PRIVACY POLICY

Controller: Moncef Bouajila (sole trader – autónomo) Trade name: Caprianna Parfums Tax ID (NIF): Z2427278R Address: Rúa Magdalena 221, BJ, 15402 Ferrol, A Coruña, Spain Email: [email protected] Telephone: +34 624 704 178

• Identification and contact data: first name, surname, email address, telephone number. • Delivery and billing data: postal address and, where applicable, tax identification number. • Transaction data: products purchased, amounts and order history. Full card details are processed directly by the payment gateway; we do not store them. • Browsing data: as described in the Cookie Policy.

a) Managing orders, delivery, payment, returns and the guarantee. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: for the duration of the business relationship and thereafter for the limitation periods applicable to legal claims and the guarantee.

b) Complying with accounting and tax obligations (invoicing). Legal basis: legal obligation (Art. 6(1)(c) GDPR). Retention: 6 years (Art. 30 of the Spanish Commercial Code) and, where relevant, the periods set by tax legislation.

c) Handling enquiries and complaints. Legal basis: the data subject's consent when contacting us or, where it relates to an order, performance of the contract. Retention: until the enquiry is resolved and then for 1 year or, in the case of a complaint, until the related claims become time-barred.

d) Sending customers marketing about products similar to those already purchased. Legal basis: legitimate interest (Art. 21(2) LSSI-CE). Retention: until the customer objects. Customers may object at the time of purchase and in every communication, easily and free of charge.

e) Sending marketing to non-customers (newsletter). Legal basis: consent (Art. 6(1)(a) GDPR). Retention: until consent is withdrawn.

Fields marked as mandatory in the order form are necessary to process the order; if they are not provided, the purchase cannot be completed. Subscribing to the newsletter is optional.

We do not disclose data to third parties except where required by law or necessary to perform the contract. The following providers may access the data as processors, under a contract compliant with Art. 28 GDPR:

• E-commerce platform and web hosting: [provider name]. • Payment gateways and payment institutions: Stripe, PayPal, Bizum, Vanex (cash on delivery in Libya) and [Libyan bank card payment provider]. • Carriers: [carrier in Spain / international] and Vanex (deliveries in Libya). • Email sending tool: [name]. • Accounting and tax adviser: [name or "external accountant"].

Data may also be disclosed to the Spanish Tax Agency, to the customs authorities of the destination country and to other public authorities where required by law.

Some providers (for example Stripe, PayPal, Google or [the platform provider]) may process data outside the European Economic Area, in particular in the United States. These transfers are based on the EU-US Data Privacy Framework (where the provider is certified) or on the standard contractual clauses approved by the European Commission.

Deliveries to Libya. To deliver orders to Libya, the delivery data (name, address, telephone number and contents of the parcel) are disclosed to Vanex, the company responsible for delivery in Libya, and, where applicable, to the local payment provider, as well as to the Libyan customs authorities. Libya is not covered by a European Commission adequacy decision; these disclosures are based on their being necessary for the performance of the contract requested by the buyer (Art. 49(1)(b) GDPR) and are limited to the data strictly needed for delivery.

Further information is available from [email protected].

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and may withdraw any consent given at any time (without affecting the lawfulness of prior processing), by writing to [email protected] or by post to the address in section 1.

We will only ask for additional information to verify your identity where there are reasonable doubts about it. We will respond within one month at the latest.

If you consider that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). These rights apply to all customers, regardless of their country of residence, including Libya.

No decisions based solely on automated processing, including profiling, that produce legal effects for the user are made.

This website is intended for persons aged 18 or over. We do not knowingly collect data from minors.

We apply appropriate technical and organisational measures to protect personal data against loss, alteration or unauthorised access, including encrypted connections (HTTPS).

This policy is available in Spanish, English, Arabic and Italian; all versions are equally authentic. We may update it to reflect changes in the law or in our services. The version in force is always the one published on this page.