Privacy Policy

This privacy policy applies to the processing of personal data belonging to customers and/or users of https://myspecialhair.com, hereinafter the WEBSITE, owned by Juan Antonio Espinosa López, hereinafter the DATA CONTROLLER.

Applicable regulations

Our Privacy Policy has been designed in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR EU 2016/679, and, insofar as it does not conflict with that Regulation, Organic Law 3/2018 of December 5 on Personal Data Protection and the Guarantee of Digital Rights, hereinafter LOPDGDD 3/2018.

By providing their data, customers and/or users declare that they have read and are familiar with this Privacy Policy and give their unambiguous, express consent to the processing of their personal data for the purposes and under the terms set out here.

Basic data protection information

• Controller: Juan Antonio Espinosa López
  
• Purpose: Handling information requests and answering inquiries, managing orders placed by customers and/or users of the online store, providing customer service, and sending commercial communications about our items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or equivalent electronic communication channels, provided the data subject has consented to the processing of their personal data for this purpose.
• Legal basis: Performance of a contract to which the data subject is a party, or taking steps at their request before entering into a contract. The controller's legitimate interests. The data subject's consent.
• Recipients: Data will not be disclosed to third parties unless required by law.
• Rights: You have the right to access, rectify, and erase your data, as well as other rights detailed in the additional information, which you can exercise by contacting the data controller at info@myspecialhair.com
• Additional information: You can consult additional, detailed information about Data Protection in the supplementary clauses available at https://myspecialhair.com/politica-privacidad/

Additional data protection information

The data controller is:

• Identity: Juan Antonio Espinosa López
• Tax ID: 08834386V
• Address: Calle Lady Smith, 9, 5ºB – 06009 Badajoz (Spain)
• Phone (+34) 649 313 252
• Email address info@myspecialhair.com

Purposes and legal basis for processing

a) General

The DATA CONTROLLER processes personal data provided by its customers and/or users for the following purposes:

• Purpose: handling information requests and answering inquiries, managing orders placed by customers and/or users of the online store, providing customer service, carrying out administrative, commercial, accounting, and tax management, and sending commercial communications about our items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or equivalent electronic communication channels, provided the data subject has consented to the processing of their personal data for this purpose.
• Legal basis for this processing: Performance of a contract to which the data subject is a party, or taking steps at their request before entering into a contract. Legitimate interests. The data subject's consent, which may be withdrawn at any time.

b) WEBSITE electronic forms

The DATA CONTROLLER processes personal data provided by customers and/or users through the electronic personal data collection forms on the WEBSITE for the purposes identified below:

Regarding the “Contact Form” and other inquiries (requests sent through the email accounts listed on the WEBSITE):

• Purpose: Contacting the data subject, handling information requests and answering inquiries, providing customer service, and sending commercial communications about our items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or equivalent electronic communication channels, provided the data subject has consented to the processing of their personal data for this purpose.
• Legal basis for this processing: Performance of a contract to which the data subject is a party, or taking steps at their request before entering into a contract. The data subject's consent, which may be withdrawn at any time.

Regarding the “Registration Form”:

• Purpose: Allows users to register to access the website's online store.
• Legal basis for this processing: Performance of a contract to which the data subject is a party, or taking steps at their request before entering into a contract.

Regarding the “Sign-In Form”:

• Purpose: Allows registered users to access the online store with their username and password to purchase the items and/or products available to them.
• Legal basis for this processing: Performance of a contract to which the data subject is a party, or taking steps at their request before entering into a contract.

Regarding the “Guest Checkout Form”:

• Purpose:Allows users to purchase items and/or products available in the online store without registering in advance.
• Legal basis for this processing: Performance of a contract to which the data subject is a party, or taking steps at their request before entering into a contract.

Regarding the “Live Chat Form – Online Customer Service Platform”:

• Purpose:Enables users to communicate directly with the DATA CONTROLLER through WhatsApp Web, an instant messaging application integrated into the website.

When information requested in electronic forms is required, the DATA CONTROLLER will indicate this when collecting customers' and/or users' data. Failure to provide it will mean that the relevant request cannot be handled.

Use of WhatsApp as a user support channel

The DATA CONTROLLER provides customers and/or website users with a communication channel through WhatsApp to facilitate personalized assistance and handle inquiries, information requests, or issues related to our services.

As part of this communication, the DATA CONTROLLER may process the following personal data:

• phone number
• WhatsApp username
• profile picture
• any other information the user voluntarily chooses to provide during the conversation

Data processing varies depending on how contact is initiated.

1. Contact via the floating button (plug-in)

When customers and/or users access our WhatsApp channel through a floating button integrated into the website, an advance information notice is displayed in compliance with the duty to provide information under Article 13 of the General Data Protection Regulation (GDPR). In this case, personal data is processed on the basis of the user's consent (Article 6(1)(a) GDPR), freely, knowingly, and unambiguously given by continuing the conversation.

2. Contact via a direct link to the WhatsApp number

If customers and/or users click a link that takes them directly to a WhatsApp conversation, the lawful basis for processing their data is legitimate interests (Article 6(1)(f) GDPR), since they have voluntarily initiated contact with the DATA CONTROLLER and are considered to have a reasonable expectation of receiving a response.

In this case, the DATA CONTROLLER fulfills its duty to provide information through an automatic or manual initial response that includes a direct link to its Privacy Policy.

3. Contact initiated directly by the user (by manually saving the number)

If customers and/or users choose to save our number and message the DATA CONTROLLER directly on WhatsApp, data is likewise processed on the basis of legitimate interests (Article 6(1)(f) GDPR), since they are considered to have a reasonable expectation of receiving a response.

In this case, the DATA CONTROLLER fulfills its duty to provide information through an automatic or manual initial response that includes a direct link to its Privacy Policy.

What types of data do we process?

For the purposes described in the preceding section, we process Customer data from the following sources and categories:

a) Data provided directly by the customer and/or user: data provided directly by customers and/or users, either when requesting the service by completing electronic personal data collection forms or paper forms provided for that purpose, or during the contractual relationship through various channels, such as complaints or information requests submitted to Customer Service. Customers and/or users are responsible for its accuracy and for keeping it up to date.

b) Data obtained from sources other than the customer and/or user: data obtained from sources other than customers and/or users, either with their consent or under another legal authorization (legitimate interests, compliance with a legal obligation, etc.).

c) Data arising from the business relationship: data provided indirectly by customers and/or users as a result of providing the contracted service and maintaining this activity. This category includes traffic data, payment history, history of items and/or products purchased, browsing data from the public website or access to the private area, and other similar data.

Record of processing activities

Please note that personal data obtained from customers and/or users through the electronic forms on the WEBSITE forms part of the DATA CONTROLLER's Record of Processing Activities (RAT), which will be updated periodically in accordance with GDPR EU 2016/679 and LOPDGDD 3/2018.

Recipients

Data subjects' personal data will be disclosed to the recipients listed below:

a) General:

• The DATA CONTROLLER's suppliers acting as data processors in connection with their services (lawyers, accounting and tax advisors, consultants, shipping companies, and information technology service providers—website hosting and email services).
• Competent authorities and public bodies, to the extent necessary to comply with legal obligations.

b) Regarding the “Contact Form” and other inquiries(requests sent through the email accounts listed on the WEBSITE), with the “Registration Form”, with the “Sign-In Form”, with the “Guest Checkout Form” and with the “Live Chat Form – Online Customer Service Platform”:

• Data will not be disclosed to third parties unless required by law.

International transfers of data to third countries

• Google LLC, owner of Google Analytics 4 and the Gmail email service, on the basis of the adequacy decision for the EU–U.S. Data Privacy Framework.
• Meta Platforms, Inc., owner of WhatsApp, under the adequacy decision for the EU–U.S. Data Privacy Framework.
• No international transfers of data to third countries without an adequate level of protection are planned.

Retention periods

Personal data will be retained:

a) General:

• Data will be retained until you request its deletion and, in any case, for the years necessary to comply with legal obligations.

b) Regarding the “Contact Form” and other inquiries(requests sent through the email accounts listed on the WEBSITE), with the “Registration Form”, with the “Sign-In Form”, with the “Guest Checkout Form” and with the “Live Chat Form – Online Customer Service Platform”:

• Personal data will be retained until the relationship between the DATA CONTROLLER and the customer and/or user ends, unless they request its erasure earlier, or until the data subject withdraws their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Regarding the “Withdrawal Request Form (digital interface)”:

• Purpose: Managing users' exercise of their right of withdrawal, including receiving and processing requests, verifying order-related data, managing returns and refunds, and, where applicable, sending necessary communications about the status and outcome of the request.
• Legal basis: Compliance with a legal obligation applicable to the DATA CONTROLLER (Article 6(1)(c) GDPR) in connection with consumer and user protection laws. When necessary to properly carry out a return under the contract entered into with the user, processing may also be based on performance of the contract (Article 6(1)(b) GDPR).

For these purposes, data subjects are reminded that they must notify the DATA CONTROLLER, as the recipient to whom they disclose personal data, of any rectification or erasure of data concerning their representatives, authorized persons, and other contacts.

Once the relationship has ended, to the extent that data subjects' personal data is relevant to the DATA CONTROLLER's liability toward customers and/or users, the data will be retained, duly blocked, and made available to judicial authorities or competent public administrations for the enforcement of liabilities arising from processing, for the applicable limitation period.

Data subjects' rights

Customers and/or users of the WEBSITE may exercise the following rights before the DATA CONTROLLER, insofar as applicable: access to personal data, rectification, erasure (the right to be forgotten), restriction of processing, data portability, objection to processing, and the right not to be subject to automated individual decisions. When processing is based on consent, they also have the right to withdraw it at any time.

Customers and/or users may exercise these rights by sending a signed written request to the DATA CONTROLLER's postal address at Calle Lady Smith, 9, 5ºB – 06009 Badajoz (Spain), or to the email address info@myspecialhair.com, attaching, in either case, legally valid proof of identity, such as a photocopy of their NIF/NIE or an equivalent document, and clearly identifying the right they wish to exercise.

Customers and/or users also have the right to file a complaint with the competent Supervisory Authority (the Spanish Data Protection Agency) if they find that processing does not comply with current law or believe their personal data protection rights have been violated, especially if their requests to exercise their rights have not been satisfactorily addressed, through the website https://www.aepd.es

The DATA CONTROLLER will respond to these rights requests within 1 month, which may be extended to 2 months if the complexity of the request or the number of requests received requires it. This is without prejudice to the obligation to retain certain data as required by law until any possible liabilities arising from processing or, where applicable, a contractual relationship have become time-barred.

In addition, under data protection laws, Users who request it may make arrangements for what happens to their data after their death.

Sending commercial communications

In accordance with the second final provision of Law 9/2014 of May 9 on Telecommunications, amending Law 34/2002 of July 11 on Information Society Services and Electronic Commerce, electronic commercial communications must be clearly identifiable as such, and the individual or legal entity on whose behalf they are sent must also be clearly identifiable, without prejudice to regulations issued by Autonomous Communities with exclusive powers over consumer affairs.

By providing contact details to the DATA CONTROLLER, clicking the “SUBMIT” button on the website's electronic personal data collection forms, and selecting both consent checkboxes, “I accept the processing of my data for the purposes stated in the basic data protection information” and “I consent to receiving commercial communications about your items and/or products,” customers and/or users expressly authorize and give the DATA CONTROLLER explicit, freely given, and unambiguous consent to process their personal data to send commercial communications about its items and/or products by letter, telephone, email, SMS/MMS, WhatsApp, Telegram, or equivalent electronic communication channels.

The legal basis for this processing is the data subject's consent, which may be withdrawn at any time.

In accordance with Articles 21 and 22 of Law 34/2002 of July 11 on Information Society Services and Electronic Commerce, users may object to the processing of their data for promotional purposes and withdraw their consent to receiving commercial communications by email by simply notifying the PROVIDER through a straightforward, free procedure: sending an email to the email address info@myspecialhair.com, with “BAJA” or “NO ENVIAR” in the subject line.

The data provided will be retained for as long as the business relationship continues or for the years necessary to comply with legal obligations.

Social media policy

The DATA CONTROLLER has profiles on the following online social networks.

• Facebook: https://www.facebook.com/mypecialhair.trend
• Instagram: https://www.instagram.com/myspecialhair.trend

In this case, it is considered the controller of its users' data, including followers, subscribers, fans, or simply people who post comments or inquiries through these channels.

In this regard, the DATA CONTROLLER may use this profile to inform users of news it considers appropriate to the services offered, or may also share current information or articles published by other social media users.

Under no circumstances will it use users' personal information without their consent to establish relationships beyond those expected on the social network in question; it will seek the user's consent where appropriate.

Accuracy of data provided by data subjects

Customers and/or users are responsible for ensuring that the information they provide by completing the electronic forms available on the WEBSITE or by sending emails to the various accounts under the internet domain dev.myspecialhair.com is truthful. They are responsible for the accuracy of all data they provide and must keep it up to date to reflect their actual circumstances. They are liable for any false or inaccurate information they provide and for any damage, inconvenience, or problems it may cause the DATA CONTROLLER or third parties.

Security measures

The DATA CONTROLLER guarantees that it has implemented appropriate technical and organizational policies on the WEBSITE to apply the security measures established by GDPR EU 2016/679 and LOPDGDD 3/2018 to protect customers' and/or users' rights and freedoms, and has provided them with appropriate information so they can exercise those rights.

To protect individual rights, particularly in relation to automated processing, and to be transparent with customers and/or users, the DATA CONTROLLER has established a policy covering all such processing, its purposes and lawful bases, and the tools available to customers and/or users to exercise their rights.

The WEBSITE uses an HTTPS connection and access controls for private accounts. The website is hosted on Vercel and uses Upstash for CRM data and Vercel Blob for files. The domain and email service remain with Raiola Networks.

All information will be stored and managed with due confidentiality, applying the necessary computer security measures to prevent unauthorized access to or misuse of your data, or its alteration, damage, or loss.

However, customers and/or users should bear in mind that computer system security is never absolute. When personal data is provided over the internet, it may be collected without your consent and processed by unauthorized third parties. The DATA CONTROLLER disclaims all liability for the consequences of such acts for Users who published the information voluntarily.

Acceptance and consent

Customers and/or users declare that they have been informed of the personal data protection conditions and accept and consent to the automated processing of their data by the DATA CONTROLLER in the manner and for the purposes described in this Privacy Policy. Certain services provided on the WEBSITE may have specific terms containing particular personal data protection provisions.

Changes to this privacy policy

THE DATA CONTROLLER reserves the right to amend this Privacy Policy to reflect changes in legislation, case law, interpretations by the Spanish Data Protection Agency, and industry practices.

In such cases, the DATA CONTROLLER will announce the changes on its websites with reasonable notice before they take effect.

This privacy policy may be supplemented by the Legal Notice, Cookie Policy, and General Terms and Conditions that may apply to certain items and/or products or services if access to them involves specific personal data protection considerations.