1. Introduction

The purpose of this privacy policy is to provide you with the legally required information about the processing of personal data obtained through the website www.create-store.com (the “Website”)

When you access and use this Website you are considered a user (“User/s” or “you”) and are deemed to know and agree to the terms of this Privacy Policy.

2. Who is the Data Controller?

• Identity: WOODS & GO DESIGN, S.L. (“CREATE”)
• Tax Code (NIF): B98944986
• Address: Polígono 4, P18. Beniarjó 46722 Valencia Spain.
• Telephone: 911 300 019
• Email: rgpd@create-store.com

3. How do we collect your personal data?

CREATE gathers information from Users who use the features of the Website that require the disclosure of certain personal data. CREATE records the following specific information:

• Creation of a Customer account: personal data (including, but not limited to, your name, surname/s, email address) required for the User to complete the form for registering on the Website and/or managing their account as a CREATE Customer. 
• During the product purchasing process: personal data (including, but not limited to, your name, surname/s, identity/tax code, telephone number, postal address, email address, payment information) required to process online sales of our products through the Website. 
• Customer Services and/or sending emails: personal data (including, but not limited to, your name, surname/s, email address) that the User enters in the forms provided for the purpose on the Website or sent by email.
• Signing up for the newsletter or marketing messages: personal data (including, but not limited to your email address) provided voluntarily by the User in the subscription form provided.

The use of the different forms and/or features available on the Website is voluntary. However, fields marked with an asterisk (*) are mandatory to be able to process your requests, therefore, if you do not provide the information required in the mandatory fields, CREATE will be unable to process your request.

 

4. How do we process your personal data?

We process the personal data you share with us through forms and features of the Website for the purposes and legal bases listed below:

• Within the scope of the legal relationship established between CREATE and Website Users (Article 6.1(b) GDPR):

• To permit access and management of the accounts of Users registered as Customers on the Website.
• To supply products acquired on the Website, including their billing and payment management, handling deliveries and returns, and other services derived from the relationship (e.g. handling requests from registered Users submitted to our Customer Service department).

• Data subjects’ consent (Article 6.1(a) GDPR)
• To deal with and respond to requests for information submitted by Users using the forms provided for the purpose and/or by sending emails to the email addresses published on the Website.
• To send you the newsletter and marketing messages about products and services provided by CREATE with the User’s authorisation.

• To comply with CREATE’s legal obligations vis-a-vis the processing described in the above paragraphs (Article 6.1(c) GDPR).

5. Who has access to the data?

 

You are hereby informed that CREATE will use your personal data to fulfil our sales order processing on the Website and must therefore share your information (identifying data, payment method, banking details) with the following organisations:

 

• Payment service providers:

PayPal (Europe) S.a.r.l. & Cie, S.C.A. 

R.C.S. Luxembourg B 118 349

More information: https://www.paypal.com/es/webapps/mpp/ua/privacy-full?locale.x=esES

 

Stripe Payments Europe Ltd.

1 Grand Canal Street Lower, Grand Canal Dock, Dublin, IRELAND

More information: https://stripe.com/es/privacy

 

Apple Distribution International Ltd. (“Apple Pay” service)

Hollyhill Industrial Estate. Hollyhill, Cork, IRELAND

More information:  https://support.apple.com/es-es/HT203027  https://www.apple.com/legal/privacy/es/

 

Google Payment Ireland Limited (“Google Pay” service) 

70 Sir John Rogerson's Quay, Dublin 2, Dublin, IRELAND

More information:

https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=es

 

All these companies have an adequate level of personal data protection in case of personal data transfers outside the European Economic Area. In the case of “PayPal”, the parent company “Paypal Europe” and Paypal Group entities have signed an intergroup agreement based on the Binding Corporate Rules approved by the competent supervisory authorities. Likewise, “Stripe Payments Europe Ltd.” makes such transfers to its parent company “Stripe Inc.” in the United States, a company that has signed Standard Contractual Clauses approved by the European Commission. In the case of Apple and Google, any subsequent transfer from its subsidiaries in the European Economic Area to the respective parent company (in both cases, located in the United States) is governed by Standard Contractual Clauses signed by both companies.

 

• Deferred payment provider:

 

Klarna Bank AB (publ)

Sveavägen 46, 111 34 Stockholm, SWEDEN

More information: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/es_es/privacy

Likewise, CREATE allows suppliers that provide services connected with the functioning of the Website or the features of the Website to access your data. In such cases, CREATE undertakes to select and engage suppliers that offer an adequate level of protection and permit the exercise of your rights in relation to the processing of your personal data.

 

Lastly, your personal data may be disclosed to authorities or government bodies where necessary to comply with a legal obligation to which CREATE is subject.

6. For how long do we keep your data?

Your personal data will be stored by CREATE:

• In the case of Users registered on the Website, for as long as you do not request the cancellation of your customer account for any reason.

• In the case of data gathered in product sales, for the duration of the contractual relationship between the User and CREATE, and until this ends according to the General Terms of Sale applicable at the time.

• In the case of customer services, contact forms and/or sending emails, for the time necessary to deal with and process each of your requests.

• In the case of the newsletter and/or marketing messages, until you withdraw your consent to receive them.

After these terms, your personal data will be blocked and stored by CREATE to be able to respond to any liability arising from their processing and solely until these liabilities have expired. CREATE will then delete your personal data.

7. How should I update my personal data?

 

You declare that you are over the age of 18 years and that the personal data you provide to CREATE through this Website are truthful, correct, current and complete. You are responsible for keeping the information in the “My personal data” in the “My Account” section up-to-date, and to notify CREATE of any changes or updates by writing to the postal or email addresses provided in this Privacy Policy in the section “How do I exercise my rights?” and following the instructions.

 

8. What happens if I provide [CONTROLLER] with data belonging to third-party data subjects?

Generally speaking, Users must not provide data pertaining to third-party data subjects. However, if you provide personal data belonging to third-party data subjects, before sending or notifying CREATE of the data, you must notify the data subjects of the contents of this Privacy Policy. You therefore undertake to have obtained the prior consent of the third-party data subjects to share their personal data with CREATE for the purposes described in this Privacy Policy.

9. What are my rights?

 

You have the right to withdraw the consent you have given to process your data at any time. As a data subject, with regard to CREATE, you have the right to exercise the rights of access, rectification, erasure and portability, restriction of processing and opposition, and to refuse to be subject to automated individual decision-making, as appropriate.

You may use the following communication channels to exercise these rights, always including a copy of your identity document:

•          By letter to the following address: Polígono 4, P18. Beniarjó 46722 Valencia, Spain
•          By email: rgpd@create-store.com

Lastly, if you become aware of a circumstance that you believe is a breach of the data protection regulation, you may file a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency).

10. Updates and changes to the Privacy Policy

CREATE reserves the right to make changes to this Privacy Policy. In case of such changes, you will be notified by means of notices on the Website, by email, or by other appropriate means, according to the circumstances.