Privacy Policy

WEBSITE PRIVACY POLICY

casa-joya.com

1. PRIVACY POLICY AND DATA PROTECTION

In accordance with current legislation, JAMES RICE, hereinafter also referred to as CASA JOYA, undertakes to adopt the necessary technical and organisational measures, according to the level of security appropriate to the risk posed by the data collected on this Website, hereinafter also referred to as casa-joya.com.

Identity of the controller of personal data

The controller of the personal data collected on casa-joya.com is: JAMES RICE, holder of Tax Identification Number (NIF): X5391875P, whose representative is: (hereinafter, the Data Controller). The contact details are as follows:

Address:

JAMES RICE
La Losilla, Carretera A327, Velez Rubio, Almeria 04820
Contact telephone: 699 00 50 24
Contact email: info@casa-joya.com

Data Protection Officer (DPO)

The Data Protection Officer (DPO) is responsible for ensuring compliance with the data protection regulations to which JAMES RICE is subject. Users may contact the DPO appointed by the Data Controller using the following contact details: .

1.1. Access and hosting data
You may visit our website without having to identify yourself. Whenever a website is accessed, the web server automatically saves only a file known as a server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transmitted and the access provider (access data), and which records the access. This access data is analysed solely to ensure that the website functions properly and to improve our offering. Under Article 6(1)(f) of the GDPR, this serves to safeguard our overriding legitimate interest in the proper presentation of our offering, following a balancing of interests. All access data is deleted no later than seven days after your visit to the website.

1.2. Collection and use of data for contract performance and when creating a customer account
We collect personal data when you voluntarily provide it to us as part of your communications with us, when you contact us (e.g. via the contact form or email) or when you open a customer account. Mandatory fields are marked as such because, in these cases, we require the information to process the contract, handle your enquiry or open your customer account. Without this information, you will not be able to complete the order and/or account registration or send the intended message. The relevant data entry forms specify which information is collected. We use the data you provide under Article 6(1)(b) of the GDPR to perform the contract and handle your requests. Further information on the processing of your data, particularly its transfer to our service providers for processing orders, payments and deliveries, can be found in the following sections of this Privacy Policy. Once the contract has been fully performed or your customer account has been deleted, further processing of your data will be restricted and the data will be deleted upon expiry of the retention periods prescribed by tax and commercial legislation, in accordance with Article 6(1)(b) of the GDPR, unless you have expressly consented to further use of your data under Article 6(1)(a) of the GDPR or we reserve the right to use your data for other purposes permitted by law and explained in this statement. You may delete your customer account at any time by sending a message to the contact address indicated in this Privacy Policy or by using a feature provided for this purpose within your customer account.

1.3. Sending commercial communications

1.3.1. Newsletter
In accordance with Article 6(1)(a) of the GDPR, where we have obtained your prior express consent to subscribe to our newsletter, we will use the data required for this purpose to send commercial communications in accordance with that consent. You may unsubscribe from the newsletter at any time by sending a message to the contact address stated here or by clicking the unsubscribe link provided in the email containing the commercial communication. After you unsubscribe, we will block your email address from being used for this purpose, unless you have expressly consented to the continued use of your data or we reserve the right to continue using your data in cases permitted by law and described in this document.

1.3.2. Sending commercial information about products similar to those previously purchased
In accordance with Article 21.2 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, if we receive your email address in connection with the sale of goods or provision of services and you have not objected, we reserve the right to regularly send you offers by email concerning our company’s products that are similar to those you have already purchased. This is intended to safeguard our legitimate interests, following a balancing of interests, in commercial communication with customers under Article 6(1)(f) of the GDPR. You may object to this use of your email address at any time via the relevant link in the advertising email or by sending a message to the email address provided here, at no additional cost other than the basic transmission charges.

1.4. Categories of personal data

The categories of data processed by CASA JOYA include both identification data and special categories of personal data within the meaning of Article 9 of the GDPR and Article 9 of Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights.

Special categories of personal data are understood to include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data used to uniquely identify a natural person; data concerning health; and data concerning a natural person’s sex life or sexual orientation.

For the processing of special categories of personal data, the User’s explicit consent will in all cases be required for one or more specific purposes.

1.5. Other recipients of personal data

The User’s personal data will be shared with the following recipients or categories of recipients:

Google Analytics: a web analytics service provided by Google, Inc., a Delaware company whose principal office is at 1600 Amphitheatre Parkway, Mountain View, California, CA 94043, United States (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help casa-joya.com analyse how users use the website. The information generated by the cookie about your use of casa-joya.com (including your IP address) will be transmitted directly to, and stored by, Google on servers in the United States.

Hosting: INTERIBÉRICA, based in Spain at C/ DAMA, 68, ALMERÍA. More information at:
https://www.interiberica.com/ INTERIBÉRICA processes data in order to provide hosting services to CASA JOYA.

If the Data Controller intends to transfer personal data to a third country or an international organisation, at the time the personal data is obtained the User will be informed of the third country or international organisation to which the data is intended to be transferred, as well as the existence or absence of an adequacy decision by the European Commission.

1.6. Personal data of minors

In accordance with Article 8 of the GDPR and Article 7 of Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights, only persons over the age of 14 may lawfully consent to the processing of their personal data by CASA JOYA. In the case of a child under the age of 14, the consent of a parent or guardian will be required for processing, which will be considered lawful only to the extent that it has been authorised by them.

1.7. Confidentiality and security of personal data

JAMES RICE undertakes to adopt the necessary technical and organisational measures, according to the level of security appropriate to the risk posed by the data collected, to ensure the security of personal data and prevent the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or unauthorised disclosure of or access to such data.

The Website has an SSL (Secure Sockets Layer) certificate, which ensures that personal data is transmitted securely and confidentially, as the transmission of data between the server and the User, and vice versa, is fully encrypted.

However, because CASA JOYA cannot guarantee that the Internet is completely secure or that hackers or other persons will never fraudulently access personal data, the Data Controller undertakes to notify the User without undue delay in the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons. In accordance with Article 4 of the GDPR, a personal data breach means a breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or to the unauthorised disclosure of or access to such data.

Personal data will be treated as confidential by the Data Controller, who undertakes to inform employees, associates and any other persons to whom the information is made accessible of their duty of confidentiality and to ensure that this confidentiality is respected through a legal or contractual obligation.

1.8. Social media

1.8.1. Facebook and Instagram social plugins
Social media buttons are used on our website. These are embedded on the page solely as HTML links, so no connection to the servers of the respective provider is established when our website is visited. If you click one of the buttons, the website of the relevant social network will open in a new browser window. There, you can click the “Like” or “Share” button, for example.

1.8.2. Our online presence on Facebook
Provided that you have given your consent to the social media operator in accordance with Article 6(1)(a) of the GDPR, data generated when you visit our social media presence will be automatically collected and stored for market research and advertising purposes, and user profiles will be created using pseudonyms. These may be used, for example, to place advertisements within and outside the platforms that correspond to your interests. Cookies are generally used for this purpose. For detailed information on the processing and use of data by the social media operator, as well as contact options and your rights and settings for protecting your privacy, please refer to the provider’s data protection information available via the link below. If you still need assistance in this regard, please contact us. Facebook is a service offered by Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook Ireland”). Information automatically collected by Facebook Ireland about the use of our online presence on Facebook is generally transferred to and stored on a server operated by Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. The European Commission has not issued an adequacy finding for the USA. Our cooperation is based on the European Commission’s standard data protection clauses. The processing of data arising from a visit to a Facebook fan page is based on an agreement between the responsible parties in accordance with Article 26 of the GDPR. Further information can be found here.

1.9. How long do we store your personal information?

We store your personal information only for as long as it is necessary to use it for the purpose for which it was collected and in accordance with the legal basis for processing under applicable law. We will retain your personal information for as long as there is a contractual and/or commercial relationship with you, or until you exercise your right to erasure and/or restriction of processing of your data.

In these cases, we will keep the information duly blocked, without using it, for as long as it may be necessary to establish, exercise or defend legal claims, or where judicial, legal or contractual liability may arise from its processing and the information needs to be retrieved for that purpose.

1.10. Rights of data subjects
As a data subject, you have the following rights under the General Data Protection Regulation (GDPR):
• Under Article 15 of the GDPR, the right to obtain information about the personal data concerning you that we process, to the extent specified therein;
• Under Article 16 of the GDPR, the right to have inaccurate personal data concerning you rectified or incomplete personal data completed without undue delay;
• Under Article 17 of the GDPR, the right to obtain the erasure of personal data concerning you, provided that processing is not necessary:
– for exercising the right to freedom of expression and information,
– for compliance with a legal obligation,
– for reasons of public interest, or
– for the establishment, exercise or defence of legal claims;
• Under Article 18 of the GDPR, the right to obtain restriction of processing of your data where:
– you contest the accuracy of the data,
– the processing is unlawful and you oppose the erasure of the data,
– we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or
– you have objected to processing under Article 21 of the GDPR;
• Under Article 20 of the GDPR, the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller;
• Under Article 77 of the GDPR, the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority of your habitual place of residence, place of work or our company’s registered office.

If you have any questions about the collection, processing or use of your personal data, or wish to obtain information, rectify, block or erase data, withdraw consent previously given or object to a particular use of your data, please contact us directly at the address provided in the Legal Notice.

Right to object
Where we process personal data as described above to safeguard our overriding legitimate interests following a balancing of interests, you may object to such processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time, as indicated above. If the processing is carried out for other purposes, you will have a right to object only on grounds relating to your particular situation.

Once you have exercised your right to object, we will no longer process your personal data for those purposes unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

This does not apply where processing is carried out for direct marketing purposes. In that case, your personal data will no longer be processed for that purpose.

1.11. Complaints to the supervisory authority

If the User considers that there is a problem or a breach of current regulations in the way their personal data is being processed, they have the right to effective judicial protection and to lodge a complaint with a supervisory authority, particularly in the country of their habitual residence, place of work or the place of the alleged infringement. In Spain, the supervisory authority is the Spanish Data Protection Agency (http://www.agpd.es).

II. COOKIE POLICY

Cookies are small amounts of information stored in the browser used by each User—on the various devices they may use to browse—so that the server can remember certain information, which will subsequently be read only by the server that placed the cookie. Cookies make browsing easier and more user-friendly, and do not harm the device used to browse.

Use of the Website implies acceptance of its Privacy and Cookie Policy. Please read the Cookie Policy here: Cookie Policy.

III. ACCEPTANCE OF AND CHANGES TO THIS PRIVACY POLICY

The User must have read and agreed to the personal data protection conditions contained in this Privacy and Cookie Policy, and must consent to the processing of their personal data so that the Data Controller may process it in the manner, for the periods and for the purposes indicated. Use of the Website implies acceptance of its Privacy and Cookie Policy.

CASA JOYA reserves the right to amend its Privacy and Cookie Policy at its own discretion or as a result of legislative, judicial or interpretative changes by the Spanish Data Protection Agency. Changes or updates to this Privacy and Cookie Policy will not be explicitly notified to the User. Users are advised to check this page periodically to stay informed of any changes or updates.