Privacy Policy

SAN SARU, S.L. (hereinafter, "the Company"), as Controller of your personal data, undertakes to adopt at all times the technical and organisational measures necessary to ensure that the processing of your data complies with Regulation (EU) 2016/679 (hereinafter, "GDPR") and Spanish Organic Law 3/2018.

The Company processes your personal data lawfully and fairly, ensuring that it receives adequate protection and is not misused. The Company also aims to be transparent in managing the personal data of its customers and users, providing them with all the necessary information on how their data is collected and processed.

The purpose of this Privacy Policy is to inform you about who will process your personal data, why we collect it, how long we will keep it, who we will share it with and what your rights are in this regard.

By providing us with your personal information and using our Website, we understand that you have read and understood the information on personal data protection set out in this Privacy Policy and in the Cookie Policy.

The Controller of your personal data is:

Depending on the products, services or features requested by customers and users, the Company will need to process different data, which will generally include the following:

• Identification and contact data: first name, surname, contact phone number, date of birth, postal address, email address and national ID number (DNI), among others.
• Data associated with the performance of a sales or service contract with the Company: identification and contact data, payment data, information on purchases, orders and returns, among others.
• Automatically collected data: when you interact with our Website, certain browsing data is collected automatically. This information is gathered through cookies, as detailed in the Company's Cookie Policy.

The information we may collect automatically relates to your use of our Website and the devices you use to access and interact with it. Some of the data we collect includes: the IP address of the device you are using, your browser, your operating system, the date and time you accessed the Website, the web address from which you accessed our Website, geolocation data, information on the pages you visited within the Website and the time spent on each page.

• Data on your personal tastes and preferences.

The personal data collected is processed for the following purposes:

• Managing the purchase of the products and services offered by the Company: to provide you with the product or service you request, to run our business internally (in terms of accounting, auditing and other internal functions) and to manage payment for products and services.
• Quality analysis: to carry out surveys on customer and user satisfaction with the quality of the products and services offered by the Company.
• Customer and user service: to handle and respond to your requests, enquiries and complaints for their management and resolution.
• Advertising and marketing: this mainly includes personalising the services we offer and making recommendations based on your interaction with the Company through its website (e.g. based on your purchase and browsing history). If you give us your consent, your personal data will be used to periodically send you information about new products that may interest you and to offer you promotions.
• Improving the user experience on the Website: to carry out analytical and statistical studies on how users browse the Company's Website.

The legal basis that allows us to process your personal data depends on the purpose for which we process it, as detailed below:

• Managing the purchase of the products and services offered by the Company. Processing your data is necessary for the proper conclusion and performance of the contractual relationship with the Company. The processing is also based on your own consent (when you decide to purchase our products or services) and on the Company's legitimate interest in carrying out the relevant checks to identify and prevent possible fraud, as well as for security reasons.
• Quality analysis. The processing of your data is based on the Company's legitimate interest in analysing customer and user satisfaction, in order to offer them products and services of the highest quality.
• Customer and user service. The processing of your data is based on the Company's legitimate interest in responding to your requests and complaints so that it can assist you properly and resolve your queries. In the case of complaints or incidents relating to the product or service purchased, processing your data is necessary for the Company to fulfil its contractual obligations. In the case of enquiries relating to the exercise of your legally recognised data protection rights, the Company needs to process your data in order to comply with its legal obligations in this area.
• Advertising and marketing. The legal basis for processing your data for advertising and marketing purposes is the consent you give us to send you commercial communications by email and SMS (which may be personalised) and the Company's legitimate interest in sending you communications about services or products similar to those you have purchased in the past or shown interest in.
• Improving the user experience on the Website. The processing of your data is based on the Company's legitimate interest in understanding user satisfaction and taking appropriate corrective measures to improve the quality of our services.

Last updated: 7 November 2024.

The San Saru mobile messaging service (the "Service") is operated by San Saru ("San Saru", "we", "us"). Use of the Service constitutes your acceptance of these terms and conditions ("Mobile Terms"). We may modify or cancel the Service or any of its features without prior notice. To the extent permitted by applicable law, we may also modify these Mobile Terms at any time, and your continued use of the Service after the effective date of such changes will constitute your acceptance of them.

By consenting to San Saru's SMS/text messaging service, you agree to receive recurring SMS/text messages from San Saru through your wireless provider to the mobile number you provided, even if your number is registered on any state or federal Do Not Call list. Text messages may be sent using an automatic telephone dialling system or other technology. Service-related messages may include updates, alerts and information (e.g. order updates, account alerts, etc.). Promotional messages may include promotions, special offers and other marketing messages (e.g. cart reminders).

You understand that you do not have to sign up to this programme in order to make purchases, and that your consent is not a condition of purchase at San Saru. Your participation in this programme is entirely voluntary.

We do not charge for the Service, but you are responsible for all charges and fees associated with text messaging imposed by your wireless provider. Message frequency varies. Message and data rates may apply. Check your mobile plan and contact your provider for details. You are solely responsible for all charges related to SMS/text messages, including charges from your wireless provider.

You can opt out of the Service at any time. Text the single keyword command STOP to SanSaru or click the unsubscribe link (where available) in any text message to cancel. You will receive a one-time opt-out confirmation message. No further messages will be sent to your mobile device unless you initiate them. If you have subscribed to other San Saru mobile messaging programmes and wish to cancel them, except where applicable law requires otherwise, you must cancel each programme separately by following the instructions provided in their respective mobile terms.

For support or assistance with the Service, text the command HELP to San Saru or email info@sansarushop.com.

We may change any short code or phone number we use to operate the Service at any time and will notify you of such changes. You acknowledge that any message, including STOP or HELP commands, that you send to a short code or number we have changed may not be received, and we will not be responsible for honouring requests made in such messages.

The wireless providers supporting the Service are not responsible for delayed or undelivered messages. You agree to provide us with a valid mobile number. If you get a new mobile number, you will need to sign up to the programme again with your new number.

To the extent permitted by applicable law, you agree that we will not be liable for failed, delayed or misdirected delivery of any information sent through the Service, for any errors in such information, and/or for any action you may or may not take in reliance on the information or the Service. We respect your right to privacy.

Your personal data will be kept for as long as strictly necessary to be used for the purpose for which it was collected.

Personal data will be stored, applying the appropriate security measures to guarantee its accuracy and integrity, for as long as its processing is necessary for the purpose for which it was collected or until you exercise your right to erasure or restriction of processing.

In such cases, we will keep your personal information blocked, without processing it in any way, for the periods established by law in order to address any possible liabilities and to demonstrate compliance with our legal and contractual obligations. After that, the Company will permanently delete your personal data.

In certain cases, in order to fulfil the purposes set out in this Privacy Policy, the Company needs to share your personal data with other Group companies and with the following third parties:

• financial institutions;
• technology and analytics service providers;
• logistics, transport and delivery service providers and partners, and/or their partner establishments;
• customer service providers;
• marketing and advertising service providers and partners;
• public authorities and bodies in order to: comply with a court order, summons or investigation, or for any other reason required by law; address possible liabilities arising from the processing of personal data; prevent unlawful use of our Website or breaches of our Website policies; respond to third-party claims; help prevent and investigate cases of fraud, among others.

These third-party partners only have access to the personal information necessary to provide the corresponding services and are required not to use it for any purpose other than the one requested. The Company also requires these third parties to apply the same level of protection and confidentiality that we apply when managing your personal information. In addition, all of them are subject to the obligations set out in their respective data processing agreements concluded with the Company.

Certain third-party partners are located in countries or territories outside the European Union. In these cases, the Company transfers your data to them in accordance with the safeguards required by law for such situations:

• we check whether the third party is located in a country or territory that the European Commission has declared to offer an adequate level of protection;
• failing that, we check whether any of the following safeguards apply: a contract containing standard data protection clauses approved by the European Commission; binding corporate rules approved by the competent supervisory authority; the third party's adherence to a Code of Conduct or certification mechanisms;
• failing that, in order to transfer your data we ask for your express consent or request the express authorisation of the competent supervisory authority.

You are entitled to exercise the following rights in relation to the processing of your personal data:

• Access (Art. 15 GDPR): allows you to obtain certain information about the purposes for which your data is being processed, the recipients to whom it is disclosed or the categories of data being processed, among others.
• Rectification (Art. 16 GDPR): allows you to ask the Controller to amend any personal data that is inaccurate and to complete any that is incomplete.
• Erasure (Art. 17 GDPR): allows you to request the erasure, without undue delay, of your personal data being processed by the Controller in the following cases: the Controller no longer needs the data for the purposes for which it was originally collected; the processing is based on your consent and you decide to withdraw it, provided there is no other processing based on a legal basis other than consent; you object to the processing of your data and the Controller's interests do not prevail, provided there is no other processing that cannot be objected to; the personal data has been processed unlawfully; the personal data must be erased to comply with a legal obligation; the data was collected in connection with the offer of information society services.
• Restriction of processing (Art. 18 GDPR): allows you to obtain from the Controller the restriction of the processing of your data where one of the following conditions applies: you contest the accuracy of your personal data, for a period enabling the Controller to verify its accuracy; the processing is unlawful and you oppose the erasure of your personal data and request the restriction of its use instead; the Controller no longer needs your personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims; you have objected to the processing, pending verification of whether the Controller's legitimate grounds override yours.
• Portability (Art. 20 GDPR): allows you to receive your personal data, or to have it transmitted to a third party, in a structured, commonly used and machine-readable format, provided that both of the following conditions are met: the Controller's legal basis for processing your data is your consent or the performance of a contract; the processing is carried out by automated means.
• Objection (Art. 21 GDPR): allows you to object to the processing of your data by the Controller. However, you can only exercise this right against processing based on a public interest or on the Controller's legitimate interest.
• Objection to automated processing (Art. 22 GDPR): allows you not to be subject to decisions based solely on the automated processing of your data, including profiling, which produce legal effects concerning you or similarly significantly affect you.

To exercise your data protection rights, the Company provides the following means:

• By written and signed request addressed to the Company at Alcalde Josep Abril 23, 1º 1ª, 08302, Mataró (Barcelona), stating the reason for your request and the right you wish to exercise, together with a photocopy of your ID card or an equivalent document proving the applicant's identity.
• By sending the completed and signed form, together with a photocopy of your ID card or an equivalent document proving the applicant's identity, to the email address: info@sansarushop.com

Below are the forms for exercising each right:

• Right of access: form
• Right to rectification: form
• Right to erasure: form
• Right to restriction of processing: form
• Right to data portability: form
• Right to object: form
• Right to object to automated processing: form

You also have the right to lodge a complaint with the competent data protection supervisory authority regarding any issue arising from the processing of your personal data: the Spanish Data Protection Agency, AEPD (Complaint submission form).