.L., considering the state of the technique, the application costs and the nature, the context, the purposes of the processing, as well as the variable risks of probability and severity for the rights and the freedom of the natural person, has stablished the appropriate technical and organizational measures to guarantee the proper level of security to the existing risk.

In any case, CALZADOS ARRAYÁS, S.L. has implemented the necessary mechanisms to:

a) Guarantee the regular confidentiality, integrity, availability and resilience of processing systems and services.
b) Restore the availability and the access to personal data rapidly, in case of physical or technical incident.
c) Regularly verify, evaluate and value the efficiency of the technical and organizational measures implemented to guarantee the processing security.
d) Pseudonymise and encrypt personal data, where appropriate.