Privacy Policy

1. Data Controller Identification

2. Applicable Principles

In the processing of your personal data, we will apply the following principles that comply with the requirements of the General Data Protection Regulation (GDPR):

• Principle of lawfulness, fairness and transparency: We require your consent for the processing of your personal data for one or more specific purposes that we will inform you about with complete transparency.
• Principle of data minimization: We only request strictly necessary data in relation to the purposes for which we require them.
• Principle of storage limitation: Data will be kept for the time strictly necessary in relation to the purposes for which they were collected.
• Principle of integrity and confidentiality: Your data will be processed in a way that ensures their security and confidentiality.

3. Personal Data Collection

To browse our website, you do not need to provide any personal data. The cases in which you do provide your personal data are as follows:

• When making a purchase through our online store
• When contacting us through the contact form
• When subscribing to our newsletter
• When creating a user account
• When you open the emails we send you or click their links, and when you browse the site if you have accepted analytics cookies

4. Your Rights

Regarding the processing of your data, you have the following rights:

• Right of access: You can request information about your personal data that we have stored.
• Right of rectification: You can request the correction of inaccurate or incomplete data.
• Right of erasure: You can request the deletion of your personal data.
• Right to object: You can object to the processing of your personal data.
• Right to restriction of processing: You can request the restriction of the processing of your data.
• Right to data portability: You can request to receive the data in a structured, commonly used format.
• Right to withdraw consent: You may withdraw your consent at any time, without this affecting the lawfulness of processing based on the consent given before its withdrawal. You can withdraw consent for analytics and advertising cookies at any time through the cookie management panel ("Manage cookies" link in the footer).
• Right to lodge a complaint with a supervisory authority: You may lodge a complaint with the Spanish Data Protection Agency (AEPD) — C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es — if you consider that the processing of your data does not comply with applicable regulations.

To exercise any of these rights, you can contact us at: hola@aceiteherencia.com

5. Legal Basis for Processing

The legal bases that legitimize the processing of your data, in accordance with Article 6 of the GDPR, are as follows:

• Performance of a contract (Art. 6.1.b GDPR): processing of data necessary to manage and deliver the orders you place and to invoice them.
• Compliance with legal obligations (Art. 6.1.c GDPR): retention of invoices and tax data in accordance with commercial, tax and consumer-protection regulations.
• Consent of the data subject (art. 6.1.a GDPR): sending commercial communications (newsletter) and measuring their opening and interaction, analytics and advertising cookies, browsing session recording, conversion measurement and ad personalisation on third-party platforms (Meta, Google and Microsoft). This consent is collected through the site's cookie banner and, for the newsletter, at the time of subscription.
• Legitimate interest (Art. 6.1.f GDPR): improving the security of the site and preventing fraud in the purchase process.

6. Purpose of Data Processing

The personal data you provide will be used for:

• Managing and processing your orders
• Sending commercial communications (if you have given your consent)
• Responding to your queries and requests
• Complying with legal obligations
• Improving our products and services
• Measuring the effectiveness of our advertising campaigns and attributing conversions to the corresponding source, by sharing with Meta Platforms Ireland Ltd. and Google Ireland Ltd. hashed (SHA-256) versions of your email, phone number, first name, last name, city, postal code, country and order identifier. This processing is only carried out if you have accepted the "Advertising" category of the cookie banner.
• Personalising ads on Meta platforms (Facebook, Instagram) and Google platforms (Search, YouTube, display network) through their own advertising identifiers.
• To measure how effective our email communications are: we record whether the message was delivered, whether you opened it — by means of a tracking pixel embedded in the email — and whether you clicked any of its links, along with the date and the specific link. This tells us what to send and how often.
• To analyse how the website is used in order to improve it, through Microsoft Clarity, which records the browsing session (pages visited, clicks, mouse movements and scrolling) and produces heatmaps. This processing only takes place if you have accepted the "Analytics" category in the cookie banner. The recordings do not capture what you type into forms: the service masks it before storing it.

7. Data Recipients

Your personal data may be communicated to the following recipients or categories of recipients, exclusively for the purposes described and with the following safeguards:

• Banking entities and payment gateways (Redsys Servicios de Procesamiento S.L. — Spanish POS): to process card and Bizum payments.
• Courier and delivery companies: to deliver orders to the shipping address provided.
• Transactional email service providers (Sendinblue/Brevo — based in France): to send order confirmation, invoicing and newsletter emails, and to record their delivery, their opening and the clicks on their links.
• Microsoft Corporation (Microsoft Clarity): to analyse site usage through session recordings and heatmaps. The data processed includes browsing data (pages viewed, clicks, mouse movements and scrolling), IP address, device type and browser. It is only activated if you have accepted analytics cookies.
• Meta Platforms Ireland Ltd. (Facebook, Instagram): for server-side measurement of advertising conversions via Meta Conversions API. The following data are transmitted IN HASHED FORM (SHA-256, not reversible at individual level): email address, phone, first name, last name, city, postal code, country and internal order identifier. The following data are also transmitted in original format: IP address, browser User-Agent and Meta pixel's own identifiers (fbc/fbp) when available.
• Google Ireland Ltd. (Google Ads, Google Analytics 4): for conversion measurement and Enhanced Conversions. The same hashed (SHA-256) data are transmitted as to Meta, together with Google's advertising identifiers (gclid/wbraid/gbraid) when available.
• Public authorities and official bodies where there is a legal obligation.
• External technology partners acting as data processors (hosting, maintenance), with data processing agreements signed in accordance with Art. 28 GDPR.

8. International Data Transfers

Some of the recipients mentioned in the previous section are companies established outside the European Economic Area, or transfer data outside it. In particular, Meta Platforms Ireland Ltd. and Google Ireland Ltd., both based in Ireland (EU), transfer data to their parent companies Meta Platforms, Inc. and Google LLC, based in the United States, in order to operate their advertising platforms; and Microsoft Clarity is a service provided by Microsoft Corporation, based in the United States.

These transfers are carried out under the following safeguards:

• EU–US Adequacy Framework (Data Privacy Framework — DPF): the European Commission, by means of Implementing Decision 2023/1795 of 10 July 2023, has declared that the US provides an adequate level of protection for personal data transferred to US companies certified under the DPF. Meta Platforms, Inc., Google LLC and Microsoft Corporation are certified under the DPF, which you can verify at https://www.dataprivacyframework.gov/list.
• Standard Contractual Clauses (SCCs) approved by the European Commission as an additional safeguard.

You can obtain information about the privacy policies and transfers of these recipients in their respective notices:

• Meta: https://www.facebook.com/privacy/policy
• Google: https://policies.google.com/privacy
• Microsoft: https://privacy.microsoft.com/privacystatement

9. Retention Periods

We keep your personal data for as long as necessary for the purpose that originated it and, afterwards, for the periods required by applicable law. Specifically:

• Orders, invoices and tax data: 6 years from the transaction, in accordance with article 30 of the Spanish Commercial Code, and in any case for as long as tax obligations have not lapsed (4 years, article 66 of the General Tax Act).
• Your user account data: for as long as the account remains active. If you delete it, we erase the associated data except for what we are legally required to keep.
• Newsletter subscription: until you withdraw your consent. We keep a record of the unsubscription, and only that, so as not to write to you again.
• Email delivery log (delivery, opens and clicks): 3 years from the send. After that period the record is anonymised, so that only aggregate statistics remain, which no longer allow you to be identified.
• Browsing data and cookies: the lifetime of each cookie is detailed in the Cookie Policy; in no case does it exceed 24 months.
• Session recordings and heatmaps (Microsoft Clarity): kept by Microsoft in accordance with its own service retention periods. We do not store any copy of the recordings.

Once the data are no longer necessary they are blocked, remaining available solely to judges, courts, the Public Prosecutor's Office and public authorities for the applicable limitation periods, after which they are deleted.

10. Data Security

We have adopted the necessary technical and organizational security measures to guarantee the security of your personal data and prevent its alteration, loss, processing or unauthorized access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed.

11. Cookies

We use cookies to improve your browsing experience. You can find detailed information about the cookies we use in our Cookie Policy.

12. Modifications

Aceite Herencia SL reserves the right to modify this Privacy Policy to adapt it to legislative or jurisprudential developments, as well as industry practices. In such cases, we will announce on this page the changes introduced with reasonable notice before their implementation.

13. Contact

If you have any questions about this Privacy Policy, you can contact us:

• 📧 Email: hola@aceiteherencia.com
• 📞 Phone: +34 614 86 95 99
• 📍 Address: Calle de la Amistad 8, 23400 Úbeda (Jaén), Spain