Privacy Policy
1. Data Controller
Data Controller: Montse Mancilla Solano
NIF/DNI: 20606400X
Address: Urb. La Ladera, 52, 11600 Ubrique, Cádiz, Spain
Email: contacto@moandpa.com
Website: https://moandpa.com
2. Personal Data We Process
Depending on how the user interacts with the website, the following categories of personal data may be processed:
- Identification and contact data: first name, surname, email address, telephone number and other information voluntarily provided through forms or communications.
- Browsing data: IP address, online identifiers, device type, browser, operating system, pages visited and data derived from the use of cookies or similar technologies.
- Data related to enquiries, requests or communications submitted by the user.
- In the case of online sales or the provision of services: data required to manage orders, invoicing, shipping, payments, returns and after-sales support.
Special categories of personal data are not requested. Users should avoid including specially protected information in forms or communications unless strictly necessary.
3. Purposes, Legal Basis and Retention Periods
| Purpose | Legal Basis | Retention Period |
|---|---|---|
| Responding to enquiries received by email or through forms | User consent and legitimate interest in responding to requests | For the time necessary to manage the enquiry and, where applicable, for the relevant statutory retention periods |
| Managing commercial relationships, orders or requested services | Performance of pre-contractual measures or contractual obligations | For the duration of the contractual relationship and the applicable statutory retention periods |
| Complying with legal, tax, accounting or administrative obligations | Compliance with legal obligations | For the periods required by applicable regulations |
| Sending marketing communications, where requested or authorised by the user | Consent or, where applicable, legitimate interest in accordance with applicable regulations | Until the user withdraws their consent or objects to the processing |
| Maintaining security, preventing abuse and ensuring the technical operation of the website | Legitimate interest in protecting the website and its systems | For the time necessary to fulfil this purpose |
| Analysing website usage through non-essential cookies, where accepted | User consent | According to the duration specified in the Cookie Policy |
The user may withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.
4. Disclosure of Personal Data
Personal data will not be disclosed to third parties unless required by law, necessary for the provision of a requested service, or where another valid legal basis applies.
Personal data may be accessed by service providers whose services are necessary for the operation of the website or the activities of the data controller, such as web hosting providers, technical maintenance services, management tools, email service providers, payment gateways, shipping companies, tax or legal advisers, and analytics or marketing platforms, where applicable.
Where such providers act as data processors, the safeguards required under applicable data protection regulations will be implemented.
5. International Data Transfers
As a general rule, no international transfers of personal data outside the European Economic Area are envisaged. However, certain technology, analytics, marketing, hosting or communications providers may process personal data in third countries.
Where providers involving international data transfers are used, such transfers will be carried out with appropriate safeguards in accordance with the General Data Protection Regulation, such as adequacy decisions, Standard Contractual Clauses or other legally recognised mechanisms.
6. Users’ Rights
Users may exercise the following rights:
- Access: to know what personal data is being processed.
- Rectification: to request the correction of inaccurate personal data.
- Erasure: to request the deletion of personal data where applicable.
- Objection: to object to certain types of processing.
- Restriction of processing: to request that the use of personal data be restricted in certain circumstances.
- Data portability: to receive personal data in a structured format, where applicable.
- Withdrawal of consent: to withdraw consent previously given at any time.
To exercise these rights, users may send a request to contacto@moandpa.com, specifying the right they wish to exercise and providing proof of identity where necessary.
If users believe that the processing of their personal data does not comply with applicable regulations, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): https://www.aepd.es
7. Security
The data controller implements reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.
However, absolute security cannot be guaranteed on the Internet. Users should therefore also take appropriate security measures to protect their devices and communications.
8. Minors
The website is not intended for children under the age of 14. If it is discovered that personal data relating to a child under the age of 14 has been collected without the appropriate authorisation, such data will be deleted as soon as possible.
9. Changes to the Privacy Policy
The data controller may amend this Privacy Policy to adapt it to legislative, technical or organisational developments. The version in force at any given time will be the version published on the website.
