Horizonte Galego, S.L. informs the users of the web site about its policy regarding the treatment and protection of the personal data of the users and clients that can be obtained by the navigation or purchase of products through its web site. In this sense, Horizonte Galego, S.L., guarantees the fulfillment of the current regulations regarding the protection of personal data, reflected in the General Regulation of Data Protection (RGPD) (EU) 2016/679 and in the Organic Law 3/2018, of December 5th, of Protection of Personal Data and guarantee of the digital rights.

Who is responsible for the processing of personal data?

For what purpose are personal data processed?

Toff & Trapp's treats the information provided for the following purposes:

• Manage and develop online shopping. We use the customer's personal information to process and deliver your order, to inform you by email of the status of your order and to carry out anti-fraud checks.
  
  
• Manage the subscription to our newsletter, to send information about promotions, news and latest products. The sending of this information will involve the creation of user profiles that consist of using personal data, the history of your purchases if applicable, as well as information on navigation on the WEB to evaluate certain aspects related to your personal preferences, with the aim of offering you commercial communications that are appropriate to your profile. Where appropriate, certain personal information of the customer may be used to personalize communications in digital media.
  
  
• Management of discount coupons and promotional draws.
  
  

Will commercial information be sent?

Through the newsletter that appears on the website owned by Toff & Trapp's, consent is obtained to contact the customer via email to send commercial information on offers and promotions for the products offered.

How have personal data been obtained and what categories of data are processed?

Toff & Trapp's may collect the following personal information from website users through the appropriate forms name, email address, mailing address, telephone number, date of birth and credit card.

The category of data that is processed is:

• Data of an identifying nature.
  
  
• Data of personal characteristics.
  
  
• Economic data.
  
  

What is the legitimacy to use your data?

Toff & Trapp's, have the following legitimate bases for data processing:

Execution of the contract: In accordance with art. 6.1. b) of the RGPD, the processing is necessary for the execution of a contract to which the data subject is a party or for the application of pre-contractual measures at the request of the data subject. If this data is not provided, the sale will not be possible.

Legal obligations: According to art. 6.1. c) of the RGPD the processing is necessary for the fulfilment of a legal obligation applicable to the data controller as it is necessary for the management and issuing of the sales invoice.

Consent: In accordance with art. 6.1. a) of the RGPD, where the data subject has given his consent to the processing of his personal data for

• Web registration management,
  
  
• Response to the exercise of rights, queries and complaints,
  
  
• Sending information about offers, promotions and news about our products through our newsletter.
  
  

How long will we keep the personal data?

Toff & Trapp's shall keep the personal data provided for the period of time reasonably necessary taking into account the needs to answer questions or solve problems, to activate its services and to comply with the requirements of the applicable legislation or until the data subject requests its deletion.

Subsequently, the data will be deleted in accordance with the provisions of the data protection legislation, which implies their blocking, being available only to requests from Judges and Courts, the Ombudsman, the Public Prosecutor's Office or the competent Public Administrations during the period of limitation of actions that could arise and, after this time, they will be completely deleted.

To which recipients will the data be communicated?

Personal data is transferred when there is a legal obligation to do so or to companies responsible for data processing (providers of fraud detection and prevention, technology services, etc.) and, in general, to third party providers that are necessary for the provision of the services offered by Toff & Trapp's (providers of courier and transport services, etc.).

Under no circumstances will personal data be sent outside the European Economic Area, and therefore no international transfer of data will take place.

What are your rights when you give your consent?

Interested persons have the right to:

• Request access to personal data relating to the data subject
  
  
• Request its correction or deletion
  
  
• Request limitation of your treatment
  
  
• Oppose treatment
  
  
• Request for data portability
  
  

Data subjects may have access to their personal data and may request that inaccurate data be corrected or, where appropriate, that they be deleted when, among other things, the data are no longer necessary for the purposes for which they were collected.

In certain circumstances, data subjects may request limitation of the processing of their data, in which case they will be kept only for the exercise or defence of claims.

In certain circumstances and on grounds relating to their particular situation, data subjects may object to the processing of their data. Toff & Trapp's will stop processing the data, except for compelling legitimate reasons, or the exercise or defence of any claims. They may also request the portability of their data.

How can the rights be exercised?

In order to exercise the aforementioned rights of access, rectification, deletion, objection, limitation of processing and portability of data, data subjects should contact the e-mail address toffandtrapps@toffandtrapps.com.

The request to exercise the right must be accompanied by your name and surname, a photocopy of your ID card or passport, the right you wish to request, the content of your request and an address for notification purposes.

Can you file a complaint with the AEPD?

Data subjects shall also have the right to effective judicial protection and to lodge a complaint with the supervisory authority, in this case the Spanish Data Protection Agency, if they consider that the processing of personal data concerning them infringes the Regulation. They may complain by writing to the Spanish Data Protection Agency, C/Jorge Juan nº 6, 28001 Madrid or by accessing its electronic headquarters: https://sedeagpd.gob.es/sede-electronica-web/.