Privacy Policy

1. Data controller

The identifying details of the data controller responsible for processing your personal data are as follows:

• Identity: CHOLLO PISCINAS SL
• Tax ID (NIF/CIF): B26943928
• Address: C/ CONCHA ESPINA 1003 B1 3F
• Phone: +34 614 90 60 83
• Contact email: info@chollopiscinas.com
• Data protection email: info@chollopiscinas.com

2. Personal data we collect

Depending on how users interact with our website, we may collect the following categories of personal data:

• Identification data: first name, last name, email address and telephone number.
• Shipping data: full postal address (street, number, postcode, town and province).
• Browsing data: IP address, browser type and version, operating system, pages visited, time spent, referral source and data collected via cookies.
• Purchase-related data: order history, products purchased, amounts, purchase frequency and product preferences.

It is important to note that payment data (credit or debit card numbers, expiry dates and CVV codes) are NOT processed or stored directly by CholloPiscinas. This data is handled entirely by Redsys (CaixaBank virtual POS), our payment service provider, which complies with Level 1 PCI DSS security standards.

3. Purposes of processing

The personal data we collect is processed for the following purposes, each of which has a specific legal basis under the GDPR:

4. Recipients of data

In order to fulfil the purposes described above, it is necessary to share your personal data with the following third parties or data processors:

• Redsys Servicios de Procesamiento, S.L. (Spain): payment processing through CaixaBank virtual POS. Privacy policy: https://www.redsys.es/politica-de-privacidad.html
• Amazon Web Services (AWS): web hosting and data storage in the EU (region eu-west-3, France)
• Amazon Simple Email Service (SES): sending transactional emails (order confirmations, password resets)
• Google Analytics (Google LLC): statistical analysis of web traffic

Personal data is not sold, transferred or shared with third parties for their own commercial purposes.

5. International data transfers

Some of the service providers mentioned above may be located outside the European Economic Area (EEA). In particular, Google LLC may transfer personal data to the United States of America. Payment processing is performed entirely within the EEA via Redsys / CaixaBank.

These international transfers are covered by the Standard Contractual Clauses (SCCs) approved by the European Commission, which ensure an adequate level of protection for the personal data transferred, in accordance with Articles 44 to 49 of the GDPR.

Data stored on Amazon Web Services is hosted entirely within the European Union, specifically in the eu-west-3 region (Paris, France), meaning no international transfer occurs in relation to data hosting.

For further information about the safeguards adopted for international data transfers, please contact us at info@chollopiscinas.com.

6. Retention period

Personal data provided will be retained for the following periods, depending on the purpose of processing:

• Customer data (orders and invoices): for the duration of the commercial relationship and an additional 5 years due to tax obligations (General Tax Act)
• User account data: until the user requests cancellation or deletion
• Newsletter data: until the user withdraws their consent
• Browsing and analytics data: 26 months

Once the indicated retention periods have expired, data will be blocked and subsequently deleted securely, unless a legal obligation justifies its retention for an additional period.

7. User rights

In accordance with the GDPR and the Spanish Data Protection Act (LOPDGDD), the user may exercise the following rights in relation to their personal data at any time:

• Right of access (Art. 15 GDPR): the right to obtain confirmation as to whether their personal data is being processed and, where applicable, to access such data.
• Right to rectification (Art. 16 GDPR): the right to request the correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): the right to request the deletion of personal data when, among other reasons, it is no longer necessary for the purpose for which it was collected.
• Right to restriction of processing (Art. 18 GDPR): the right to request the suspension of data processing in certain circumstances.
• Right to data portability (Art. 20 GDPR): the right to receive personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
• Right to object (Art. 21 GDPR): the right to object to the processing of personal data in certain circumstances, including processing for direct marketing purposes.
• Right not to be subject to automated individual decision-making (Art. 22 GDPR): the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects the individual.
• Right to withdraw consent: at any time and without affecting the lawfulness of processing based on consent prior to its withdrawal.

To exercise any of these rights, the user must send a request by email to info@chollopiscinas.com, stating "Data Protection" in the subject line and attaching a copy of their national identity document (DNI, NIE or equivalent) to verify their identity.

The request will be processed within a maximum of 30 days from receipt. If the request is complex or a large number of requests are received, the period may be extended by a further two months, with the user being informed within the first month.

Furthermore, the user has the right to lodge a complaint with the Spanish Data Protection Authority (AEPD), located at C/ Jorge Juan, 6, 28001 Madrid, or through its electronic office at www.aepd.es, if they consider that the processing of their personal data does not comply with applicable legislation.

8. Security measures

In compliance with Article 32 of the GDPR, CHOLLO PISCINAS SL has implemented appropriate technical and organisational measures to ensure the security of personal data and to prevent its alteration, loss, processing or unauthorised access, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity to the rights and freedoms of individuals. These measures include:

• SSL/TLS encryption on all communications between the user's browser and our servers, ensuring the confidentiality of transmitted data.
• Payment data managed entirely by Redsys (CaixaBank virtual POS), a Level 1 PCI DSS certified provider, the highest security standard in the payments industry.
• Access control for personal data through authentication systems and role-based permissions, limiting access exclusively to authorised personnel.
• Regular and automated backups of stored data, with disaster recovery procedures.
• Certified security infrastructure from Amazon Web Services (AWS), which holds ISO 27001, SOC 1, SOC 2 and SOC 3 certifications, among others.

These measures are reviewed and updated periodically to adapt to new threats and vulnerabilities, in order to maintain a level of security appropriate to the risk.

9. Cookie policy

Cookies are small text files stored on the user's device (computer, tablet or smartphone) when they visit a website. They allow the website to remember the user's actions and preferences for a period of time, so that the user does not have to reconfigure them each time they return to the site or navigate between its pages.

On www.chollopiscinas.com we use the following types of cookies:

• Technical cookies (session and preference): strictly necessary for the website to function. These include session cookies to keep the user identified during their visit and preference cookies to remember the selected language setting. These cookies do not require prior consent.
• Analytics cookies (Google Analytics GA4 - ID: G-PG9L15FGKK): used to collect statistical information about website usage, such as the number of visitors, the most visited pages and time spent. This information is processed in aggregated and anonymised form to improve our services.

The user can manage and disable cookies through their browser settings. Instructions for managing cookies in the main browsers are provided at the following links:

• Google Chrome: chrome://settings/cookies
• Mozilla Firefox: about:preferences#privacy
• Safari: Preferences > Privacy
• Microsoft Edge: edge://settings/privacy

It is important to note that disabling certain cookies may affect the proper functioning of the website. Some features, such as maintaining the user session or preferred language, may not work correctly if technical cookies are blocked.

In accordance with Article 22(2) of Law 34/2002 on Information Society Services and Electronic Commerce (Spanish E-Commerce Act (LSSI-CE)), analytics cookies will only be installed after obtaining the user's informed consent.

10. Policy amendments

CHOLLO PISCINAS SL reserves the right to amend this Privacy Policy to adapt it to legislative, case law or business practice developments. Any amendments will be published on this page of the website, always indicating the date of the last update.

Users are advised to review this Privacy Policy periodically to stay informed about how we protect their personal data. In the event that amendments materially affect data processing activities or users' rights, notice will be provided through the website or by email where possible.