Privacy Policy

This notice from “TAPICERIAS GANCEDO, LTD.” (hereafter “GANCEDO”) serves to inform users of the www.gancedo-com and b2b.gancedo.com websites, in compliance with European Parliament Regulation (EU) 2016/679 and Council of 27 April 2016 (General Regulation of Data Protection) and Organic Law 3/18 of 5 December relating to the Protection of Personal Data and guarantee of digital rights and other applicable legislation, of its personal data protection policy so that users may decide expressly, freely and voluntarily to provide “GANCEDO” with  the personal data requested relating to requests for information or in order to contract various products offered in the context of the sale of goods and services to professionals and private individuals of fabrics, materials, and samples of all kinds.

Except where specifically stated to the contrary, all data considered necessary to complete the form or the paper-based version must be truthful, accurate, complete and up to date. Otherwise, “GANCEDO” may, depending on the case, decline to register the user or even refuse the specific service requested. All data provided by the user/interested party will be processed in accordance with the detailed provisions listed below.

In order to make a purchase on Gancedo websites, each one will contain specific guidance as to how to register and thus be enabled to access the purchase page.

The user must follow the registration instructions; otherwise, it will be impossible to conclude the purchase.

 

Information concerning the processing of personal data

Identification of the controller: “TAPICERIAS GANCEDO, S.L.”, registered at Calle Velázquez 38, MADRID, NIF (tax identification number): B-28116358, registered in the Madrid Commercial Register, Volume 1613, Book 1037, Section 3a, Folio 116, Sheet 7.382. Email contact: lopd@gancedo.com.

Purpose of processing:

All data supplied will be used to the following ends:

  • To reply to requests made by the interested party.
  • To maintain the relationship where one has been established.
  • To manage, administer, inform, provide and improve services that may be contracted.
  • Business relationships relating to our products and services.

 

Any personal data supplied will be retained as long as the commercial relationship remains ongoing, unless the interested party requests its deletion, or where the data are necessary for processing purposes. Data will not be destroyed if any legal provision exists requiring their preservation, in which case the data will be blocked, remaining solely at the disposal of the public administration, judges and lawcourts, relating to possible responsibilities resulting from its processing, until the end of any statute of limitations.

At present, no type of automated decision is ever taken based on your personal data, including the development of profiles. Should such automated decisions ever be considered in the future, prior consent will be sought.

Lawfulness of processing:

All processing of your personal data has been agreed to by you explicitly beforehand. You are kept informed, in advance, of all points as required by Law so that you can give informed consent.

You can revoke this agreement at any point exactly as outlined further on in this document.

The data can be disclosed to businesses in the group, as detailed below:

TAPICERÍAS S.A.

TAPICERÍAS GANCEDO S.A.

User and password registration:

Accepting the current conditions implies that the Client will be responsible for the management of the log-in account and password with which they are granted access to the TAPICERIAS GANCEDO b2b.gancedo.com website. The current Conditions apply in addition to the Electronic Commerce conditions.

The Client will be responsible for maintaining the confidentiality of the Username and password of the account used to access the content of the b2b.gancedo.com website, also accepting sole responsibility for all activity which may occur under their Username or  on the Account. The Client undertakes to report any unauthorised use of the account or any other security breach immediately. Tapicerías Gancedo will not be held responsible for any loss or damage which may result from the loss of the account or from use not authorised by the account holder.

Any person acting using the passwords of a Tapicerías Gancedo Client, whether a colleague, employee, etc., will be considered to be the representative of the Client and with sufficient powers to act as such and to bind him/her.

Minors:

Minors are not permitted to make purchases on the b2b.gancedo.com website. “GANCEDO” reserves the right to request documentary proof of identity from the User in any case where there may be doubts regarding the veracity of his/her data, and to refuse to provide services unless the User addresses the said request.

Recipients, assignment and transfer of data:

These websites are aimed at fabric and upholstery sector professionals, although private individuals may also make online purchases with the consent of the company.

Your data will not be shared with third parties, except where it is essential for the provision of services or is a legal obligation.

Similarly, your data will not be transferred to non-EU countries, unless it is essential for fulfilling the objectives and you have given us prior, explicit permission.

Rights of interested parties:

You may at any time exercise the rights listed below, by mail to “Tapicerias Gancedo, S.L”, Calle Velazquez number 38 28001 Madrid; or by email to lopd@gancedo.com or using the following online form  www.gancedo.com/derechos. The request must include the name, surnames and documentation proving the identity of the interested party or their legal representative, as well as the representative’s proof of identity, a covering letter confirming the request, an address for notification purposes, date and signature of the applicant and supporting documents relating to the request being made. Should the request not meet the requirements specified, rectification will be required.

The rights of the interested parties are access, rectification, restriction, portability, objection and deletion, defined as follows:

Right to Access:

The interested party will have the right to obtain from the data controller confirmation as to whether or not personal data concerning him/her are being processed and, should this be the case, the right to access the personal data and the following information:

  1.  
    1. The purpose of the processing
    2. The types of personal data involved
    3. The recipients or types of recipients to whom the personal data has been or will be communicated, in particular third parties or international organizations
    4. Wherever possible, the specified retention period of the personal data or, if that is not possible, the criteria applied to determine this period
    5. The existence of the right to request from the data controller the rectification or deletion of personal data or restrictions on the processing of personal data relating to the interested party, or to object to such processing
    6. The right to present a complaint to a supervisory body
    7. When the personal data has not been obtained from the interested party, any information available as to its source
    8. The existence of automated decisions, including the development of profiles, referred to in Article 22, sections 1 and 4, and at the least in such cases, meaningful information as to the logic applied, as well as the importance of and the likely consequences of such processing for the interested party.

When personal data is transferred to a third country or international organization, the interested party will have the right to be informed of the appropriate guarantees by virtue of those set out in Article 46 relating to transfer. The data controller will provide a copy of the personal data being processed. The processer may levy a reasonable fee based on administrative costs for any other copy requested by the interested party. When the interested party presents the request electronically, the information will be supplied in a commonly used electronic format, unless a request is made for it to be supplied in another format.

Right to rectification:

The interested party will have the right to obtain the rectification of any inaccurate personal data concerning him/her from the data controller without undue delay. Bearing in mind the purposes of the processing, the interested party will have the right to complete any incomplete personal data, including by means of a supplementary declaration.

Right to deletion:

The interested party will have the right to obtain the deletion of any personal data relating to him/her from the data controller without undue delay, the data controller being obliged to delete the personal data without undue delay given any of the following circumstances:

  1.  
    1. the personal data are no longer needed in relation to the purposes for which they were collected or are used to other ends
    2. the interested party withdraws the consent on which processing was granted in accordance with Article 6, Section 1, letter a), or Article 9, Section 2, letter a), and when this is not based on other legal grounds
    3. the interested party is opposed to processing in accordance with Article 21, Section 1, and no other legitimate reasons take precedence regarding the processing, or if the interested party objects to processing in accordance with Article 21, Section 2
    4. if the personal data have been unlawfully processed
    5. if the personal data must be deleted in order to comply with a legal obligation established in EU law or that of any Member States applying to the data controller
    6. if the personal data have been obtained in connection with the offer of services of the information society referred to in Article 8, Section 1

When the data controller has made public personal data over which the interested party has exercised the right to deletion, the data controller must take reasonable measures, bearing in mind the technology available and the costs of its application, to communicate the request for data deletion to third parties who may be processing that information, including any link to that data or to any copy or reproduction of the same.

This right is limited by other rights such as the right to freedom of expression and information, to compliance with any legal obligation, or when it is deemed in the public interest.

Right to restriction of processing:

The interested party will have the right to obtain from the data controller the restriction of processing of data in any of the following circumstances:

  1. if the interested party contests the accuracy of the personal data, within a timeframe which allows the controller to verify the accuracy of the same
  2. if the processing operation is unlawful and the interested party objects to the deletion of the personal data and requests instead a restriction as to their use
  3. if the controller no longer needs the personal data for the purposes of the processing operation but the interested party needs them for the drafting, exercising or pursuit of complaints
  4. if the interested party has objected to the processing operation by virtue of Article 21, Section 1, while whether the legitimate motives of the controller take precedence over those of the interested party is under investigation

When the processing of personal data has been restricted by virtue of Section 1, the said data can only be used for processing, with the exception of their preservation, with the consent of the interested party or for the drafting, exercising or pursuit of complaints, or with a view to protecting the rights of another natural or legal person or for reasons of significant public interest to the Union or to another Member State.

Any interested party who has obtained the restriction of the processing operation in accordance with Section 1 will be informed by the controller before the lifting of the said restriction.

Right to objection

The interested party will have the right to object at any time, for reasons relating to his/her particular situation, to the processing of personal data concerning him/her based on the provisions of Article 6, Section 1, letters e) and/or f), including the development of profiles based on the said provisions.

The data controller will stop processing personal data, except where compelling legitimate reasons can be shown as to why the processing should take precedence over the rights and freedoms of the interested party, or for the drafting, exercising or pursuit of complaints.

When the processing of personal data has as its objective direct marketing, the interested party will have the right to object at any time to the processing of the personal data concerning him/her, including the development of profiles insofar as this is related to the said marketing.

When the interested party objects to processing for direct marketing purposes, the personal data will cease to be processed for those purposes.

When the personal data are processed with a view to scientific or historical research or for statistical purposes in accordance with Article 89, Section 1, the interested party will have the right, for reasons relating to his/her personal situation, to object to the processing of personal data relating to him/her, except where it may be necessary to fulfil the objectives of an undertaking carried out in the public interest.

Right to data portability:

The interested party will have the right to receive personal data concerning him/her, that he/she may have provided to a data controller, in a structured, commonly used and machine readable format, and to transmit them to another data controller without the controller to whom they may have been provided preventing this, when:

  1. The processing operation is based on consent in accordance with Article 6, Section 1, letter a), or Article 9, Section 2, letter a), or in a contract in accordance with Article 6, Section 1, letter b), and
  2. The processing operation is carried out by automated means.

On exercising his/her rights to data portability as outlined in Section 1, the interested party will have the right to have the personal data transmitted directly from controller to controller wherever this is technically feasible.

The exercise of the right mentioned in Section 1 of the present article will be understood without prejudice to Article 17. Such a right will not apply to processing which may be necessary for the fulfilment of an undertaking carried out in the public interest or in the exercise of public powers conferred on the data controller.

The data controller will communicate any rectification or deletion of personal data or restriction of processing carried out in accordance with Article 16, Article 17, Section 1, and Article 18, to each of the recipients to whom the personal data may have been communicated, except where this is impossible or demands a disproportionate effort. The controller will inform the interested party regarding the said recipients, should he/she so request.

Withdrawal of consent: The interested party, who at some point may have granted consent to the processing of his/her personal data, may likewise withdraw it at any time. Withdrawal of consent will not imply the unlawfulness of processing previously carried out.

The interested party will have the right to present a complaint to the competent Supervisory Authority.

In the event that personal data are going to be processed at a later date to different ends, the controller will inform the interested party of such an eventuality.

Security measures:

The Data Controller declares that the necessary measures of a technical and organisational nature have been adopted to guarantee the security of the data and to prevent their alteration, loss, unauthorized processing or access, bearing in mind the state of technology, the nature of the data stored and the risks to which they are exposed, whether these arise from human action or from the natural or physical environment.

The www.gancedo.com website contains links to other web pages that may be of interest to the interested party. “GANCEDO” accepts no responsibility for these links, being unable to give any guarantees as to their compliance with appropriate privacy policies, with the result that the interested party accesses, entirely at his/her own risk, the content of the said web pages subject to the conditions established therein.

Should you have any queries, questions or recommendations regarding our Privacy Policy, please contact us by email at the following address: “lopd@gancedo.com”

“Tapicerías Gancedo, S.L.”

All rights reserved