PRIVACY AND DATA PROTECTION POLICY

In compliance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter, the “GDPR”), as well as Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (hereinafter, the “LOPDGDD”); Laboratorios Herbitas, S.L.U. (hereinafter, “HERBITAS”), as data controller, with Tax ID No. B46594362 and registered office at C/ Periodista Badia No. 13 B, Foios, 46134 Valencia, hereby informs visitors and users of the website of the following information regarding the processing of their personal data:

ONLINE STORE

Purpose and legal basis for processing

Your personal data will be processed on the basis of the performance of the contract resulting from the creation of your user account and/or the completion of a purchase through the Online Store, for the following purposes:

Registration, management and maintenance of your customer account.
Management and shipment of orders and returns, and processing of payments in accordance with the General Terms and Conditions established on this website.

Recipients of the data

Public authorities for compliance with legal obligations.
Credit institutions for payment management.
Transport companies for the delivery of purchased products.
HERBITAS may use service providers that have access to your data for the fulfilment of the purposes described above. In all cases, HERBITAS undertakes to enter into data processing agreements with its service providers in accordance with applicable legislation.

Data retention periods

Your data will be retained until your customer account is deleted and, in all cases, in accordance with the applicable statutory limitation periods.

Data protection rights

You may exercise your rights of access, rectification, erasure, portability, restriction, objection and withdrawal of consent by writing to HERBITAS at C/ Periodista Badia No. 13 B, Foios, 46134 Valencia, stating “Exercise of data protection rights”, or via the following email address: protecciondedatos@prim.es. You also have the right to lodge a complaint with the Supervisory Authority (Spanish Data Protection Agency www.aepd.es).

FORMS AND CONTACT SECTIONS

Purpose and legal basis for processing

When you contact HERBITAS through the forms and contact sections available on the website, your personal data will be processed on the basis of your express consent, in accordance with Article 6(1)(a) of the GDPR, for the purpose of responding to your enquiries and providing the requested services.

Recipients of the data

Your data will not be disclosed to third parties unless strictly necessary to resolve your enquiry or provide the requested services.

Data retention periods

Your data will be retained for as long as necessary to respond to your enquiry, provide the requested services and, in all cases, for the applicable statutory limitation periods.

Data protection rights

Purpose and legal basis for processing

When you subscribe to our Newsletter, we will process your personal data on the basis of the performance of the requested services for the management and maintenance of your subscription, in accordance with Article 6(1)(b) of the GDPR.

Recipients of the data

Public authorities for compliance with legal obligations.
Service providers and/or suppliers of goods involved in carrying out the purposes described above. For example, for the management and sending of communications to subscriber lists. In all cases, HERBITAS undertakes to enter into data processing agreements with its service providers in accordance with applicable legislation.

Data retention periods

Your data will be retained until you cancel your subscription.

Data protection rights

SENDING OF COMMERCIAL INFORMATION

Purpose and legal basis for processing

If you are a customer, HERBITAS may process your personal data for commercial purposes on the basis of its legitimate interest, in accordance with Article 6(1)(f) of the GDPR, where there is a prior contractual relationship and the products or services concerned are similar to those already purchased or contracted. In this context, HERBITAS may send you commercial information relating to such products or services.

Likewise, where you have given your express consent, HERBITAS may process your personal data for commercial purposes, in accordance with Article 6(1)(a) of the GDPR, and send you information about products, services, promotions or other commercial communications.

Recipients of the data

Public authorities for compliance with legal obligations.
Service providers and/or suppliers of goods involved in carrying out the purposes described above. For example, for the management and sending of commercial communications by email to contact lists. In all cases, HERBITAS undertakes to enter into data processing agreements with its service providers in accordance with applicable legislation.

Data retention periods

Your data will be retained until you object to the processing, withdraw your consent or request the erasure of your data.

Data protection rights

SENDING OF SATISFACTION AND OPINION SURVEYS

Purpose and legal basis for processing

If you are a customer, HERBITAS may process your data for the purpose of sending surveys to assess your level of satisfaction and to collect your assessment or opinion regarding the products and services offered, on the basis of its legitimate interest, in accordance with Article 6(1)(f) of the GDPR.

Likewise, where you have given your express consent, HERBITAS may process your personal data for the purpose of sending surveys to assess your level of satisfaction and to collect your assessment or opinion regarding the products and services offered, in accordance with Article 6(1)(a) of the GDPR.

Recipients of the data

Public authorities for compliance with legal obligations.
Service providers and/or suppliers of goods involved in carrying out the purposes described above. For example, for the management and sending of surveys by email to contact lists. In all cases, HERBITAS undertakes to enter into data processing agreements with its service providers in accordance with applicable legislation.

Data retention periods

Your data will be retained until you object to the processing, withdraw your consent or request the erasure of your data.

Data protection rights

PUBLICATION OF IMAGES AT EVENTS

Purpose and legal basis for processing

When you participate in HERBITAS events where images/videos are captured, we will request your express consent to publish the images and/or videos (including your voice) captured of you through HERBITAS’s usual communication channels, such as its website, social media and internal corporate platforms, for the purpose of publicising and promoting the activities and services carried out by the company. Likewise, provided that you have given us your express consent in accordance with Article 6(1)(a) of the GDPR, your images/videos (including your voice) captured at events may be disclosed to third parties for publication through their own communication channels.

In addition, HERBITAS may have a legitimate interest, in accordance with Article 6(1)(f) of the GDPR, in capturing general and panoramic images and/or videos (including voice) of events for publication through the company’s usual communication channels, for the purpose of publicising and promoting the activities and services it carries out. If you believe that you can be identified in any of these publications, you may exercise your right to have your image erased by following the instructions set out in the DATA PROTECTION RIGHTS section.

Recipients of the data

Your data will not be disclosed to third parties unless you have given your express consent or there is a legal obligation to do so. However, since images and/or videos (including voice) may be published through the company’s usual communication channels, any third party with access to these channels may view them (website, social media, HERBITAS internal corporate platforms, etc.).
Service providers and/or suppliers of goods involved in carrying out the purposes described above. For example, for taking images and videos or managing the publication of images on HERBITAS’s social media. In all cases, HERBITAS undertakes to enter into data processing agreements with its service providers in accordance with applicable legislation.
Likewise, where you have given us your express consent, your images/videos (including your voice) captured at events may be disclosed to third parties for publication through their own communication channels.

Data retention periods

Your data will be retained until you request its erasure or withdraw your consent.

Data protection rights

SOCIAL MEDIA

Purpose and legal basis for processing

HERBITAS has user profiles on social media platforms for the purpose of publicising and promoting its activities and services. If you decide to follow us, HERBITAS may, depending on the social media platform used, carry out the following processing activities in relation to your user profile:

Interact with you as a user through posts or private messages via the social media platform.
You may publish comments, images, links and, in general, any multimedia content supported by the social media platform on HERBITAS’s user profile. In this regard, users are advised that they are prohibited from publishing any content on HERBITAS’s user profile that is contrary to morality, ethics, good taste or decency and/or that infringes, violates or breaches intellectual or industrial property rights, image rights or any other applicable legal provision. HERBITAS shall not be responsible for content published by users. In such cases, HERBITAS reserves the right to remove content published by the user and to block the user.
Provided that you have given your express consent, in accordance with Article 6(1)(a) of the GDPR, we may publish on HERBITAS’s social media the images and/or videos (including your voice) captured of you at events, for the purpose of publicising and promoting the activities and services carried out by the organisation.
In addition, HERBITAS may have a legitimate interest, in accordance with Article 6(1)(f) of the GDPR, in capturing general and panoramic images and/or videos (including voice) of events for publication on social media, for the purpose of publicising and promoting the activities and services carried out by the organisation. If you believe that you can be identified in any of these publications, you may exercise your right to have your image erased by following the instructions set out in the DATA PROTECTION RIGHTS section.

Recipients of the data

When you publish content on HERBITAS’s user profile, other users may have access to such publications and to the information published on your user account. HERBITAS, for its part, will not communicate or disclose your data to third parties unless you have expressly authorised it to do so or there is a legal obligation.
Service providers and/or suppliers of goods involved in carrying out the purposes described above. For example, for managing the publication of images on HERBITAS’s social media. In all cases, HERBITAS undertakes to enter into data processing agreements with its service providers in accordance with applicable legislation.

Data retention periods

Your data will be retained for as long as you continue to follow HERBITAS’s user profile and/or until you request the erasure of your data. In the case of publications containing images and/or videos (including your voice) of you, your data will be retained until you request its erasure or withdraw your consent.

Data protection rights

USE OF COOKIES

Purpose and legal basis for processing

Please refer to the Cookie Policy section to identify the purposes applicable to each cookie. We will always request your express consent, in accordance with Article 6(1)(a) of the GDPR, for the activation of cookies that are not technical or strictly necessary for the operation of the website.

Recipients of the data

The website may use third-party cookies for the purposes identified in the Cookie Policy. Users’ interaction with third-party cookies may involve the international transfer of their data, provided that they have accepted the activation of such cookies through the settings panel.

In all cases, the international transfer of your data will be carried out in accordance with the provisions of the INTERNATIONAL DATA TRANSFERS section.

Data retention periods

Please refer to the Cookie Policy section to identify the retention period applicable to each cookie.

Data protection rights

INTERNATIONAL DATA TRANSFERS

Where the recipients of your data are located in countries outside the European Economic Area (hereinafter, the EEA), such communication will be considered an international transfer of data. In such cases, HERBITAS will adopt the necessary safeguards to ensure an adequate level of data protection and security in accordance with applicable legislation. These measures may include selecting service providers located in countries that have been recognised as providing an adequate level of data protection, as well as adopting additional safeguards through instruments such as the Standard Contractual Clauses approved by the European Commission, where applicable. In accordance with applicable legislation, you may request a copy of these safeguards in accordance with the provisions set out in the Data Protection Rights section.

DATA SECURITY

HERBITAS appropriately manages its server environment and maintains a firewall infrastructure that complies with strict security requirements. It continuously uses current technologies to ensure that the confidentiality and privacy of information are not compromised. The Website uses SSL (Secure Socket Layer) protocol to enhance security. SSL is an industry-standard technology used to protect and maintain the security of message transmissions over the Internet. When accessing your accounts or submitting information from secure web pages, encryption will encode your data into an unreadable format to prevent unauthorised users from accessing such data.

For this purpose, the necessary technical and organisational measures are adopted to guarantee the security of the personal data contained therein and to prevent their alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the data and the risks to which they are exposed.

The user shall be solely responsible for the accuracy of the data provided to HERBITAS.

Fields marked with an asterisk (*) on the forms available on the Website are mandatory. Therefore, if any of these fields are not completed, the form cannot be submitted.

Any changes made to the Privacy Policy and information management practices will be reflected in a timely manner, and HERBITAS may add, modify or remove this Privacy Policy whenever it considers it necessary.

Under no circumstances will HERBITAS modify its policies or practices in a way that makes them less effective in protecting previously stored personal data of our customers without the prior consent of the customers concerned.

PRIVACY AND DATA PROTECTION POLICY

ONLINE STORE

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

FORMS AND CONTACT SECTIONS

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

NEWSLETTER

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

SENDING OF COMMERCIAL INFORMATION

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

SENDING OF SATISFACTION AND OPINION SURVEYS

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

PUBLICATION OF IMAGES AT EVENTS

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

SOCIAL MEDIA

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

USE OF COOKIES

Purpose and legal basis for processing

Recipients of the data

Data retention periods

Data protection rights

INTERNATIONAL DATA TRANSFERS

DATA SECURITY