Privacy Policy
1. Data Controller
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD), the following information regarding the data controller is provided:
Data Controller: Orlando Sullón
Trading name: Mamasara Alpaca
Tax ID (NIF): 60093738M
Address: Calle Mallorca 525, 08026 Barcelona, Spain
Email: info@mamasara.eu
Website: www.mamasara.eu
2. Personal data we may process
Depending on the user’s relationship with Mamasara and the services they use, we may process the following categories of personal data:
Identification and contact details, such as name, surname, email address, telephone number and addresses.
Data required to manage orders, deliveries, returns or after-sales service.
Billing and transaction data.
Data relating to the creation and management of a user account.
Information voluntarily provided through forms, email or other contact channels.
In a corporate context, professional data such as company, job title or information relating to an enquiry or proposal.
Technical and browsing data, where applicable and in accordance with the user’s cookie preferences.
Mamasara does not request personal data that is not necessary for the relevant purposes.
3. Purposes and legal bases
Purchase and order management
Data provided during the purchasing process will be processed to manage the order, confirm the purchase, process payment, arrange delivery, handle any returns or issues and provide after-sales support.
Legal basis: performance of a contract or taking pre-contractual steps at the request of the data subject.
Billing and legal obligations
Certain data relating to purchases and transactions will be processed to comply with applicable tax, accounting and legal obligations.
Legal basis: compliance with legal obligations.
User account
When a user creates an account, their data will be processed to identify them, manage access and facilitate the use of features associated with their account.
Legal basis: performance of the contractual relationship or taking steps requested by the user.
Enquiries and customer service
Data provided through forms, email or other contact channels will be used to respond to enquiries, requests or issues.
Legal basis: taking pre-contractual steps, performance of the existing relationship or legitimate interest in responding to requests received, depending on the nature of the communication.
Enquiries and relationships with companies
When a person contacts Mamasara on behalf of a company, organisation or institution, their professional data may be processed to manage the enquiry, prepare a proposal, coordinate meetings and maintain the communications necessary in connection with a potential or existing business relationship.
Legal basis: taking pre-contractual steps, performance of the business relationship and, where applicable, legitimate interest in managing professional relationships.
Marketing communications
Where the user has expressly consented to receiving marketing communications, their data may be used to send information about Mamasara products, news or content.
Legal basis: consent.
The user may withdraw their consent at any time.
Analytics and similar technologies
Where authorised by the user through the cookie management system, certain browsing data may be processed for the purpose of measuring and analysing the use of the website.
Legal basis: consent.
Further information is available in the Cookie Policy.
4. Data retention
Personal data will only be retained for as long as necessary to fulfil the purpose for which it was collected.
Data associated with purchases, billing and contractual relationships may subsequently be retained, duly restricted where appropriate, for the periods established by applicable tax, accounting, commercial and other legislation.
Data arising from enquiries will be retained for as long as necessary to manage the request and, subsequently, for the periods required to address any potential liabilities.
Where processing is based on consent, the data may be retained until the user withdraws that consent, without prejudice to any applicable legal obligations.
5. Recipients and service providers
To provide its services, Mamasara may use service providers that need access to certain personal data in order to perform their functions, including:
Hosting and technology service providers.
Platforms and tools used to operate and manage the online shop.
Payment service providers.
Transport and logistics companies.
Email and communications providers.
Analytics services, where authorised by the user.
Professional advisers where necessary to comply with legal, tax or accounting obligations.
These providers will process only the data necessary to provide the relevant services and in accordance with applicable legislation.
Certain technology providers may be located outside the European Economic Area. Where an international transfer of personal data takes place, it will be carried out using one of the mechanisms and safeguards provided for under the GDPR.
Personal data will not be sold to third parties.
Data may be disclosed to public authorities, judges, courts or other authorities where required by law.
6. Rights of data subjects
Where applicable, users may exercise the following rights:
Right of access to their personal data.
Right to rectification of inaccurate data.
Right to erasure.
Right to restriction of processing.
Right to object.
Right to data portability.
Right to withdraw consent at any time where processing is based on consent.
To exercise these rights, users may send a request to:
Mamasara may request additional information only where necessary to verify the identity of the person making the request.
Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) www.aepd.es if they consider that the processing of their personal data does not comply with applicable legislation.
7. Information security
Mamasara implements appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access, disclosure or improper processing, taking into account the nature of the data and the risks associated with its processing.
8. Third-party data
Where a user provides personal data relating to another person, they must ensure that they are authorised to do so and that the person concerned has been informed, where applicable, about the disclosure of their data.
9. Changes to this Privacy Policy
Mamasara may amend this Privacy Policy where necessary to reflect legislative or technical changes, or changes to the processing activities carried out through the website.
The updated version will remain permanently available on mamasara.eu.
