In accordance with the provisions of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR), regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data, the following information is provided to you:

CONTROLLER «Who is responsible for the processing of your data?»

Identity: TORREVEQUIA, S.L. with CIF B72085491

Adress: Avenida Virgen del Carmen, 53 – Local 2 – 11202 – Algeciras, CÁDIZ

Phone: +34 957 113 159

Email: info@torrevequia.com

Your personal data will be processed for the following purposes, as applicable:

SALE OF PRODUCTS

–Manage and develop your registration on the website, to contact you and resolve any questions or queries you may have about our products, as well as to place orders that may be of interest to you.

–Manage and process your online purchase or purchase through other means that may be of interest to you. We use your personal information to process and deliver your order, as well as to conduct an analysis of your order to prevent any type of fraud in the event of suspicious transactions.

-Manage possible returns or claims once you have made your purchase.

–Administrative management arising from the sale of our products, including the preparation and delivery of your order, the issuance of receipts, delivery notes, or invoices, collections, and the necessary communications to provide you with proper service. These communications will be made via telephone, instant messaging (WhatsApp, SMS), and/or email.

You can cancel your registered user account by contacting us via info@torrevequia.com

"The provision of the requested data is mandatory, as the information requested is essential for the sale of our products. If you refuse, the consequences of not providing this data will be the impossibility of carrying out the described purposes."

"Your personal data will not be used for purposes other than those described, and your express, informed, and unequivocal consent will always be requested beforehand. Profiling based solely on automated processing that produces legal effects or significantly affects you in a similar way will not be carried out."

COMPLAINTS AND CLAIMS

Receive the "Complaints and Claims Form" in order to respond to it and propose a solution to the complaint or claim raised or, where appropriate, justify the impossibility of a possible solution.

RIGHTS

Respond to the exercise of rights, queries and complaints.

"How long will your data be retained?"

Your personal data will be retained as long as there is a contractual or business relationship between you and CASERÍO DE LA SIERRA and you do not request its deletion. When they are not necessary, they will be kept for the period of prescription of the actions arising from the treatment, from the last confirmation of interest or last transaction/communication (6 years, for commercial purposes, article 30 of the Commercial Code: documentation, receipts, invoices, etc.; 10 years, Law 10/2010 on the prevention of money laundering and the financing of terrorism: documentation formalizing compliance with the obligations established in the aforementioned Law; 1 year, Law 34/2002 on Information Society Services and Electronic Commerce (LSSICE): traffic data relating to emails and data provided through the website; 1 year, Article 5 Law 25/2007 on the conservation of data relating to electronic communications and public communications networks: data relating to calls sent or received on fixed and mobile telephony; other conservation periods provided for in current applicable regulations).

During this limitation period for actions arising from processing, we will keep the information duly blocked and will not use it for any purpose, except to make the data available to judges and courts, the Public Prosecutor's Office, or the competent Public Administrations, particularly data protection authorities, to enforce potential liability arising from processing.

After these periods, the personal data will be deleted using appropriate security measures to ensure their complete destruction.

LEGITIMATION "What is the legitimacy for the processing of your data?"

CASERÍO DE LA SIERRA has the following legal bases to process your personal data: Legal Obligation, in accordance with article 6.1 letter c) GDPR 2016/679: The management and issuance of receipts, delivery notes or invoices resulting from the sale of our products is based on a legal obligation, as well as in responding to the exercise of rights made by you, as well as in responding to the exercise of rights made by you, the claims formally filed through the document "Complaints and Claims Sheet".

Execution of a contract, in accordance with article 6.1 letter b) GDPR 2016/679: The legal basis for the processing of personal data provided for the sale of our products, through our website, for the purpose of managing, processing and delivering your online purchase, is the execution of a sales contract to which you are a party (acceptance of the terms and conditions of the purchase).

All processing arising from the online sale of our products, such as administrative management, order preparation and delivery, collection management, communications required for the purpose of processing or others, as well as the management of any returns or claims requested, have the same legitimate basis (Article 6.1 letter b).

Express consent, in accordance with article 6.1 letter a) of the GDPR 2016/679:

In relation to the following purposes, the legal basis for the processing of your personal data will be your express consent:

Response to complaints filed, as well as for resolving questions and queries.

Registering a user account on the website.

You may withdraw your consent without affecting the lawfulness of the processing based on consent prior to its withdrawal. You may communicate your withdrawal of consent at any time by email. info@torrevequia.com

"The revocation of consent will not affect our contractual relationship." Legitimate Interest of the Controller, pursuant to Article 6.1 letter f) of GDPR 2016/679: In relation to the following purposes, the legal basis for processing the personal data provided will be our legitimate interest:

We may use your personal data to pursue legal claims and/or take legal action to defend our legitimate rights and interests.

Analyze orders placed through our website for the purpose of preventing any type of fraud, in the event that transactions are carried out that may be considered suspicious, based on our legitimate interest in combating fraud.

Your personal data may be processed by the business group for internal administrative purposes.

RECIPIENTS“To which recipients will your data be communicated?”

Your personal data may be disclosed lawfully and, when necessary, to the following recipients. Such disclosures will be necessary for the provision of services and the sale of our products:

Public administrations and bodies (Treasury, etc.) and/or law enforcement agencies, when required by law or necessary for the legal protection of our legitimate interests and in compliance with the law.

Companies responsible for data processing, such as IT Service Providers, Consulting Firms, etc. CASERÍO DE LA SIERRA has signed the corresponding contract with each of these providers, with the aim of ensuring that they process the data provided in accordance with current legislation. Post Office, in the case of postal shipments.

Entities providing courier services. A business group, based on the controller's legitimate interest for internal administrative purposes.

International Data Transfers with adequate guarantees (flow of personal data from Spanish territory to recipients established in countries outside the European Economic Area), in the event that there are communications through the Messaging tool

Whatsapp snapshot.

WhatsApp, owned by WHATSAPP LLC, carries out data transfers outside the European Union under Standard Contractual Clauses approved by the European Commission to ensure that the data processed enjoys equivalent levels of protection.

Information available at: https://faq.whatsapp.com/general/about-standard-contractual-clauses.

To communicate via WhatsApp, we will provide your phone number to WhatsApp Inc. to verify that you are a user of this service. We recommend that you review your privacy settings and read WhatsApp's privacy policy for more detailed information about WhatsApp's use of personal data.

International Data Transfers with adequate safeguards due to the use of Microsoft Office 365 software to host emails, belonging to MICROSOFT CORPORATION, which complies with the EU-US Data Privacy Frameworks (EU-US Data Privacy Frameworks), the UK to EU-US Extension Data Privacy Frameworks and the Swiss-US Data Privacy Frameworks (Switzerland-US Data Privacy Frameworks) as set forth by the US Department of Commerce. Microsoft Corporation has certified to the US Department of Commerce that it adheres to the

EU-US Data Privacy Framework Principles (EU-US Data Privacy Framework Principles) regarding the processing of personal data received from the European Union under the EU-US Data Privacy Framework and from the United Kingdom (and Gibraltar) under the UK Extension to the EU-US Data Privacy Framework.

Microsoft Corporation has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. Data Privacy Framework Principles) regarding the processing of personal data received from Switzerland in reliance on the Swiss-U.S. Data Privacy Framework.

Information available at: https://privacy.microsoft.com/es-ES/privacystatement#maincaliforniaconsumerprivacyactmodule

RIGHTS "What are your rights when you provide us with your data?"

Any person has the right to obtain confirmation as to whether or not CASERÍO DE LA SIERRA is processing personal data concerning them. Right to access, rectification, and deletion: You have the right to access your personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Right to restriction: In certain circumstances, you may request that the processing of your data be restricted, in which case we will only retain it for the exercise or defense of legal claims.

Right to Object: In certain circumstances and for reasons related to your particular situation, you may object to the processing of your data. Therefore, CASERÍO DE LA SIERRA will stop processing your data, except for compelling legitimate reasons or to exercise or defend against potential legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object to the processing of your data, including profiling related to such marketing.

Right to data portability: You may request the portability of your data to another data controller, in which case this will be done provided that the processing is based on lawful consent, the processing is automated, and the data will be transmitted from one controller to another when technically possible.

Right to withdraw consent, without affecting the lawfulness of processing based on consent prior to its withdrawal.

The right to lodge a complaint with the Spanish Data Protection Agency or the Data Protection Officer when you have not received satisfaction in the exercise of your rights or other matters. You can contact this Supervisory Authority through its website. www.agpd.es, and to do so with the Delegate of

Data Protection in the information provided in the DPD section.

To exercise any of the rights indicated above, you will have at your disposal a series of models or forms located at https://www.aepd.es/derechos-y-deberes/conoce-tus-derechos/derecho-de-acceso and you should direct them to CASERÍO DE LA SIERRA or to the address that appears in the CONTROLLER's contact details.

or to the address that appears in the CONTROLLER's contact details.www.aepd.es) to request information about these rights.

To process your request to exercise your rights, if we have reasonable doubts about your identity, we will ask you to provide a photocopy of your ID (only the part of the ID document necessary to confirm your identity). If you are acting through a representative, whether legal or voluntary, you must also provide proof of representation and identification.

OTHER INFORMATION

CASERÍO DE LA SIERRA will maintain professional secrecy regarding all information affecting personal data, storing it with due confidentiality and using it only for the specific purposes for which it was provided. It will also adopt appropriate technical and organizational measures to prevent unauthorized access to or unlawful processing of personal data, as well as accidental loss or destruction. The information is confidential, privileged, and processed only by authorized users with access to personal data. Any disclosure, distribution, or reproduction of the information processed is strictly prohibited.

–The data provided and generated during the contractual relationship will be processed lawfully, fairly, transparently, appropriately, pertinently, limited, accurate, and up-to-date.

–Unless you inform us otherwise, we will assume that your data has not been modified, and you agree to notify us of any changes.

–This policy may be subject to periodic review for the purpose of improving and updating it. You will be notified of any changes.

"If you share third-party data with us, you must inform them in advance of this fact, as well as the purpose and method of processing it. You are also solely responsible for such sharing."