This privacy policy applies to the processing of personal data of customers and/or users of https://ortoprime.com, hereinafter the WEBSITE, owned by Ortoprime, S.L., hereinafter the DATA CONTROLLER.
Applicable legislation
Our Privacy Policy has been designed in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR EU 2016/679, and, insofar as it does not conflict with the aforementioned Regulation, in accordance with Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights, hereinafter LOPDGDD 3/2018.
By providing us with their data, the customer and/or user declares that they have read and understood this Privacy Policy and gives their unequivocal and explicit consent to the processing of their personal data in accordance with the purposes and terms set out herein.
Basic information on data protection
|
Data Controller |
Ortoprime, S.L. |
|
Purpose |
To respond to information requests received, answer enquiries submitted, manage newsletter subscriptions to receive the latest news about our items and/or products, offers, discounts and patient care guides, manage orders placed by customers and/or online orthopaedic store users, provide customer support services, and send commercial communications about our items and/or products by post, telephone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic means, provided that the data subject has given consent for this purpose. |
|
Lawful basis |
Performance of a contract to which the data subject is a party or the application, at their request, of pre-contractual measures. Legitimate interest of the controller. Consent of the data subject. |
|
Recipients |
No data will be transferred to third parties, except where legally required. |
|
Rights |
You have the right to access, rectify and delete your data, as well as other rights detailed in the additional information, which you may exercise by contacting the Data Controller at support@ortoprime.com |
|
Additional information |
You may consult additional and detailed information on Data Protection in the attached clauses available at https://ortoprime.com/pages/privacy-policy |
Additional information on data protection
The Data Controller is:
- Identity: Ortoprime, S.L.
- Tax ID: B10502813
- Address: Carretera Ciudad Rodrigo, 0 S N, 10840 Moraleja, Cáceres, (Spain)
- Email: support@ortoprime.com
Data Protection Officer
The DATA CONTROLLER does not have a Data Protection Officer.
Purpose and legal basis of processing
- a) In general:
The DATA CONTROLLER processes the personal data provided by its customers and/or users for the following purposes:
- To respond to information requests received.
- To answer enquiries submitted.
- To manage newsletter subscriptions to receive the latest news about our items and/or products, offers, discounts and patient care guides.
- To manage orders placed by customers and/or users of the online orthopaedic store.
- To provide customer support services.
- To send commercial communications about our items and/or products by post, email, SMS/MMS, WhatsApp or other equivalent electronic means, provided that the data subject has given consent for this purpose.
We value your privacy and the information you agree to share in relation to our SMS marketing service. We use this information to send you SMS notifications (about your order, including abandoned cart reminders), SMS marketing offers and transactional messages, including review requests.
Our website uses cookies to track items added to your shopping basket, including when you abandon the checkout. This information is used to determine when to send SMS cart reminder messages.
The legal basis for processing the data is the performance of a contract to which the data subject is a party or the application, at their request, of pre-contractual measures, the legitimate interest of the controller, and the consent of the data subject.
- b) Specifically, for sending commercial communications:
The DATA CONTROLLER may process the personal data of its customers and/or users in order to send commercial communications relating to its items and/or products, provided that the data subject has given consent for this purpose.
The legal basis for processing the data for this purpose is the consent of the data subject.
Recipients of the data
The personal data provided by customers and/or users will not be transferred to third parties, except where legally required.
Rights of customers and/or users
As the data subject, the customer and/or user has the right to obtain confirmation as to whether the DATA CONTROLLER is processing their personal data.
You have the right to access your personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain circumstances, the customer and/or user may request the restriction of the processing of their data, in which case we will retain it solely for the exercise or defence of legal claims.
In certain circumstances and for reasons related to their particular situation, the customer and/or user may object to the processing of their data. In this case, the DATA CONTROLLER will cease processing the data, except for compelling legitimate grounds or for the exercise or defence of potential claims.
The customer and/or user may exercise their rights by contacting Ortoprime, S.L. at the email address support@ortoprime.com, attaching a copy of their identity document or equivalent document.
If consent has been given for a specific purpose, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.
If the customer and/or user believes that there are issues with the way the DATA CONTROLLER is handling their data, they have the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (www.aepd.es), or with the supervisory authority of their country of residence.
Data retention
The personal data provided will be retained for the time necessary to fulfil the purposes for which it was collected, to determine any liabilities that may arise from those purposes and from the processing of the data, and to comply with other legal obligations.
Additional information
For further information on the protection of personal data, you may consult the website of the Spanish Data Protection Agency (www.aepd.es), or contact the DATA CONTROLLER at the email address support@ortoprime.com
What types of data do we process?
For the purposes set out in the previous section, we process Customer data, which we may divide into the following sources and categories:
a) Data provided directly by the customer and/or user: data provided directly by the customer and/or user, either when requesting the service through the completion of electronic forms for the collection of personal data or in paper format prepared for this purpose, as well as data provided during the contractual relationship through various means, such as complaints or information requests submitted to Customer Service. The customer and/or user is responsible for the accuracy and updating of this data. Identification Data (first and last name, NIF, NIE, passport, postal address, email, telephone, mobile phone, handwritten or digital signature, social media profiles, IP addresses, username and password). Financial Data (bank details). b) Data obtained from sources other than the customer and/or user: data obtained from sources other than the customer and/or user, either with their consent or under another legal basis (legitimate interest, compliance with a legal obligation, etc.). c) Data derived from the development of the commercial relationship: data indirectly provided by the customer and/or user resulting from the provision of the contracted service and the maintenance of this activity. This category includes traffic data, payment history or purchased items and/or products, browsing data through the public website or access to the private area, or other data of a similar nature.
Record of processing activities
We inform you that the personal data obtained from the customer and/or user as a result of completing the electronic forms available on the WEBSITE form part of the Record of Processing Activities (ROPA) of the DATA CONTROLLER, which will be periodically updated in accordance with the provisions of GDPR EU 2016/679 and LOPDGDD 3/2018.
Recipients
The personal data of data subjects will be disclosed to the recipients indicated below:
a) In general: Suppliers of the DATA CONTROLLER acting as data processors, within the scope of the corresponding provision of services (lawyers, accounting and tax advisors, consultants, goods suppliers, transport agencies and technology service providers). Authorities and competent bodies, to the extent necessary to comply with legal obligations. b) In relation to the “Contact Form” and other enquiries (those that may be submitted via the email addresses available on the WEBSITE), the “Newsletter Subscription Form”, the “Create an Account – Register Form”, the “Account Login – Sign In Form”, the “Guest Checkout Form” and the “Live Chat – Online Customer Support Platform”: No data will be transferred to third parties, except where legally required.
Transfers to third countries
No transfers of data to third countries without an adequate level of protection are envisaged.
Retention periods
Personal data will be retained:
a) In general: Data will be retained until its deletion is requested and, in any event, for the years necessary to comply with legal obligations. b) In relation to the “Contact Form” and other enquiries (those that may be submitted via the email addresses available on the WEBSITE), the “Newsletter Subscription Form”, the “Create an Account – Register Form”, the “Account Login – Sign In Form”, the “Guest Checkout Form” and the “Live Chat – Online Customer Support Platform”: Personal data will be retained until the relationship between the DATA CONTROLLER and the customer and/or user ends, unless the data subject requests its deletion earlier, or until the data subject withdraws consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. For this purpose, the data subject is reminded that they must inform the DATA CONTROLLER, as the recipient to whom personal data is communicated, of any rectification or deletion of the data of their representatives, authorised persons and other contact persons.
Once the relationship has ended, to the extent that the personal data of data subjects is relevant for the liability of the DATA CONTROLLER towards customers and/or users, such data will be retained, duly blocked, at the disposal of judicial authorities or competent public administrations, for the purposes of liabilities arising from the processing for the applicable limitation period.
Rights of data subjects
Customers and/or users of the WEBSITE may exercise, where applicable, the following rights in relation to the DATA CONTROLLER: access to personal data, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection to processing and not to be subject to automated individual decision-making and, where processing is based on consent, the right to withdraw it at any time.
Customers and/or users may exercise these rights by submitting a written and signed request sent to the postal address of the DATA CONTROLLER at Carretera Ciudad Rodrigo, 0 S N, 10840 Moraleja, Cáceres, (Spain) or via the email address support@ortoprime.com in both cases enclosing valid proof of identity, such as a copy of the NIF/NIE or equivalent document, and clearly indicating the right they wish to exercise.
Customers and/or users also have the right to lodge a complaint with the competent Supervisory Authority (Spanish Data Protection Agency) if they consider that the processing does not comply with current legislation or believe that their rights regarding the protection of their personal data have been infringed, especially when they have not obtained satisfaction in the exercise of their rights, via the website https://www.aepd.es
These rights will be fulfilled by the DATA CONTROLLER within a period of 1 month, which may be extended to 2 months if the complexity of the request or the number of requests received so requires. Notwithstanding the obligation to retain certain data for the legally established periods and until the limitation of any liabilities arising from possible processing or, where applicable, from a contractual relationship.
In addition to the above, and in relation to data protection legislation, users who so request have the possibility to organise the fate of their data after their death.
Sending of commercial communications
In accordance with the provisions of the Second Final Provision of Law 9/2014 of 9 May on Telecommunications, which amends Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, commercial communications sent by electronic means must be clearly identifiable as such, and the natural or legal person on whose behalf they are sent must be clearly identifiable, without prejudice to the provisions of regulations issued by the Autonomous Communities with exclusive competence in consumer matters.
The customer and/or user who provides their contact details to the DATA CONTROLLER by clicking the “SUBMIT” button on the electronic personal data collection forms available on the website and ticking the two consent checkboxes provided, “I accept the processing of my data for the purposes indicated in the basic data protection information” and “I give my consent to receive commercial communications about your items and/or products”, expressly authorises and gives their explicit, free and unequivocal consent to the DATA CONTROLLER to process their personal data in order to send them commercial communications about its items and/or products by post, telephone, email, SMS/MMS, WhatsApp, Telegram or other equivalent electronic means.
The legal basis legitimising this processing is the consent of the data subject, which may be withdrawn at any time.
In accordance with the provisions of Articles 21 and 22 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, the user may object to the processing of their data for promotional purposes and withdraw consent to receive commercial communications by email by simply notifying the PROVIDER of their intention through a simple and free procedure consisting of sending an email to the address support@ortoprime.com, indicating “CANCELLATION” or “DO NOT SEND” in the subject line.
The data provided will be retained for as long as the commercial relationship is maintained or for the years necessary to comply with legal obligations.
Social media policy
The DATA CONTROLLER has profiles on the following social networks on the Internet:
Facebook: https://www.facebook.com/OrtoPrime.es
Instagram: https://www.instagram.com/OrtoPrime.es
Youtube: https://www.youtube.com/channel/UC9rxy5FNipYJYTdgcx1PppQ
In this context, it is considered responsible for the processing of the data of its users, whether followers, subscribers, fans or simply individuals who submit comments or enquiries through these channels.
In this regard, the DATA CONTROLLER may use these profiles to inform its users of news it considers relevant for the purposes of the services offered, or to share information or current affairs articles published by other social network users.
Under no circumstances will it use users’ personal information without their consent to establish relationships other than those provided for on the aforementioned social network, requesting the user’s consent where required.
Accuracy of data provided by data subjects
The customer and/or user is responsible for ensuring that the information provided by completing the electronic forms made available on the WEBSITE or by sending emails to the various addresses under the ortoprime.com domain is accurate, being responsible for the correctness of all data provided and keeping it updated so that it reflects the true situation, and being liable for any false or inaccurate information provided and for any damage, inconvenience or issues that may be caused to the DATA CONTROLLER or to third parties.
Security measures
The DATA CONTROLLER guarantees that it has implemented appropriate technical and organisational policies on the WEBSITE to apply the security measures established by GDPR EU 2016/679 and LOPDGDD 3/2018 in order to protect the rights and freedoms of customers and/or users and has provided them with the appropriate information so that they can exercise these rights.
The DATA CONTROLLER, in order to protect individual rights, especially in relation to automated processing and with the intention of being transparent with customers and/or users, has established a policy that includes all such processing, the purposes pursued, their lawfulness and the tools available to customers and/or users to exercise their rights.
The WEBSITE is built on the Shopify.com e-commerce platform and has an SSL encryption certificate enabled for the entire domain, allowing users to securely submit their personal data through the existing electronic forms.
The WEBSITE is hosted on servers provided to the DATA CONTROLLER by Shopify International Limited, VAT IE3347697KH, with registered address at 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland.
All information will be stored and managed with due confidentiality, applying the necessary IT security measures to prevent unauthorised access or misuse of data, its manipulation, deterioration or loss.
However, the customer and/or user should be aware that the security of IT systems is never absolute. When personal data is provided over the Internet, such information may be collected without consent and processed by unauthorised third parties. The DATA CONTROLLER declines any responsibility for the consequences that such acts may have for the user if the information has been voluntarily disclosed.
Acceptance and consent
The customer and/or user declares that they have been informed of the conditions regarding the protection of personal data, accepting and consenting to the automated processing of such data by the DATA CONTROLLER in the manner and for the purposes indicated in this Privacy Policy. Some services provided on the WEBSITE may contain specific conditions with particular provisions regarding the protection of personal data.
Changes to this privacy policy
The DATA CONTROLLER reserves the right to modify this Privacy Policy in order to adapt it to legislative, case-law or interpretative developments of the Spanish Data Protection Agency, as well as industry practices.
In such cases, the DATA CONTROLLER will announce the changes introduced on the website with reasonable notice prior to their implementation.
This privacy policy may be supplemented by the Legal Notice, the Cookie Policy and the General Terms and Conditions that may apply to certain products or services, where such access entails specific provisions regarding the protection of personal data.