Privacy Policy

Data Controller

Purposes and Legal Basis of Processing

BODEGA OTAZU, S.A.U. (hereinafter Otazu) processes your personal data for the following purposes, each supported by the legal basis that applies according to the nature of the request:

• Management of the commercial relationship and performance of the contract (Art. 6.1.b GDPR): processing of orders, management of payments and shipments, handling of incidents and exercise of warranties.
• Enquiries related to a purchase or to the request of a service (Art. 6.1.b GDPR): handling of enquiries and requests prior to contracting, as pre-contractual measures adopted at the request of the data subject, or linked to the performance of an existing contract.
• General enquiries voluntarily addressed to the company (Art. 6.1.f GDPR): legitimate interest of Otazu in attending and responding to the communications that the user voluntarily sends us through the contact form or other channels, when they are not linked to a specific purchase or service.
• Compliance with legal obligations (Art. 6.1.c GDPR): issuing invoices, compliance with tax, commercial and consumer protection regulations.
• Management of job applications (Art. 6.1.b GDPR): evaluation of the application for a specific selection process, as a measure prior to a possible hiring adopted at the request of the data subject. The retention of the CV to participate in future, separate and independent selection processes will be based on your consent (Art. 6.1.a GDPR).
• Legitimate interest — commercial communications to customers (Art. 6.1.f GDPR, in relation to Art. 21.2 of the LSSI-CE): sending commercial communications about Otazu’s own products and services similar to those already purchased, under the terms and with the guarantees detailed in the "Commercial Communications" section.
• Legitimate interest — internal analytics and service improvement (Art. 6.1.f GDPR): preparation of statistics, reports and internal analyses on sales, orders and website use, using our own tools hosted on our own systems (including an internal analytics database, Power BI-type). These data are used exclusively for our internal management and the improvement of our products and services. Otazu does not sell, rent or transfer this data to third parties, nor does it use it for third-party advertising.
• Consent (Art. 6.1.a GDPR): subscription to the newsletter, sending of commercial communications when the legitimate interest indicated above does not apply, and processing of data on social networks.

The acceptance checkbox of this Privacy Policy included in our forms is intended to prove that this information has been provided to the user, and does not constitute generic consent when the processing is necessary to attend to the data subject’s request (for example, a pre-contractual enquiry or the performance of a contract).

Retention Periods

Data will be kept for as long as necessary to fulfil the purpose for which it was collected and, in any case, for the legally established periods:

• Customer and transaction data: 6 years (Art. 30 Commercial Code) and 4 years for tax obligations (Law 58/2003 General Tax Law).
• Candidate data: maximum 1 year from the last update of the CV.
• Commercial communications: until withdrawal of consent or exercise of the right to object.
• Video surveillance: maximum 30 calendar days (Art. 22.3 LOPDGDD).

Data Recipients

Personal data may be disclosed to the following recipients, and only when strictly necessary for the provision of the service:

• Transport and logistics companies: recipient name, address and telephone, exclusively for the delivery of the order.
• Payment gateway (Stripe): data necessary to process the payment securely, under its own security measures and PCI-DSS certification.
• Public Administrations: when required by applicable regulations (Tax Agency, State Security Forces and Corps, etc.).

These are the only third parties that may receive data, and only to the extent strictly necessary to provide the contracted service. No international data transfers are made outside the European Economic Area, except where the technology providers used have appropriate safeguards in accordance with Article 46 of the GDPR (standard contractual clauses approved by the European Commission).

Own Analytics and No Sale of Data

Otazu does not use third-party analytics tools such as Google Analytics, nor does it install third-party cookies for advertising or cross-site tracking purposes. Website audience measurement is carried out through our own analytics solution, hosted on our own servers, which processes information in aggregate and without transferring data to third parties.

Our customers’ personal data is processed on our own infrastructure and, where applicable, integrated into an internal analytics database (Power BI-type) for exclusively internal use. In no case do we sell, rent or transfer personal data to third parties for commercial or advertising purposes.

Otazu may produce internal statistics and segmentations for analysis and improvement purposes, but does not adopt automated decisions that produce legal or significant effects on the user.

Data Subjects’ Rights

In accordance with the GDPR and the LOPDGDD, you may exercise the following rights:

• Access: obtain confirmation of whether we process your data and access it.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request the deletion of your data when, among other reasons, they are no longer necessary for the purpose for which they were collected.
• Objection: object to the processing of your data, in particular for direct marketing purposes.
• Restriction: request the restriction of processing in certain circumstances.
• Portability: receive your data in a structured, commonly used and machine-readable format, and transmit them to another controller.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
• Not to be subject to automated decisions: including profiling with significant legal effects.

To exercise any of these rights, you may write to BODEGA OTAZU S.A.U., Señorío de Otazu, 31174 OTAZU (Navarra), or email info@otazu.com, indicating the right you wish to exercise. As a general rule it will not be necessary to provide a copy of your ID; however, Otazu may request additional information to verify your identity when there are reasonable doubts about the identity of the person exercising the right.

We will respond to your request within a maximum of one month of receipt. This period may be extended by a further two months in the case of particularly complex or numerous requests; in such case, we will inform you of the extension and the reasons for it within the first month.

If you consider that the processing of your data does not comply with current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Video Surveillance

The facilities of BODEGA OTAZU S.A.U. have a video surveillance system in compliance with Article 22 of the LOPDGDD. The captured images are kept for a maximum of 30 calendar days, after which they are securely deleted, unless they must be kept to be made available to the State Security Forces and Corps or judicial authorities in the context of an investigation.

The video-surveilled areas are duly signposted with the informative sign required by the regulations. Access to the facilities implies knowledge of this processing.

Social Media

BODEGA OTAZU S.A.U. has profiles on various social networks. The processing of data in these environments is governed by the privacy conditions of each platform. Otazu only accesses the public data of the user’s profile to manage its relationship with the community, publish content and respond to comments.

Data obtained through social networks will not be used for purposes other than those indicated, nor will they be transferred to third parties outside the platform environment without the user’s express consent.

Commercial Communications

If you are a customer of BODEGA OTAZU S.A.U., we may send you commercial communications about products and services of our own and similar to those purchased, under the legitimate interest recognised in Article 21.2 of the LSSI-CE. This sending is carried out only when the following conditions are jointly met:

• the contact data were lawfully obtained in the framework of a previous purchase of a product or service;
• the communications refer to Otazu’s own products or services;
• such products or services are similar to those that were initially the subject of the contract;
• the user is offered, in a simple and free way, the possibility of objecting to the processing for advertising purposes both at the time of data collection and in each of the communications sent to them.

Consequently, you may object to this processing at any time, at no cost, through the unsubscribe link included in each communication or by writing to info@otazu.com. This same possibility of objection is offered to you during the purchase process, at the time your data is collected.

If you have subscribed to our newsletter without being a customer, the processing is based on your express consent, which you may withdraw at any time through the unsubscribe link included in each communication or by contacting us directly.

Security

BODEGA OTAZU S.A.U. has adopted the necessary technical and organisational measures to guarantee the security and integrity of personal data and to prevent its alteration, loss, processing or unauthorised access, taking into account the state of technology, the nature of the data and the risks to which they are exposed. These measures include the encryption of communications using the TLS/SSL protocol.