Privacy

In this privacy policy, we explain to you what information and personal data we collect, store, use, process, assign, transfer and/or delete about you, for what purposes we process your data, what legal basis legitimises or permits us to do so, what rights you have and how you can assert them with us or with the relevant supervisory authority, if applicable. Our principles are very clear. At Nelly Castro, you are in control of your personal information and we will never sell it to third parties or take unfair or improper advantage of it. This means that we will always use the data you provide to us for the strict and legitimate purposes of our business and always in a transparent manner, and we will not seek to undermine or infringe any rights or interests that you may have.

This Privacy Policy has been prepared in accordance with the principles and rules of Regulation (EU) 2016/679 of 27 April, known as the General Data Protection Regulation or the GDPR, as well as the guidelines of the supervisory authority (Spanish Data Protection Agency) on the subject.

We consider it very important to give you this information and that you read and understand it. Therefore, we have tried to use clear, simple and transparent language and minimise the use of legal formulae.

IDENTITY OF THE DATA CONTROLLER: WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA AND INFORMATION?

Details of the data controller:

Name of the owner/manager: Nelly Aleyda Castro Ibarra (hereinafter "Nelly Castro").

Address: Calle General Prim, 11- 46005 Valencia - Spain

E-mail: kontakt@nellycastro.de

Tax ID: Y9824161R

Facebook co-responsibility

Nelly Castro has included the Facebook "Like" button in certain content on its website. The activation of this button means that when accessing the Nelly Castro website, data such as the IP address, browser settings or information on cookies and similar technologies used on this website are automatically transmitted to Facebook.

According to the general interpretation of the Court of Justice of the European Union on the "Like" button (judgment of 29 July 2019, Case C-40/17), Nelly Castro would be jointly liable with Facebook because it decides to include the "Like" button on the website and to allow the processing, even if Nelly Castro does not have access to the personal data transferred to Facebook. However, Nelly Castro's liability would be limited to the part of the processing in which it is involved, i.e. the collection of the data and its transmission to Facebook. Facebook is solely responsible for the purposes and subsequent processing carried out by Facebook.

PURPOSES OF PROCESSING: WHY DO WE PROCESS YOUR PERSONAL DATA?

Nelly Castro processes the personal data collected through the use of this website for the following purposes:

Managing contact with users and customer service.

Management of the contractual relationship resulting from the purchase of products from the online shop.

Where applicable, management of commercial communications, including by electronic means.

Analysis of user behaviour on the website in order to improve the user-friendliness of the service or our advertising campaigns, using cookies.

LEGAL BASIS: WHAT APPLICABLE LAW GIVES US THE RIGHT TO PROCESS YOUR PERSONAL DATA?

The contractual relationship (Art. 6.1(b) of the GDPR).

We generally process your personal data on the basis that such processing is necessary for the performance of the contract between us and our users/customers (the contract for the purchase of products in our online shop) or for the performance of pre-contractual measures (at the request of the data subjects).

Consent of the data subject (6.1(a) of the GDPR).

We ask for your explicit, prior, free, informed and unambiguous consent to the use of analytical, social and advertising cookies (see Cookie Policy).

Similarly, we will seek your explicit consent before sending you any commercial communications by electronic means.

Legitimate interests of the data controller (6.1 f of the GDPR).

On this legal basis, we process the personal data with which you contact Nelly Castro via the functions and forms offered on this website (in particular by e-mail), insofar as we do not unduly jeopardise or prejudice your rights and interests. Excerpt from the assessment of legitimate interest: This processing is necessary to achieve the objectives of the company, in particular to be able to communicate electronically with its customers, prospects and other contacts. Users are also interested in being able to contact the company in this way and it is in line with their legitimate expectations that such processing of contact details is carried out. Furthermore, Art. 19 of the GDPR requires that the processing of contact details, including those of sole traders and freelancers, is based on a legitimate interest (Art. 6.1(f) of the GDPR).

CATEGORIES OF DATA: WHAT PERSONAL DATA DO WE PROCESS THROUGH THE FUNCTIONALITIES OF THIS WEBSITE?

Nelly Castro collects as little personal data as possible in order to provide the relevant service, in accordance with the requirements of the Data Minimisation Principle of the GDPR.

This data is the data collected in the data collection forms on this website and the data collected through cookies and similar technologies.

The web forms collect data necessary to manage the contact with the user or to manage the shipment of the products purchased, as well as to issue the corresponding invoice. These are the following categories of data:

Identification data: Name, Surname, NIF.

Contact information: Address or place of delivery, email, telephone.

In order to send commercial communications electronically to the relevant subscriber, we collect the following categories of data:

Identifying data: Name or pseudonym (alias).

Contact information: Email.

Cookies or other similar technologies collect certain data, such as the IP address, the identification of the user's device or certain navigation or security parameters that are necessary to provide you with the full functionality of this website or to fulfil the purposes stated in our Cookie Policy.

None of the data processed by Nelly Castro on this website is sensitive or has a significant impact on your privacy or your rights and freedoms. In particular, no special category data is collected on our website.

When Nelly Castro collects personal data through this website, it will inform you which of your personal data are mandatory in order to provide the relevant services (usually by marking them with the asterisk symbol).

If you refuse to provide the mandatory data, it will be impossible to provide you with the relevant service or to process your request as a data subject, unless Nelly Castro decides otherwise depending on the specific circumstances of the case.

In order to keep the information contained in our processing system up to date and free of errors, we ask you to inform us as soon as possible of any changes or corrections to your personal data.

CATEGORIES OF RECIPIENTS TO WHOM WE DISCLOSE YOUR DATA?

Nelly Castro will not share the information collected through the features provided on this website with any other company or organisation. Only if required by a European Union regulation or Spanish law, Nelly Castro will disclose your data to the corresponding public administrations, to the competent authorities and, where applicable, to judges and courts, on the basis of a legal obligation.

When your personal data is to be processed on behalf of Nelly Castro, our company will only select suppliers (data processors) that provide sufficient guarantees for the application of appropriate technical and organisational measures so that the processing complies with the requirements of the applicable data protection legislation (RGPD and LOPDGDD) and guarantees the defence of the rights of the data subject.

INTERNATIONAL DATA TRANSFERS IN WHICH CASES MAY YOUR PERSONAL DATA BE TRANSFERRED TO A THIRD COUNTRY OUTSIDE THE EUROPEAN ECONOMIC AREA?

The following international data transfers are envisaged:

Some of the cookies used by Nelly Castro (as indicated in the Cookie Policy) or the Facebook "Like" button may transfer certain data, such as your IP address or certain browser parameters or configurations of your device or terminal, to the following companies: meta and Google, based in the United States of America.

As you know, the international transfer of personal data to the United States of America is legitimised by an adequacy decision of the European Commission of 12 July 2016, which authorises the Privacy Shield.

RETENTION PERIODS: WHAT CRITERIA DO WE USE TO DETERMINE HOW LONG WE KEEP YOUR PERSONAL DATA?

We keep your personal data for as long as it is necessary for the purposes for which it was collected or for the performance of the contractual relationship, as well as during the limitation periods of any legal disputes.

We will also keep your data for as long as you withdraw your consent or for as long as you do not request that we erase that data or restrict or object to processing.

RIGHTS: HOW DO WE ASSIST DATA SUBJECTS IN EXERCISING THEIR RIGHTS AND WHAT ARE THOSE RIGHTS?

Nelly Castro will always facilitate the exercise of your rights in relation to the protection of personal data through visible, accessible and simple procedures and forms.

Whenever appropriate, Nelly Castro will allow requests to be made electronically.

Specifically, you can send us your request with a copy of your identity card to the postal address (see Identity of the Responsible Party above in this Policy) or by email with a digitised copy of your identity card to the address kontakt@nellycastro.de.

The exercise of rights is free of charge. In cases where requests are manifestly unfounded or excessive, especially if they are repetitive, Nelly Castro may charge a fee to offset the administrative costs of responding to the request or refusing to act. This fee must not represent additional revenue for Nelly Castro, but must correspond to the actual costs of processing the request.

Nelly Castro must inform the affected party of the action resulting from its request within one month (this period may be extended to two months for particularly complex requests, in which case the affected party must be informed of this extension within the first month).

If Nelly Castro decides not to process a request, it must inform the affected party within one month of the request being submitted, giving reasons.

And these are your rights as a data subject or personal data holder:

Right of access: you have the right to obtain confirmation from Nelly Castro as to whether or not personal data about you is being processed. Nelly Castro will provide a copy of the personal data processed, if applicable.

Right to rectification: You have the right to obtain, without undue delay, the rectification of inaccurate personal data about you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of an additional declaration.

Right to erasure: You have the right to obtain, without undue delay, the erasure of personal data concerning you. If the circumstances referred to in Article 17.1 of the GDPR apply, Nelly Castro is obliged to delete your data without delay. 

Right to data portability: you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transfer it to another controller without Nelly Castro preventing you from doing so, if the processing is based on your consent and is also carried out by automated means.

Right to restriction of processing: If the processing of your personal data has been restricted on the basis of a request from you, this data - with the exception of its storage - may only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. You have the right to obtain the restriction of the processing of your personal data if one of the circumstances referred to in Article 18.1 of the GDPR is met.

Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you on the basis of the legitimate interests of Nelly Castro or third parties. Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you. If you object to the processing of your data for direct marketing purposes, those personal data will immediately no longer be processed for those purposes.

We remind you that if the legal basis for the processing of the data is your consent, you have the right to withdraw this consent at any time and as easily as you gave it.

You also have the right to complain to the competent supervisory authority, usually the Spanish Data Protection Authority, if you have not been satisfied by Nelly Castro in the exercise of your rights. You can find more information on the company's website at this link.

Finally, you have the right not to be subject to a decision by Nelly Castro based solely on automated processing, including profiling, which produces legal effects or otherwise significantly affects you.

TECHNICAL AND ORGANISATIONAL MEASURES - WHAT SECURITY MEASURES DOES NELLY CASTRO APPLY WHEN PROCESSING YOUR PERSONAL DATA?

The protection of users' privacy, professional secrecy and the security of personal data are important principles and firm commitments in Nelly Castro's actions and handling of personal data.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, Nelly Castro will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These technical and organisational measures aim to reduce and minimise the risks of loss, misuse, alteration, unauthorised access or disclosure of personal data relating to you.

To provide you with additional security, this website has installed a Secure Socket Layer (SSL) certificate that encrypts communications between you and Nelly Castro Travel, giving the website the status of a trusted, authentic and secure website.

CHANGE IN PRIVACY POLICY

In order for Nelly Castro to effectively implement the principle of proactive and ongoing compliance with the Privacy Policy and to comply with the duty of transparency, it is likely that we will amend this Privacy Policy from time to time.

We therefore encourage you to review this policy periodically. Nevertheless, Nelly Castro will use its best endeavours to inform data subjects of any material changes to this Privacy Policy that affect the rights and interests of data subjects.

MORE INFORMATION ABOUT NELLY CASTRO'S PRIVACY POLICY.

To clarify any doubts, questions or concerns raised or not resolved by reading this Privacy Policy, you may contact Nelly Castro at the following email address: kontakt@nellycastro.de. Or at the postal address of the data controller set out at the beginning of this policy.

Google ReCaptcha

We integrate the function for the recognition of bots, e.g. for entries in online forms ("ReCaptcha") of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.