Privacy policy.

 

PRIVACY POLICY

This privacy policy applies to the processing of the personal data of customers and/or users of https://www.bullplanet.es, hereinafter the WEBSITE, whose data controller is Ismael Iglesias Martínez, hereinafter the DATA CONTROLLER.

Applicable legislation

Our Privacy Policy has been drawn up in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter EU GDPR 2016/679, and, insofar as it does not conflict with that Regulation, Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights, hereinafter Organic Law 3/2018.

By providing us with their data, the customer and/or user declares that they have read and understood this Privacy Policy and gives their unequivocal and express consent to the processing of their personal data in accordance with the purposes and terms set out herein.

Basic information on data protection

BASIC INFORMATION ON DATA PROTECTION

Controller

Ismael Iglesias Martínez

Purpose

Respond to information requests received; provide the services requested; process and manage orders from customers and/or users of the online store selling items and/or products; provide customer service; manage subscriptions to the newsletter; manage users’ comments on posts published on the website’s blog; and send commercial communications about our items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or other equivalent electronic communication channels, provided that the data subject has consented to the processing of their personal data for this purpose. Also manage payments for orders placed using the various payment methods available to users (card, Bizum, and installment financing), including the necessary transfer of data to financial institutions and payment platforms.

Legal basis

Performance of a contract to which the data subject is a party, or to take steps at the data subject’s request prior to entering into a contract. Legitimate interest of the controller. Consent of the data subject.

Recipients

No data will be disclosed to third parties, except where legally required.

Rights

You have the right to access, rectify and erase your data, as well as other rights indicated in the additional information, which you can exercise by contacting the data controller at info@bullplanet.es

Additional information

You can consult the additional and detailed information on Data Protection in the attached clauses available at https://www.bullplanet.es/pages/politica-de-privacidad

 

Additional information on data protection

The data controller is:

 

  • Identity: Ismael Iglesias Martínez
  • Tax ID: 50464050ª
  • Postal address: C/ Porthos 17 - 2º | 28011 Madrid (Spain)
  • Telephone numbers: (+34) 6660441297 | (+34) 690213171
  • Email address: info@bullplanet.es

 

Data Protection Officer

 

The DATA CONTROLLER has no Data Protection Officer.

Purposes and legal basis for processing

  1. a) General:

The DATA CONTROLLER processes the personal data provided by its customers and/or users for the following purposes:

  • Purpose: to carry out administrative, commercial, accounting and tax management; handle requests for information received; respond to queries raised; handle and manage orders from customers and/or users of the online store for items and/or products; provide customer service; process subscriptions to the newsletter; manage user comments on posts published on the website’s blog; and send commercial communications about our items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic communication channels, provided that the data subject has consented to the processing of their personal data for this purpose. .manage user comments on posts published on the website’s blog, manage and process payment for orders placed using the various payment methods made available to the user (card, Bizum and installment financing with Klarna), including the necessary disclosure of data to financial institutions (CaixaBank), payment gateways (Craftgate) and financing platforms, as well as send commercial communications.

 

  • Legal basis for this processing: Performance of a contract to which the data subject is a party, or to take steps at the data subject’s request before entering into a contract. Legitimate interest. The data subject’s consent, which may be withdrawn at any time.

 

  1. b) Website forms:

The DATA CONTROLLER processes the personal data provided by customers and/or users through the electronic personal data collection forms on the WEBSITE for the purposes identified below:

Regarding the “Contact Form” and other inquiries (those that may be sent through the email accounts listed on the WEBSITE):

  • Purpose: Contact the data subject, handle requests for information received and answer questions raised, provide customer service, and send commercial communications about our items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic communication channels, provided that the data subject has consented to the processing of their personal data for this purpose.
  • Legal basis for this processing: Performance of a contract to which the data subject is a party or, at the data subject’s request, taking steps prior to entering into a contract. The data subject’s consent, which may be withdrawn at any time.

 

Regarding the “Newsletter Form”:

 

  • Purpose: Allows users to subscribe to the newsletter to receive the latest updates, offers and special discounts on our items and/or products by email.

 

  • Legal basis for this processing: The data subject’s consent, which may be withdrawn at any time.

 

Regarding the “Blog Form – Leave a comment”:

 

  • Purpose:Manage users’ comments on posts published on the website’s blog, as well as send commercial communications about our items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic communication channels, provided that the data subject has consented to the processing of their personal data for this purpose.

 

  • Legal basis for this processing: The data subject’s consent, which may be withdrawn at any time.

 

Regarding the “Sign Up Form”:

 

  • Purpose: Allows users to create an account to access the online store for items and/or products.

 

  • Legal basis for this processing: Performance of a contract to which the data subject is a party, or to take steps at the data subject's request prior to entering into a contract.

 

Regarding the “Sign In Form”:

 

  • Purpose: Allows registered users to access the online store using their username or email address and password to purchase the items and/or products made available to them.

 

  • Legal basis for this processing: Performance of a contract to which the data subject is a party, or to take steps at the data subject's request prior to entering into a contract.

 

In relation to the “Guest Checkout Form”:

 

  • Purpose:Allows users to purchase the items and/or products made available in the online store without having to register beforehand.

 

  • Legal basis for this processing: Performance of a contract to which the data subject is a party, or to take steps at the data subject's request prior to entering into a contract.

 

In relation to the “Live Support Form – Online Customer Service Platform”:

  • Purpose:Enables the user to communicate directly with the DATA CONTROLLER through Chat and WhatsApp (RoarTheme plugin for Shopify).

 

  • Legal basis for this processing:The data subject's consent, which may be withdrawn at any time.

When the data requested in the electronic forms is required, the DATA CONTROLLER will indicate that it is mandatory when collecting data from customers and/or users. Failure to provide it will mean that the corresponding request cannot be handled.

What types of data do we process?

 

For the purposes set out in the previous section, we process all of the Customer's data, which we can divide into the following sources and categories:

 

  1. a) Data provided directly by the customer and/or user: data provided directly by the customer and/or user, either when requesting the service by completing electronic personal data collection forms or paper forms provided for this purpose, or throughout the contractual relationship through various means, such as complaints or requests for information submitted to the Customer Service Department. The customer and/or user is responsible for ensuring that the data is accurate and up to date.

 

  • Identifying Data (first and last name, NIF, NIE, passport, postal address, email address, telephone, mobile phone, manual, handwritten or digitized signature, social media profiles, IP addresses, username and password)

 

  • Financial Data (bank details)

 

  1. b) Data obtained from sources other than the customer and/or user: data obtained from sources other than the customer and/or user, either with their consent or on any other legal basis (legitimate interest, compliance with a legal obligation…).

 

  1. c) Data arising from the commercial relationship: data provided indirectly by the customer and/or user as a result of the provision of the contracted service and the continuation of this activity. This category includes traffic data, payment or contracted item history, browsing data from the public website or access to the private area, and other similar data.

Record of processing activities

We inform you that the personal data obtained from the customer and/or user as a result of completing the electronic forms available on the WEBSITE form part of the CONTROLLER’s Record of Processing Activities (ROPA), which will be updated periodically in accordance with EU GDPR 2016/679 and LOPDGDD 3/2018.

 

Recipients

 

The data subjects’ personal data will be disclosed to the recipients listed below:

 

  1. a) General:
  • The CONTROLLER’s providers acting as data processors, in connection with the provision of the relevant services (lawyers, accounting and tax advisors, consultants, transport companies and providers of information technology services).

 

  • The competent authorities and bodies, to the extent necessary to comply with legal obligations.
  1. b) In relation to the “Contact Form” and other inquiries(those that may be sent via the email accounts listed on the WEBSITE), the “Newsletter Form”, the “Blog Form – Leave a comment”, the “Register Form”, the “Log In Form”, the “Buy as a guest Form”, and the “Live Support Form – Online customer service platform”:
  • Shopify International Limited, VAT IE3347697KH, website hosting service.
  • ARSYS INTERNET, S.L.U., N.I.F.: B85294916, domain registration and email services.
  • No data will be shared with other third parties, except where required by law.
  • Pay in installments with Klarna To offer you Klarna’s payment methods, at checkout we may transmit your personal data included in the contact form and your order details to Klarna Bank AB (publ), so that Klarna can assess whether you qualify for its payment methods and tailor them to your profile. Your personal data is processed in accordance with Klarna’s Privacy Policy.

    Payment with Bizum via MONEI 

    Purpose: Processing payments for purchased products or services.

    Recipient: When selecting payment by Bizum, the necessary data (order amount, order number and mobile phone number) will be disclosed to MONEI DIGITAL PAYMENTS S.L., which acts as a data processor or joint controller for the performance of the sales contract.

    Legal basis: The disclosure of this data is necessary for the performance of the contract to which the data subject is a party (Art. 6.1.b of the GDPR). Without this disclosure, it would not be possible to process payment using this method.

    Security: MONEI meets the highest standards of financial security and data protection. You can consult its privacy policy on its official website.

    Your payment data (identification and transaction details) will be disclosed to these entities solely to process the payment, prevent fraud and comply with banking legal obligations. These entities will process your information in accordance with their own security and privacy policies and the applicable financial regulations.

 

Transfers to third countries

International data transfers

To properly manage your orders and provide our services, your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). In particular:

E-commerce platform: We use Shopify to manage our online store. Your data may be processed in Canada (a country covered by an adequacy decision of the European Commission, which guarantees a level of protection equivalent to that in Europe) and in the U.S., in which case Shopify relies on the Data Privacy Framework or uses Standard Contractual Clauses approved by the European Commission.

International Sales and Logistics: When making purchases from countries outside the European Union, please note that your identifying and contact details (name, delivery address and telephone number) will be disclosed to transport companies and customs authorities in the destination country. This disclosure is strictly necessary to perform the sales contract and physically deliver your order.

Safeguards: In all cases, we ensure that these international transfers are always carried out under the applicable legal safeguards, ensuring that your external providers meet appropriate security and privacy standards.

Retention periods

Personal data will be retained:

 

  1. a) General:

The data will be retained until you request its deletion and, in any event, for as long as necessary to comply with legal obligations.

  1. b) In relation to the “Contact Form” and other inquiries(those that may be sent via the email accounts listed on the WEBSITE), the “Newsletter Form”, the “Blog Form – Leave a comment”, the “Register Form”, the “Log In Form”, the “Buy as a guest Form”, and the “Live Support Form – Online customer service platform”:

Personal data will be retained until the relationship between the DATA CONTROLLER and the customer and/or user ends, unless they request its erasure earlier, or until the data subject withdraws their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

For these purposes, data subjects are reminded that they must notify the DATA CONTROLLER, as the recipient to whom they disclose personal data, of any rectification or erasure of data concerning their representatives, authorized persons, and other contact persons.

Once the relationship has ended, insofar as the data subjects' personal data is relevant to the DATA CONTROLLER's liability towards customers and/or users, such data will be retained, duly blocked, and made available to the competent judicial authorities or public administrations for the purpose of establishing liability arising from processing, for the applicable limitation period.

Rights of data subjects

Customers and/or users of the WEBSITE may exercise the following rights before the DATA CONTROLLER, where applicable: access to personal data, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection to processing, and not to be subject to automated individual decision-making; and, where processing is based on consent, the right to withdraw it at any time.

Customers and/or users may exercise these rights by submitting a written, signed request to the postal address of the DATA CONTROLLER at C/ Porthos 17 - 2º | 28011 Madrid (Spain) or via the email address info@bullplanet.es, attaching, in either case, proof of identity valid under the law, such as a photocopy of a NIF/NIE or equivalent document, and clearly indicating the right they wish to exercise.

Customers and/or users will also have the right to lodge a complaint with the competent supervisory authority (Spanish Data Protection Agency) if they observe that the processing does not comply with current regulations or consider their rights regarding the protection of their personal data to have been infringed, especially if they have not received satisfaction when exercising their rights, through the WEBSITE https://www.aepd.es

 

The DATA CONTROLLER will respond to these requests within 1 month, which may be extended to 2 months if the complexity of the request or the number of requests received so requires. This is without prejudice to the obligation to retain certain data as required by law and until any potential liabilities arising from possible processing, or, where applicable, from a contractual relationship, are time-barred.

 

In addition to the above, and in relation to data protection regulations, Users who request it may arrange what happens to their data after their death.

 

Sending commercial communications

 

In compliance with the provisions of the Second Final Provision of Law 9/2014 of May 9 on Telecommunications, which amends Law 34/2002 of July 11 on information society services and electronic commerce, commercial communications sent by electronic means must be clearly identifiable as such, and the natural or legal person on whose behalf they are sent must also be clearly identifiable, without prejudice to the provisions of regulations issued by Autonomous Communities with exclusive powers over consumer affairs.

The customer and/or user who provides their contact details to the DATA CONTROLLER by clicking the “SUBMIT” button on the electronic personal data collection forms on the website and affirmatively checking both consent boxes, “I accept the processing of my data for the purposes stated in the basic data protection information” and “I consent to receiving commercial communications about its items and/or products,” expressly authorizes and gives their explicit, free, and unequivocal consent to the DATA CONTROLLER to process their personal data for the purpose of sending them commercial communications about its items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or other equivalent electronic communication channels.

The legal basis for this processing is the data subject’s consent, which may be withdrawn at any time.

In accordance with Articles 21 and 22 of Law 34/2002 of July 11 on information society services and electronic commerce, users may object to the processing of their data for promotional purposes and withdraw their consent to receive commercial communications by email by simply notifying the SERVICE PROVIDER of their wishes through a simple, free procedure by sending an email to info@bullplanet.es, with “UNSUBSCRIBE” or “DO NOT SEND” in the subject line.

 

The data provided will be retained for as long as the business relationship continues or for the number of years required to comply with legal obligations.

Social Media Policy

The DATA CONTROLLER has profiles on the following social media platforms:

  • Facebook:

https://www.facebook.com/arteconcuero

https://www.facebook.com/cinturonlumbar

 

  • Instagram:

https://www.instagram.com/bullplanet

https://www.instagram.com/bullplanetfit

 

  • YouTube:

https://www.youtube.com/channel/UChI_PWJDkE1Kxx6Bc4vA78w

 

       · TikTok

At Bullplanet, we use TikTok for Business services (provided by TikTok Information Technologies UK Limited and TikTok Technology Limited) to run advertising campaigns, measure the performance of our ads, and show you products that may be of interest to you.

To do this, we have integrated the TikTok Pixel and the Events API (server-to-server data transmission) into our store. When you browse our website or interact with our products, these tools may collect and share certain information with TikTok.

  • What data is collected: Information about your device (IP address, browser type, operating system), cookie identifiers, browsing data from our store (pages visited, products added to your cart, purchases made) and, in some cases, encrypted contact details (such as your email address or phone number) to associate your purchase with our ads.

  • Purpose: We use this information exclusively to optimize our advertising campaigns, measure the return on investment of our ads, create custom audiences, and show you relevant advertising about our products on the TikTok platform.

  • Legal basis: The processing of this data is based on your explicit consent, obtained through our cookie banner when you visit the website.

  • Data transfers: Data collected by TikTok may be processed on servers located outside the European Economic Area (EEA). TikTok guarantees that these transfers are carried out under standard contractual clauses approved by the European Commission or equivalent mechanisms to ensure the protection of your information.

  • How to withdraw your consent: You can withdraw your consent at any time by disabling marketing or advertising cookies in the cookie settings panel on our website, or by configuring the privacy preferences directly in your TikTok app user account.

To learn more about how TikTok collects, uses, and protects your data, you can consult the TikTok Privacy Policy.

 

In all cases, it is considered the controller of the data of its users, including followers, subscribers, fans, or simply people who post comments or make inquiries through these channels.

In this regard, the DATA CONTROLLER may use this profile to inform its users of news it considers appropriate in connection with the services offered, or may also share current information or articles published by other social network users.

In no case will it use users’ personal information without their consent to engage in relationships beyond those expected on each of the aforementioned social networks; where applicable, it will seek the user’s consent.

Accuracy of the data provided by data subjects

The customer and/or user is responsible for ensuring that the information provided by completing the electronic forms made available on the WEBSITE or by sending emails to the various accounts under the Internet domain bullplanet.es is accurate. They are responsible for the accuracy of all the data they provide and must keep it up to date so that it reflects their actual situation. They are liable for any false or inaccurate information they provide and for any damage, inconvenience, or problems it may cause the DATA CONTROLLER or third parties.

Security measures

The DATA CONTROLLER guarantees that it has implemented appropriate technical and organizational policies on the WEBSITE to apply the security measures set out in EU GDPR 2016/679 and LOPDGDD 3/2018 in order to protect the rights and freedoms of customers and/or users, and has provided them with the appropriate information so that they can exercise them.

To protect individual rights, especially in relation to automated processing, and to be transparent with customers and/or users, the DATA CONTROLLER has established a policy setting out all such processing, its purposes, its legal basis, and the tools available to customers and/or users to exercise their rights.

The WEBSITE is built on the Shopify e-commerce platform and has an SSL encryption certificate from Let's Encrypt Authority X3 enabled for the entire domain, allowing users to securely submit their personal data through the available electronic forms.

The WEBSITE is hosted on servers provided to the DATA CONTROLLER by Shopify International Limited, VAT IE3347697KH, located at 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland.

All information will be stored and managed with due confidentiality, applying the necessary IT security measures to prevent unauthorized access to or use of your data, or its manipulation, deterioration, or loss.

Nevertheless, the customer and/or user should bear in mind that the security of computer systems is never absolute. When personal data is provided over the Internet, that information may be collected without their consent and processed by unauthorized third parties. The DATA CONTROLLER declines any liability for the consequences such acts may have for the User if they published the information voluntarily.

Acceptance and consent

The customer and/or user declares that they have been informed about the conditions regarding the protection of personal data and accepts and consents to its automated processing by the DATA CONTROLLER in the manner and for the purposes indicated in this Privacy Policy. Certain services provided on the WEBSITE may be subject to specific terms containing particular provisions on the protection of personal data.

 

Changes to this Privacy Policy

The DATA CONTROLLER reserves the right to amend this Privacy Policy to adapt it to legislative and case-law developments, interpretations by the Spanish Data Protection Agency, and industry practices.

In such cases, the DATA CONTROLLER will announce the changes made on the websites a reasonable time before they take effect.

This privacy policy may be supplemented by the Legal Notice, Cookie Policy, and General Terms and Conditions of Sale which, where applicable, are provided for certain products or services if access to them involves any particularities regarding the protection of personal data.