Customer Privacy Policy

CUSTOMER PRIVACY POLICY  

Data Controller

Data Controller: SMILEAT, S.L. (hereinafter, SMILEAT)

Tax ID: B-87.144.622

Postal address: Calle Gran Vía, 62, 5º D – 28013 Madrid

Email: info@smileat.com

Purposes of processing

We will process your data to manage the relationship established through this contract and, specifically, to:

(i) Management of the contractual relationship for product purchase. Manage the purchase and delivery of the various SMILEAT food products. Manage customer discounts and points earned, as well as payments made by customers.

(ii) Contract formalization. Delivery management. Management of the Help Center and after-sales service, aimed at handling inquiries, incidents, shipments, deliveries, and orders, using the channels SMILEAT deems appropriate (emails, phone calls, SMS, PUSH notifications, regular mail, etc.). Management of collection, accounting, tax, and administrative matters. Handling claims procedures before judicial or administrative bodies.

(iii) Customer registration. SMILEAT will record the customer's personal data when purchasing the product and completing the corresponding forms; likewise, it will record data of minors indicated by customers to obtain discounts or points.

(iv) Manage a secure relationship with customers. Your data may be processed to carry out fraud prevention actions in contracting if evidence of fraud arises in the current contracting process, including the creation of a list enabled for this purpose.

(v) Sending commercial communications. Carry out promotional, advertising, or commercial actions and communications through various means, including electronic media, provided you give your express consent. We inform you that you can revoke your consent at any time via the automatic link included for this purpose in the commercial communications you receive, if applicable, or by email addressed to info@smileat.com. In the event that you express your wish that your data not be processed for sending commercial communications, SMILEAT informs you that you can register in advertising exclusion systems. For this purpose, you can consult the information published by the Spanish Data Protection Agency, as the competent supervisory authority. Refusal to give your consent will make processing for these purposes impossible.

(vi) Preparation of statistics and conducting surveys. Likewise, we may process your data to prepare statistics and conduct quality surveys of our products in order to make improvements, marketing actions, and developments, previously authorized by the customer and that do not involve the creation of profiles and developments.

SMILEAT informs you that it will not make automated decisions based on the profiles of data subjects.

Legal basis for processing your data

The legal basis for processing your data for the purposes detailed in the previous section are as follows:

o (i) (ii) Art. 6.1 b) GDPR: performance of a contract or for the application of pre-contractual measures; although handling claims before certain bodies or judicial authorities will be carried out in compliance with a legal obligation.

o (iii) Art. 6.1.a) GDPR: by the customer's consent. In the case of collecting personal data from minors under 14 years old, the consent of the parents or guardians will be required, through the checkboxes provided for this purpose in the corresponding forms.

o (iv) Art. 6.1.c) GDPR: compliance with a legal obligation.

o (v) Art. 6.1 a) GDPR: by the consent of the data subject, which may be revoked at any time. For sending commercial communications electronically, the customer's consent will be required. Such consent may be revoked at any time.

o (vi) Art. 6.1 f) GDPR: legitimate interest. The processing of your data based on legitimate interests will be carried out, in any case, with the utmost rigor and respect for your privacy, rights, and freedoms; and in no case will it be used for purposes that undermine your rights in this regard.

o (v) Art. 6.1 a) GDPR: by the consent of the data subject. For sending commercial communications electronically, the customer's consent will be required. Such consent may be revoked at any time., without in any case the withdrawal of this consent affecting the execution of the General Terms and Conditions of Sale signed with SMILEAT.

For any other purpose not expressly foreseen, your consent will be required, which may be revoked at any time.

Recipients

SMILEAT does not foresee data communications to third parties, except those required by legal obligation, which will be carried out, in any case, complying with all legally provided guarantees. In other cases, SMILEAT will request your explicit consent or another basis of legitimacy.

Notwithstanding the above, SMILEAT informs you that, exceptionally, your data may be processed by SMILEAT or by third-party companies contracted by SMILEAT. In such cases, the corresponding contract will be signed between the parties, with the indispensable requirement for formalizing this contract being that the service provider is aware of the existing personal data protection regulations and guarantees compliance during the contract's execution.

Data processed

The personal data processed by SMILEAT has been provided by you yourself, by completing the corresponding registration and/or contract subscription forms, or discount forms.

SMILEAT informs you about the processing of the following categories of data:

· Basic data: Customer's first and last name (voluntarily, you may provide the date of birth in the case of minors, when the customer opts to apply a discount)

· Contact details: Postal address, email address, phone number.

· Payment methods: bank details

Data accuracy and age of majority. You guarantee that you are of legal age or over fourteen years old to give your consent in accordance with current data protection regulations and that the data provided is true, accurate, complete, and up to date, being responsible for any direct or indirect damage or harm that may result from failure to comply with this obligation.

International Data Transfers

No international data transfers are planned. However, if SMILEAT's activity requires transferring your data to a third country outside the European Union or to a country that does not have an adequate level of protection as declared by the European Commission, it will adopt the appropriate safeguards to carry out such international transfers in accordance with applicable current legislation.

Data accuracy

You guarantee that the data provided is true, accurate, complete, and up to date, being responsible for any direct or indirect damage or harm that may result from failure to comply with this obligation.

Rights

You can exercise the rights granted by the applicable current regulations: right of access, rectification, deletion, and objection, restriction of processing, data portability, and not to be subject to automated individual decisions.

  • Access: allows the data subject to obtain information about whether SMILEAT processes personal data concerning them or not and, if so, the right to obtain information about their personal data being processed.
  • Rectification: allows correcting errors and modifying data that are inaccurate or incomplete.
  • Deletion: allows data to be deleted and no longer processed by SMILEAT unless there is a legal obligation to retain them and/or other legitimate reasons for their processing by SMILEAT under current regulations prevail.
  • Restriction: under legally established conditions, allows the processing of data to be suspended, so that SMILEAT avoids processing it in the future, only retaining it for the exercise or defense of claims.
  • Objection: allows the data subject, under certain circumstances and for reasons related to their particular situation, to object to the processing of their data. SMILEAT will stop processing the data, except for legal reasons or the exercise or defense of possible claims.
  • Portability: allows the data subject to receive their personal data and to transmit it directly to another controller in a structured, commonly used, and machine-readable format. To exercise this right, the data subject must provide a valid email address.

You can exercise your rights by any means that allow proof of sending and receiving your request. The request must be addressed to SMILEAT through the contact details included in the "Data Controller" section, indicating the reference "Data Protection." The request must include: first name, last name, the specific request being made, and an address for notification purposes. If there are doubts about your identity, any procedure that allows verification of the person should be used, but without requiring a copy of the ID.

If you are not satisfied with SMILEAT's response to the exercise of your rights, you have the right to file a complaint with the Supervisory Authority, the Spanish Data Protection Agency, for their protection.

Without prejudice to the above, anyone has the right to obtain confirmation as to whether SMILEAT is processing personal data concerning them or not.

Retention of your data

SMILEAT informs you that it will process and store your data as long as necessary according to the purpose and legal basis of the processing for which they were collected, and provided that you do not object or expressly revoke your consent if that was the basis of legitimacy.

We also process your data to comply with the requirements of applicable law, prevent unlawful actions, resolve disputes, solve problems, execute our contract, and other actions permitted by law.

We will keep your personal data during the legal retention periods, in accordance with the applicable current legislation and the general and sector-specific regulations applicable to SMILEAT.

Once the processing of your data is no longer necessary and the legal retention periods have expired, we will delete and/or block them in accordance with our data retention and deletion policy.

If you formalize your contract electronically, SMILEAT processes your data under secure levels. For this purpose, credit card transactions will be transmitted through a secure SSL (Secure Socket Layer) server. When the letters "http" change to "https," the "s" means it is in an SSL area; your browser may also inform you of the site's security through a pop-up message. The SSL security protocol encrypts personal information during data transmission.

In accordance with industry standards, SMILEAT informs you that it maintains technical and organizational measures against accidental or illegal destruction, accidental loss or alteration, unauthorized disclosure or access, and other illegal forms or procedures.

In this regard, SMILEAT will adopt the appropriate security measures to prevent alteration, loss, processing, or unauthorized access to data. Likewise, it will inform those who have access to your data about their security, confidentiality, and secrecy obligations.