This Legal Notice regulates the use of the Internet portal service at https://www.otxaran.com/, whose responsible party for identification purposes is:
- Responsible party: Bodegas Virgen de Lorea S.L.
- Tax ID: B95628814
- Address: Barrio La Flor 2, Otxaran, 48860, Bizkaia
- Telephone: (+34) 94 667 18 71
- Email: info@bodegasvirgendelorea.com
- Registered in the Mercantile Registry of Bizkaia, volume 5178, folio 142, sheet no. BI57661, 1st registration.
The Responsible Party guarantees compliance with current regulations on the protection of personal data, as set out in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (GDPR), and in Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
Principles: Which principles do we apply when processing data?
• Principle of lawfulness, fairness, and transparency: The Responsible Party will always request consent for the processing of personal data, which may be for one or more specific purposes, about which the Responsible Party will inform the User beforehand with complete transparency.
• Principle of data minimization: The Responsible Party will request only the data strictly necessary for the purpose or purposes for which it is requested.
• Principle of storage limitation: The Responsible Party will retain the collected personal data only for the strictly necessary period for the purpose or purposes of the processing.
• Principle of integrity and confidentiality: The collected personal data will be processed in such a way that their security, confidentiality, and integrity are guaranteed. The Responsible Party takes the necessary precautions to prevent unauthorized access or misuse of users’ data by third parties.
Purpose: What do we process your data for?
When you connect to the Website to send an email to the Responsible Party, write a comment on an article or page, or subscribe to its newsletter, you are providing personal information for which the Responsible Party is responsible.
The personal data and the purpose of processing by the Responsible Party vary depending on the information capture system:
• Contact forms: The Responsible Party requests personal data that may include name and surname, email address, telephone number, and website address for the purpose of responding to user inquiries.
• Newsletter form: By subscribing, you authorize the Responsible Party to send you commercial communications about products and services related to the activity of the website managed by the Responsible Party.
• Purchase form: To make a purchase, the Responsible Party requests personal data that may include name and surname, email address, telephone number, address, and financial data for the purpose of processing your order.
Completion of the registration form will be mandatory in order to access and enjoy certain services offered on the website. Failure to provide the requested personal data or failure to accept this data privacy policy will make it impossible to register, subscribe, or participate in any promotions that require personal data.
Data origin: Where do we obtain your data?
The personal data collected comes directly from the information provided by the interested parties through the Responsible Party’s website. To browse the Website, it is not necessary to provide any personal data.
The Responsible Party obtains your data:
• When contacting through contact forms, quick purchase forms, or by sending an email.
• When subscribing to a subscription form or newsletter.
Legal basis: What is the legal basis for processing your data?
The legal basis for processing your data will be:
• The consent of the data subject, for the processing of their data, in accordance with Article 6(1)(a) of the General Data Protection Regulation. In this case, the processing will be carried out to respond to users who contact the Responsible Party via instant messaging systems, as well as through the forms on the Responsible Party’s website, with the user enabling the checkbox “I have read and accept the privacy policy.”
• The necessary performance of a contract to which the data subject is a party or the application, at the request of the data subject, of pre-contractual measures, in accordance with Article 6(1)(b) of the General Data Protection Regulation.
Recipients:To whom do we disclose your data?
Personal data will not be disclosed except in compliance with legally established obligations or to support services related to this processing.
Retention: How long do we keep your data?
We will retain your personal data for at least 5 years if you are a customer, in order to strictly comply with the legal obligations established by applicable regulations.
If you are not a customer, we will retain your data for the minimum time necessary to manage our relationship.
Cookie policy
For this Website to function properly, it needs to use cookies, which are information stored in your web browser.
You can consult all information regarding the cookie collection and processing policy on the Cookie Policy page.
Rights: What are your rights when you provide us with your data?
As a result of the processing of your personal data by the Responsible Party, current legislation grants you a number of rights. Below is a brief explanation of each right to facilitate their exercise:
– Right of access: You have the right to know which personal data we process about you and for what purposes.
– Right of rectification: Your data always belongs to you, and as such, you may request its rectification at any time if the data recorded in our records is incorrect.
– Right of erasure: You may request at any time that your personal data be deleted from our files. However, as indicated in the data retention section above, please note that in certain circumstances compliance with current legislation may prevent the effective exercise of this right.
– Right to object: You may object to the processing of your data in relation to any of the purposes for which we process your data, in accordance with the applicable privacy policies.
– Right to restriction of processing: You may request restriction of processing in the following cases:
– If you believe that the data we hold about you is not accurate or correct;
– If you believe that we are not processing your data lawfully, but you prefer that we restrict its processing rather than delete it;
– If the data we hold is no longer necessary for the purposes for which it was collected, but you need us to retain it for the establishment, exercise, or defense of legal claims;
– If, having exercised your right to object to any processing, you are awaiting a response from us.
– Right to data portability: You will have the right, whenever technically possible and reasonable, to request that the personal data you have directly provided to us be communicated to another data controller. Where possible, we will provide your data directly to that other controller; otherwise, we will provide it to you in a standard format.
Whenever we process your data based on consent, you may withdraw it at any time, without consequences for you beyond, depending on the right exercised, not being able to provide certain services.
You may exercise your rights by contacting the Responsible Party through one of the following means:
-
By email to: pedidos@bodegasvirgendelorea.com
-
By postal mail addressed to the corresponding Data Controller (as stated at the beginning of this document).
If you do not wish to exercise a specific right but need to make an inquiry or suggestion regarding the processing of your personal data, you may also contact the corresponding Data Controller (as stated at the beginning of this document).
Please note that you may, in any case, file a complaint with the competent Data Protection Authority if you believe that we have not processed your data lawfully or have not properly addressed your requests or rights. In Spain, the competent authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
Minors’ consent: What happens if you are underage?
If any of our services are specifically directed at minors under fourteen years of age, we will request the consent of parents or guardians for the collection of personal data or, where applicable, for the automated processing of such data in accordance with Article 7 of the LOPDGDD.
Accuracy, truthfulness, and security of data: How do we process your data?
The User is solely responsible for the truthfulness and accuracy of the data provided, and we are released from any liability in this regard. Users guarantee and are responsible, in any case, for the accuracy, validity, and authenticity of the personal data provided and undertake to keep it duly updated. The user agrees to provide complete and correct information in registration or subscription forms. We are not responsible for the accuracy of information that is not of our own creation and for which another source is indicated, nor do we assume any liability for potential damages arising from the use of such information.
We also reserve the right to update, modify, or delete the information contained on the website and may even limit or deny access to such information. We shall not be liable for any damage or harm suffered by the User as a result of errors, defects, or omissions in the information provided by the Responsible Party, provided that it comes from external sources.
Data will be processed confidentially and subject to appropriate technical and organizational security measures to prevent alteration, loss, unauthorized processing, or access.
You may file a complaint with the Spanish Data Protection Agency, especially when you have not obtained satisfaction in the exercise of your rights, at the postal and/or electronic address indicated on the website www.aepd.es.