When we need to obtain information from you, we will always ask you to provide it voluntarily and expressly. The data collected through the data collection forms on the website or other ways will be incorporated into a personal data file, which is responsible GRUPO JOSE LUIS.

This entity will process the data confidentially and exclusively for the purpose of offering the services requested, with all the legal and security guarantees imposed by Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and the free movement of such data and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce.

We recommend that you carefully review our Privacy Policy to ensure that you understand how your personal data will be used when you browse the Website.

1. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

The controller is the legal person who determines the purposes and means of the processing of personal data. In other words, the controller decides how and for what purposes personal data are processed.

For the purposes of this Privacy Policy, the party responsible for the processing of personal data is PACESA CARTERA SL, whose registered office is located at Avd. de la Industria 35, 28108-alcobendas (Madrid), and its VAT number is B-84156108. Its contact e-mail address is: info@joseluis.es, PACESA CARTERA is registered in the Companies Register of Madrid, Volume 20464, Folio 28, Page M-362025.

2. WHO IS YOUR CONTACT AT JOSE LUIS GROUP FOR THE PROTECTION OF YOUR PERSONAL DATA?

GRUPO JOSE LUIS has appointed a data protection officer ("DPD") to ensure the proper protection of your personal data.

If you have any questions or would like to receive more information about the processing or protection of your personal data, you can contact us or our DPD directly through any of the following channels:

• Data controller: GRUPO JOSE LUIS
• Postal address: calle Avd. de la Industria 35, 28108-alcobendas (Madrid)
• Email DPD: info@joseluis.es

3. WHAT IS PERSONAL DATA?

Personal data is any information relating to an identified or identifiable natural person.

4. WHAT PERSONAL DATA IS PROCESSED BY JOSE LUIS GROUP?

For the purposes set out in this Privacy Policy, GRUPO JOSE LUIS collects and processes the personal data detailed below:

• Identification data: name, surname, identity document (tax identification number or code, foreigner's identification number, passport or residence permit).
• Contact details: postal address, e-mail address, landline telephone number, mobile telephone number.
• Transactional data: information about purchases, orders, contracts, billing and collection, payment methods, bank details and any data relating to your transactions with us.
• Datos electrónicos: dirección IP, tipo e idioma del navegador, dominio a través del cual accede al Sitio Web, datos de navegación, actividad en el Sitio Web.

GRUPO JOSE LUIS not intentionally collect information on minors, unless you have the express consent of their parents or legal guardians. You warrant that you are over 14 years. If you know or suspect that GRUPO JOSE LUIS has personal data of minors, please contact us through any of the channels indicated in section 3 of this Privacy Policy and will proceed to its elimination.

5. COLLECTION AND COLLECTION OF PERSONAL DATA.

GRUPO JOSE LUIS collects and processes personal data that you voluntarily provide us through your interaction with our Website, specifically:

• when contacting us, for example when requesting information or quotations for our products and services;
• by registering as a registered user of our Websites;
• by subscribing to our newsletters and bulletins;
• by purchasing products or services from GRUPO JOSE LUIS;
• by submitting your CV to us with a view to participating in recruitment processes, whether carried out by Group companies or on behalf of third parties;
• when signing up for events;
• by engaging with us through social media.

Only be required to provide personal data that are necessary for GRUPO JOSE LUIS can provide services or make available the functionality of the Website that you have requested.

For example, if you wish to receive a quote from GRUPO JOSE LUIS, it will be necessary to provide us with your email address. If you request information or want us to contact you, you must provide the necessary contact details for this purpose. If you wish to purchase any product or service that GRUPO JOSE LUIS makes available on the Website, it will be necessary to provide us, among others, a tax address to prepare your invoice. If you do not provide this personal information, it would be impossible for us to provide our services.

In the forms available on the Website, fields whose completion is mandatory will be marked with an asterisk (*). If you do not provide all the mandatory data or if we receive any abnormal or incorrect response, we will not be able to deal with your request or provide the corresponding service or functionality.
You guarantee and are responsible, in any case, for the truthfulness, accuracy, validity and authenticity of the personal data provided and undertake to keep them duly updated.

To browse the Website is not necessary to provide your personal data. However, when you visit our Website, GRUPO JOSE LUIS collects the following information automatically and through cookies and other tracking technologies, depending on the specific configuration of your browser: IP address, type and device identification, browser type and language, domain through which you access the Website, navigation data, activity on the Website. For more information, you can consult the cookies policy.

Finally, we have a presence and link on social networks: Facebook, Instagram, etc. which we use to keep you informed of products, services and news, as well as a platform for registering for competitions and registration on our Websites. If you consider interesting to be our fan/follower in this type of social networks, you should know that by following us you are giving your data to these platforms and you must therefore know and accept the use that these platforms make of your data.

6. WHAT DO WE USE YOUR PERSONAL DATA FOR? PURPOSES AND LEGAL BASES FOR PROCESSING.

En general, los datos personales que nos proporciona y que obtenemos de Usted se utilizan para procesar sus solicitudes y transacciones, para proporcionarle un servicio de alta calidad y para informarle sobre oportunidades que creemos que serán de su interés.

The specific purposes for which we process your personal data are detailed below:

• To provide you with information requested by you, including quotes for products and services, or to respond to questions you ask us via our contact points. In this case, the legal basis for processing your data is your consent.
• To check the availability of products and services at your address or location. In this case, the legal basis for processing your data is the need to implement, at your request, pre-contractual measures.
• To send you our newsletter in order to keep you informed about the latest news or hot topics according to your tastes and needs, as well as discounts and promotions, campaigns and news about products and services of the companies of GRUPO JOSE LUIS. In this case, the legal basis for the processing of your data is your consent.
• To allow you to create an account that gives you the status of registered user, provides you with access to the private area for registered users and facilitates access to the information and services available therein. In this case, the legal basis for the processing of your data is consent.
• To register you as a customer, process your transactions, manage the contractual relationship with you, give you access to the private customer area, send you relevant information about products and services, billing, collections and payments, process transactions and payment methods and any service communication or related to your contract and transactions, administration of loyalty programs, discounts and promotions and conducting satisfaction surveys or related to products and services marketed and distributed by GRUPO JOSE LUIS. In this case, the legal basis for the processing of your data is, in the case of a natural person, the execution of the contract of sale of products or services with GRUPO JOSE LUIS; and, in the case of a corporate client, our legitimate interest in hiring and providing our services to the company or organization in which you are employed or provide services, in accordance with Article 19 of the Organic Law on Data Protection.
• To manage your application and contact you in connection with the recruitment processes of GRUPO JOSE LUIS Group or third parties, as well as manage their participation in them. In this case, the legal basis for the processing of your data is your consent.
• To manage your participation in events organised or sponsored by GRUPO JOSE LUIS Group or collaborating companies, as well as to publish content and images about the event on our websites, apps and social media profiles. In this case, the legal basis for the processing of your data is consent.
• To manage your participation in competitions, as well as to be able to contact you directly in case of being the winner, as well as to be able to contact you to manage the delivery of the prize or return of the product due to lack of security. In this case, the legal basis for the processing of your data is consent.
• To send you commercial communications about our products and services and the products and services of third parties, to send you our publications, opinion polls, promotional and advertising information, coupons, offers (including personalised offers) and recommendations of our own and third party products and services, according to your interests and based on a profile developed by us, by telephone, post, email, SMS or other means of contact. In this case, the legal basis for the processing of your data is your consent, except in those cases where you have contracted a product or service from GRUPO JOSE LUIS Group, in which we may send you communications about products and services of the Group to the extent that you do not object to receive these communications. You can exercise your right to object to profiling at any time by following the guidelines given in section 10 of this privacy policy "WHAT ARE YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL INFORMATION? You may exercise your right to object to receiving commercial communications by unsubscribing through the mechanisms provided in the communications themselves.
• To ensure the security of our website and information. In this case, the legal basis for the processing of your data is the legitimate interest in providing a secure environment and prevent damage to the systems of GRUPO JOSE LUIS and the information of its users, as well as unauthorized access and misuse of them. To ensure that the impact on your privacy is the least, we will treat your personal data for the time strictly necessary to ensure this purpose.

As regards the purposes for which cookies are used, please refer to our cookie policy. In this case, the legal basis for the processing of your data is your consent.

When the basis of the treatment is consent, you may revoke it at any time by sending a communication to info@joseluis.es, enclosing a copy of your ID card or document proving your identity, indicating your address for communication purposes and providing the details necessary to process your request. You can always contact us through any of the channels indicated in section 2 of this Privacy Policy WHO IS YOUR CONTACT AT GRUPO JOSE LUIS FOR THE PROTECTION OF YOUR PERSONAL DATA.

Please note that receiving commercial information is not essential to maintain our relationship with you. If you prefer not to receive commercial communications, you may inform us at any time by the means indicated or unsubscribe using the link provided for this purpose in the commercial e-mail communications you receive or, if the communications are sent by other means, through the procedure indicated for this purpose.

To what extent will decision-making be automated?

GRUPO JOSE LUIS does not use fully automated decision-making processes to enter into, develop or terminate a contractual relationship with you. In the event that we use such processes in a particular case, we will keep you informed and inform you of your rights in this regard if so prescribed by law.

Will profiling take place?

In order to be able to offer you products and/or services according to your interests and to improve your user experience, we may create a "marketing profile" based on the information provided. However, no automated decisions will be made on the basis of such a profile.

You can exercise your right to object to profiling at any time by following the guidelines in section 10 of this privacy policy "WHAT ARE YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA?

7. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

We only use, transfer or share personal data with third parties on the terms described in this Privacy Policy. GRUPO JOSE LUIS does not sell or rent your personal data to third parties and will only communicate them to persons or entities if we obtain your prior consent or in compliance or in accordance with applicable law where such consent is not necessary for a specific transfer.

We will share or give third parties access to your personal data where doing so is necessary to achieve one of the purposes described below and in accordance with applicable law:

Companies of GRUPO JOSE LUIS. Many of the activities and services offered on our website are companies linked to GRUPO JOSE LUIS. On certain occasions will be allowed access to your personal data to these companies for the fulfillment of any of the actions that we mentioned in section 6 of this Privacy Policy WHAT WE USE YOUR PERSONAL DATA FOR? PURPOSES AND LEGAL BASIS FOR PROCESSING.

Our suppliers. GRUPO JOSE LUIS will communicate or allow access to your personal data to companies that provide services to us under a contract, when necessary for the fulfillment of the purposes described in section 6 of this Privacy Policy WHAT WE USE YOUR PERSONAL DATA FOR? PURPOSES AND LEGAL BASIS FOR THE PROCESSING: web platform services, order and transport management, payment processing, email distribution, call-center, SEO services, marketing and organisation of promotional campaigns. If any of these service providers need access to your personal data, they use it only to provide a service to us and in accordance with our instructions. We also require them to maintain the confidentiality and security of the data and to return or destroy the data when it is no longer needed.

Legal obligations: GRUPO JOSE LUIS may communicate your personal data when the transfer is authorised by law or is necessary to comply with a legal obligation, including the transfer to the competent authorities, judges and courts.

International transfers. Some of the service providers are located in territories outside the European Economic Area which do not provide a level of data protection comparable to that of the European Union, since they are based in the United States. Your data will be processed by these companies for the following purposes: standardisation and validation of physical and electronic addresses, as well as enrichment with socio-demographic variables and the sending of commercial communications.

In such cases, we inform you that we transfer your data with appropriate safeguards and always keeping the security of your data. If for the purposes described in this Privacy Policy is necessary to transfer your personal data to countries where the level of protection may not be the same as that provided in Spain, GRUPO JOSE LUIS will duly inform you and comply with the applicable legal provisions, requesting your consent or offering appropriate guarantees.

8. WHAT MEASURES DO WE TAKE TO KEEP YOUR PERSONAL DATA SECURE?

GRUPO JOSE LUIS adopts appropriate technical and organisational measures in accordance with current regulations to protect your personal data against any misuse, destruction, loss, accidental or unlawful modification, disclosure or unauthorised access, including those necessary to address any suspected data breaches.

The Website has a permission system, through username and password, through which only authorized users can access the private area. GRUPO JOSE LUIS not use at any time that information for any use other than its maintenance, management of the business relationship with you, as well as the provision of services available in it.

You undertake to keep and use the user name with due diligence. The use of the password is personal and non-transferable, and it may not be transferred, even temporarily, to third parties. In this regard, you must take the necessary measures to safeguard the password and prevent its use by third parties. Consequently, you are solely responsible for the use made of your password, with full indemnity for GRUPO JOSE LUIS.

If you know or suspect that your password is being used by third parties or that there may be an improper use of personal data or unauthorised access to the same, please let us know as soon as possible through any of the channels indicated in section 2 of this Privacy Policy WHO IS YOUR CONTACT AT GRUPO JOSE LUIS FOR THE PROTECTION OF YOUR PERSONAL DATA?

9. HOW LONG DO WE KEEP YOUR DATA?

GRUPO JOSE LUIS will keep your personal data for the time necessary to fulfill the purposes for which they were collected, as long as you do not exercise your right of deletion or to revoke your consent.

They will then be deleted, unless a longer retention period is required or permitted by law (e.g. for the formulation, exercise or defence of claims), in which case they will be kept appropriately blocked for the time necessary before deletion.

To determine an appropriate retention period for your data, we apply the following criteria:

• The data necessary to provide you with information requested by you, including product and service quotations, will be retained for the time necessary to deal with and process such requests.
• The data required to send you newsletters will be processed until you revoke your consent and inform us that you no longer wish to receive them.
• Data about registered users will be retained until you unsubscribe from the private area.
• Data related to the purchase of PIMe products and services within the framework of a contractual relationship will be retained for the duration of the contract and for a subsequent period of 3 years to facilitate re-registration as recurring customers.
• Where you have consented to receive marketing communications, they will be retained until you revoke your consent and inform us that you no longer wish to receive them.
• Data submitted for recruitment purposes will be retained until you terminate your account or a period of 3 years of inactivity has elapsed.
• Where you have registered for an event, they will be kept for the duration of the event and thereafter to inform you of new events, until you revoke your consent or unsubscribe from our services, or after a period of 3 years of inactivity.
• Where you have entered a competition, they will be retained for the duration of the competition and thereafter to inform you of new competitions, until you withdraw your consent or unsubscribe from our services, or after a period of 3 years of inactivity.
• Where cookies are set on your device, data will be retained from our cookie policy.
• After the retention periods set out above, the data will be identified as blocked and irreversibly anonymised/destroyed after 3 years.

10. WHAT ARE YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA?

In accordance with the applicable regulations, you have a number of rights in relation to the collection and processing of your personal data. The exercise of these rights will be free of charge for you, except in cases where manifestly unfounded or excessive requests are made, especially for repetitive reasons.

These rights are as follows:

Right to information:

• You have the right to be informed in a concise, transparent, intelligible and easily accessible manner, in clear and simple language, about the use and processing of your personal data.

Right of access:

• You have the right to ask us at any time to confirm whether we are processing your personal data, to provide you with access to your personal data and information about its processing, and to obtain a copy of such data.
• The copy of your personal information that we provide to you will be free of charge, although requests for additional copies may be subject to a reasonable charge based on administrative costs. We may ask you to provide proof of your identity or request additional information that is necessary to process your request.

Right of rectification:

• You have the right to request the rectification of inaccurate, outdated or incomplete personal data concerning you. You may also request that personal data that is incomplete be completed, including by means of an additional statement.

Right to suppression - right to be forgotten:

• You have the right to request the deletion of your personal data when, among other reasons and provided that a proportionality test is carried out, the data are no longer necessary for the purposes for which they were collected and do not deal with current events or events and the right to information is paramount. However, this right is not absolute so that PIMe may continue to keep them duly blocked in the cases provided for by the applicable regulations.

Right to limit processing:

• You have the right to request that we restrict the processing of your personal data which means that we may continue to store it, but not further process it if any of the following conditions are met:
  that you contest the accuracy of the data, for a period of time that allows the data controller to verify the accuracy of the data;
  the processing is unlawful and you object to the deletion of the data and request instead the limitation of its use;
  GRUPO JOSE LUIS no longer need the data for the purposes of treatment, but you need them for the formulation, exercise or defense of claims;
  You have objected to the processing, while verifying whether the legitimate reasons of GRUPO JOSE LUIS prevail over yours.

Right to data portability:

• You have the right to have your data transmitted to another data controller in a structured, commonly used and machine-readable format. This right applies when the processing of your personal data is based on consent or the performance of a contract and such processing is carried out by automated means.

Right of opposition:

This right allows you to object to the processing of your personal data, including profiling. We will not be able to comply with your right only when we process your data if we can demonstrate compelling legitimate grounds for the processing or for the formulation, exercise or defense of claims.

Right to revoke consent:

In cases where we have obtained your consent to the processing of your personal data in connection with certain activities (e.g. for the purpose of sending you commercial information), you may withdraw your consent at any time.

Right to file a complaint with a supervisory authority:

You have the right to file a complaint with the Spanish Data Protection Agency, details of which can be found at https://www.aepd.es/es.

You may exercise your rights by sending us a communication to info@joseluis.es, attaching a document proving your identity and providing the necessary details to process your request.