Adition information on data protection

Farmacia Gayà – Sastre CB(hereinafter, “the Company”) undertakes, as Responsible for the processing of your personal data, to adopt the necessary technical and organizational measures in order to guarantee that the processing of your data is in accordance with the provisions of the Regulation (EU ) 2016/679 (hereinafter, “RGPD”) and Organic Law 3/2018.

The Company treats your personal data in a lawful and loyal manner, ensuring that they receive adequate protection and that they are not misused. Likewise, the will of the Company is to be transparent in the field of managing the personal data of its clients and users, making all the necessary information available to them regarding the collection and processing of their data.

The objective of the Privacy Policy is to inform you about who will process your personal data, why we collect this data, for how long we will keep the data collected, to whom we will transfer it and what your rights are in this area.

By providing us with your personal information and using our Website, we understand that you have read and understood the information regarding the protection of personal data set forth in this Privacy Policy and in the Cookies Policy.

1.Who is responsible for the processing of your data?

The person responsible for the processing of your personal data is:

Social denomination:Farmacia Gayà – Sastre CB

N.I.F: E56801673

Phone: 971837318

Mailing address:Plaça Sant Isidre 14 s’Horta 07669 Balearic Islands

Email:  info@farmaciashorta.es

2. For what purpose do we process your personal data?

Depending on the products, services or functionalities requested by customers and users, the Company will need to deal with some data or others, which in general will be the following:

• Data identification and contact: name, surname, contact telephone number, Curriculum vitae, postal address, email and ID, among others;

• Data collected automatically: When you interact with our Website, certain browsing data is automatically collected. This information is collected through cookies, the regulation of which is detailed in the Company’s Cookies Policy;

The information we may collect automatically relates to your use of our Website and the devices you use to access and interact with it. Some of the data we collect are: the IP address of the device you are using, the browsing program you are using, your operating system, the date and time of access to the Website, the Internet address of the website through which you accessed our Website, geolocation data, information on the pages visited by the user within the Website and the browsing time on each page;

• Data about yourpersonal tastes and preferences.

The personal data collected is processed for the following purposes:

• Manage the contracting of products and services offered by the Company: to be able to provide you with the product or service you request, to be able to operate our business internally (in terms of accounting, auditing and other internal functions) and manage payment for the products and services;

• Queries and requests for proposals sent through forms:Blog participation through comments, participation in social networks such as Facebook, Instagram, Whatsapp, sending CVs and Cover Letters.

• quality analysis: carry out surveys on the satisfaction of customers and users in relation to the quality of the products and services offered by the Company;

• Customer and user service: channel and respond to your requests, queries and claims for their management and resolution;

• Advertising and marketing actions: mainly includes customizing the services we offer and making recommendations based on interaction with the Company through its website (eg, based on purchase and browsing history). If you give us your consent, your personal data will be used to periodically send you information about new products that may be of interest to you and offer you promotions;

• Curriculum vitae: the possibility of including the curriculum vitae to be part of the pharmacy professionals.

Improve the user experience on the Website: carry out analytical and statistical studies on how users browse the Company’s Website.

3. What is the legitimation for the processing of your data?

The legal basis that allows us to process your personal data depends on the purpose for which we process it, as detailed below:

• Manage the contracting of products and services offered by the Company.The processing of your data is necessary for theproper execution and proper development of the contractual relationshipwith the company. The legitimacy of the processing of your data also resides in your ownconsent(when deciding to hire our products or services) and in thelegitimate interestof the Company to carry out the pertinent checks in order to identify and prevent possible fraud, as well as for security reasons;

• quality analysis. The legitimacy of the processing of your data resides in thelegitimate interestof the Company to analyze the degree of satisfaction of customers and users, in order to be able to offer them products and services of the best quality;

• Attention to users and customers. The legitimacy of the processing of your data resides in thelegitimate interestof the Company to attend to your requests and claims in order to attend you properly and resolve your requests. In the case of claims or incidents related to the product or service purchased, the processing of your data is necessary so that the Company canfulfill contractual obligations. In case of queries related to the exercise of your legally recognized rights in terms of data protection, the Company requires the processing of your data tocomply with legal obligationsthat bind it in this field;

• Advertising and marketing actions. The legal basis for processing your data for advertising and marketing purposes is theconsentthat lends us to send commercial communications (which can be personalized) and thelegitimate interestof the Company to send you communications similar to those services or products contracted in the past or for which you have shown interest.

• Curriculum vitae: The legal basis of the treatment is the consent that the candidate gives us to be able to access the curriculum vitae.

Remember that if you have given us your consent for the processing of your data for any purpose, you have the right to withdraw it at any time.

• Improve the user experience on the Website.The legitimacy of the processing of your data resides in thelegitimate interestof the Company to know the degree of user satisfaction and adopt the appropriate corrective measures to improve the quality of our services.

 4. For how long will we keep your data?

Your personal data will be duly kept for the essential time to be able to be used according to the purpose for which they were collected.

Personal data will be stored, applying the appropriate security measures to guarantee its accuracy and integrity, as long as its processing is necessary for the purpose for which it was collected or as long as you do not exercise your right to suppress or limit processing.

In such cases, we will keep your personal information blocked, without giving it any treatment, during the periods established by law to attend to eventual responsibilities and to be able to prove compliance with our legal and contractual obligations. Subsequently, the Company will permanently delete your personal data.

5. With who can we share your data?

Your personal data will be processed by members of the Company who act on behalf of the organization and in relation to whom the corresponding contracts have been perfected, which include specific obligations of confidentiality and diligent management of personal data in accordance with the legislation in the present scope.

In certain cases, in order to comply with the purposes set forth in this Privacy Policy, the Company needs to share your personal data with other Group companies and with the following third parties:

• financial entities;
• technology and analytics service providers;
• providers and collaborators of logistics, transport and delivery services, and/or establishments that collaborate with them;
• service providers relating to customer support;
• providers and collaborators of services related to marketing and advertising;
• authorities and public bodies to: respond to an order, summons or judicial investigation, or for any other cause required by law; attend to possible responsibilities derived from the processing of personal data; prevent illegal uses of our Website or violations of our Website policies; deal with third party claims; contribute to the prevention and investigation of cases of fraud, among others.

These third-party collaborators only have access to the personal information necessary to carry out the corresponding services and are required not to use it for any purpose other than the one requested. The Company also requires from these third parties the same degree of protection and confidentiality that we apply in the management of your personal information. Likewise, all of them are subject to the obligations set forth in their respective data processing contracts executed with the Company.

Certain third party collaborators are located in countries or territories located outside the European Union. In these cases, the Company transfers your data to them in accordance with the legally required guarantees for this type of situation:

• We verify if the third party is located in a country or territory that has been declared an adequate level of protection by the European Commission;
• In the absence of the above, we verify if any of the following guarantees apply:
  • conclusion of a contract that contains standard data protection clauses approved by the European Commission;
  • implementation of binding corporate standards, approved by the competent control authority;
  • the adherence of the third party to a Code of Conduct or certification mechanisms;

• In the absence of the above, to carry out the transfer of your data we request your express consent or request the express authorization of the competent control authority.

6. What are your rights?

You are entitled to exercise the following rights in relation to the processing of your personal data:

• access(art. 15 GDPR): allows you to obtain certain information about the purposes for which your data is being processed, the recipients to whom it is communicated or the categories of data that are being processed, among others.

• rectification(art. 16 GDPR): allows you to contact the Data Controller to modify inaccurate personal data and to complete incomplete data.

• suppression(art. 17 GDPR): allows you to request the deletion, without undue delay, of your personal data that is being processed by the Controller

• Limitation of treatment(art. 18 GDPR): allows you to obtain from the Controller the limitation of the processing of your data

• Portability(art. 20 GDPR): allows you to receive your personal data or have it sent to a third party, in a structured, commonly used and mechanically readable format

• Opposition(art. 21 GDPR): allows you to oppose the processing of your data by the Controller. However, you can only exercise this right against treatments covered by the legitimate basis of a public interest or a legitimate interest of the Responsible.

• Opposition to automated processing(art. 22 GDPR): allows you not to be subject to decisions based solely on the automated processing of your data, including profiling, which produce legal effects on you or significantly affect you in a similar way.

6.1 How can I exercise my rights?

In order to exercise your rights regarding data protection, the Company makes the following means available to you:

• By means of a written and signed request addressed to the Company, indicating the reason for your request and the right you wish to exercise, and must attach a photocopy of the DNI or equivalent document that proves the identity of the applicant;

• Sending the completed and signed form, attaching a photocopy of the DNI or equivalent document proving the applicant’s identity, to the email address: info@farmaciashorta.es

The forms to be able to exercise the different rights are provided below:

• Right of access:https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-acceso.pdf
• Right of rectification:https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-rectificacion.pdfv
• Right of erasure:https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-supresion.pdf
• Right to limit processing:https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-limitacion.pdf
• Right to portability:https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-portabilidad.pdf
• Opposition right:https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-oposicion.pdf
• Right to oppose automated processing:https://www.aepd.es/sites/default/files/2019-09/formulario-derecho-de-oposicion-decisiones-automatizadas.pdf

Likewise, you have the right to contact the corresponding competent control authority in matters of data protection, for any claim arising from the processing of your personal data: the Spanish Agency for Data Protection (https://www.agpd.es/portalwebAGPD/index-ides-idphp.php)

 7. Changes to the privacy policy

This Privacy Policy is subject to continuous review by the Company, modifying it whenever necessary in order to adapt it to current legislation at any time or to any variation on our Website.

For this reason, we recommend that you periodically review the Privacy Policy to stay informed about any news related to the processing of your personal data.