Privacy policy

1. General information
Savia Bruta Flower School S.L., a company with registered address in Madrid, Calle Eduardo Marquina 32, 3.º, postcode 28019, Madrid, with tax ID (C.I.F.) B-13904008 ("Savia Bruta Flower School SL" or the "Company"), is the owner of the website located at the domain name www.saviabrutaflowerschool.com (the "Website") and is the Data Controller.
We have appointed a privacy officer who is responsible for overseeing questions relating to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your rights, please contact the privacy officer using the contact details below.
Name of the privacy officer: Alex Molina
Email address: hola@saviabrutaflowerschool.com
Phone number: +34692155926
The User has the right to make a complaint at any time to their local Supervisory Authority. However, we would appreciate the chance to deal with your concerns before you approach the Supervisory Authority, so please contact us in the first instance.
This Privacy Policy applies to the Website, meaning all the pages and subpages included in it, as well as any communications between our customers and users and the Company (through contact forms, emails, phone). Savia Bruta S.L. accepts no responsibility for the different privacy and personal data protection policies that may be contained on the websites that can be accessed through the hyperlinks on this Website and that are not managed directly by Savia Bruta Flower School S.L.
This policy has been drawn up in strict compliance with current personal data protection regulations, that is, among others, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR).

2. Collection and processing of personal data
We do not collect any personal data if you are only browsing the Website, except in the case described in our "Cookie Policy".

Data:
We collect the following categories of data:
– Identity data: includes name, username or similar identifier.
– Contact data: includes address, email address and phone numbers.
– Financial data: includes credit card details.
– Transaction data: includes details of payments to and from you and details of purchases and deliveries.
– Technical data: includes IP address, location data and your login data.
– Profile data: includes your username and password, the bookings you have made, your interests and preferences.
– Usage data: includes information about how you use our website and services.
– Marketing and communications data: includes your preferences for receiving marketing from us.
We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity.
We do not collect any special categories of personal data about you (this includes details about your race or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).
If you do not provide personal data
Where we need to collect personal data by law or under the terms of a contract we have with you and you do not provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In that case, we will not be able to provide you with our services

HOW IS YOUR PERSONAL DATA COLLECTED?
We use different methods to collect data from and about you. These methods include:
Direct interactions. You may give us your personal data by registering or communicating with us. This includes the personal data you provide when you:
– create an account on our website;
– subscribe to our service or publications;
– ask us to send you marketing; or
– give us feedback.
Automated technologies or interactions. As you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. Some of the ways in which we or our website may collect this information are described below:
Cookies and other technologies: the website may use cookies, a type of technology that places a small amount of information on a user's computer or other device so that a website can, for example, recognise future visits from that computer or device. The website may use other similar technologies (including, among others, tracking pixels, as described below, and other anonymous identifiers) to collect personal data, such as IP addresses and location data, to personalise your visit, to allow us to improve our service, or for other purposes. Please see our Cookie Policy for more details.

Purposes
In accordance with the GDPR and its implementing regulations, Savia Bruta Flower School S.L. informs our customers and users that the data they provide to us (through the Website and other communications) will be processed by Savia Bruta Flower School S.L. as Data Controller. This data will be processed for the purpose of:
– providing our services and
– managing relationships and communications with our customers and Website users,
– answering your direct questions.
– making our business contacts with other people who communicate with us regarding Savia Bruta Flower School
– For our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests
– complying with a legal or regulatory obligation on the company
This personal data may also be processed for the purpose of commercial analysis and prospecting, and to build customer/user profiles.
If you expressly accept (by ticking the corresponding box, that is, provided you have previously given your consent and have not objected), we may send you, electronically, by post and by phone (including SMS alerts or other similar messaging), personalised commercial information that may be of interest to you about products or services related to those offered by Savia Bruta Flower School S.L., and invite you to take part in satisfaction surveys. You can withdraw your consent at any time by writing to us at the email address above.

The lawful bases for processing this data are:
– the performance of a contract with the registered user and the purchaser of products and services, or to take steps at their request before entering into such a contract
– our legitimate interest in getting to know our customers and their preferences, and in commercial prospecting. We make sure we consider and balance any potential impact on you (both positive and negative) and on your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by sending any enquiries you consider appropriate to the following email account
– Complying with a legal or regulatory obligation means processing your personal data where it is necessary to comply with a legal or regulatory obligation to which we are subject
– express informed consent, particularly for sending commercial emails, offers and newsletters.

Disclosure of your data
The personal data collected through the Website and communications with us will not be transferred to any third party, except (a) in the specific cases where such transfer is covered by the LOPD (Spanish Data Protection Act), (b) in accordance with your instructions so that we can provide our services correctly, and (c) in accordance with a legal obligation under the applicable laws, regulations and rules. It may only be accessed by the staff of Savia Bruta Flower School S.L. and by those third parties that provide services to Savia Bruta Flower School S.L. related to the purposes mentioned above; or in the event of an audit of the information in the context of a purchase and sale or other corporate transaction.
However, we may have to share your personal information with the parties set out below:
– Service providers acting on our behalf.
– Transport and customer service companies
– Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them, if we are part of a bankruptcy proceeding or other change of control.
– Third parties with whom we must share your information to investigate suspected fraud, harassment or other violations of any law, rule or regulation, or of the website's policies.
– We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only allow them to process your personal data for specified purposes and in accordance with our instructions.

Data quality
Users must notify Savia Bruta Flower School S.L. of any change to the data provided, being in any case responsible for the truthfulness and accuracy of the data supplied at all times. Savia Bruta Flower School S.L. will endeavour to diligently check the truthfulness of this data, reserving the right, where appropriate and without prejudice to any other actions that may be available to it, not to register or to remove users who provide false or incomplete data. This prior verification does not in any case imply that Savia Bruta Flower School S.L. assumes any responsibility for damages that may arise from the falsity or inaccuracy of the data supplied, for which the user alone will be responsible.

Security

Savia Bruta Flower School S.L. guarantees that it has adopted the legally required levels of security for the protection of personal data, and has installed all the technical, personnel and organisational means and measures within its reach to guarantee the confidentiality, integrity and quality of the information, and to prevent the loss, misuse, alteration, unauthorised access and theft of the personal data provided.

Retention
We will only keep your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and the applicable legal requirements. In some circumstances you can ask us to delete your data: see Erasure requests below for more information. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use and retain this information indefinitely without further notice to you.

IMPORTANT NOTICE: To become part of the community of registered customers and users of Savia Bruta Flower School S.L. and to be able to register, the USER must be at least fourteen (14) years old. Therefore, by completing the registration form, the USER guarantees that they are at least fourteen (14) years old and will be entirely responsible for this declaration. Savia Bruta Flower School S.L. may require the USER, at any time, to verify their age by providing the corresponding identity document.

3. Data of recipients of flower deliveries
When using the Services, the customer/user must provide us with personal data of the recipients of the flowers and other deliveries they order from us ("Third-Party Data"). The customer/user is solely responsible for this Third-Party Data, as "Data Controller", insofar as such processing is regulated by the GDPR and its implementing regulations. Through the Website, the Company provides a delivery service that includes processing this Third-Party Data on behalf of the customer, the Company acting as "Data Processor" (for the purposes of providing the Service).
Insofar as the Company is a "Data Processor", it undertakes to (a) implement technical and organisational measures to safeguard Third-Party Data against any unauthorised or unlawful access, loss, destruction, theft, use or disclosure; (b) limit access to Third-Party Data only to those employees and third-party suppliers who need to know it to allow the Company to provide the Services in order to fulfil the contract with the Company (in particular the delivery and courier companies that work with the Company); (c) process only the personal data specified in this Policy in accordance with the instructions provided by the user, which include the User Account settings and their instructions (orders on the Website), and (d) not use Third-Party Data for purposes other than those related to providing the Services or in accordance with these instructions.
The user/customer guarantees that they are authorised to provide us with this Third-Party Data and will indemnify us against any damage or loss (including fines and penalties) in respect of the processing of this data while providing our services.
Except as indicated (for delivery purposes), we will not disclose Third-Party Data to any third party without the prior written consent of the user or the Third Party concerned.
On expiry or termination of the Service, because the User Account is closed, or at the express request of the customer/user, the Company will stop processing any Third-Party Data associated with their account and will delete it, as indicated in the Terms of Use. Notwithstanding the above, if the Third Party has an account with us, their Data will continue to be processed by the Company in providing the Service to that new user.

4. Users' rights
OPT OUT
How to opt out of our messages
To unsubscribe from any future promotional messages from us, you must send us an unsubscribe request to hola@saviabrutaflowerschool.com. If you do not want your personal data to be shared with third parties so that they can use that information for direct marketing purposes, you can opt out of such disclosure by emailing hola@saviabrutaflowerschool.com. We will deal with your request within a reasonable time after receiving it. Please note that if you choose to unsubscribe or not to receive communications from third parties, certain parts of the website may no longer be available to you. Under data protection laws in relation to your personal data, you have the right to:
– Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.
– Request correction of the personal data we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
– Request erasure (deletion) of your personal data. This enables you to ask us to delete your personal data where there is no good reason for us to continue processing it. You also have the right to ask us to delete your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Please note, however, that we may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
– Object to the processing of your personal data where, even though there is a legitimate interest (ours or a third party's), there is something about your particular situation that makes you want to object to processing on this ground, as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
– Request restriction of the processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it, to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
– Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially gave us consent to use, or where we used the information to perform a contract with you.
– Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
Any request must be sent to Calle Eduardo Marquina 32, 3.º, postcode 28019, Madrid, or made by phone or by email to hola@saviabrutaflowerschool.com. This right extends to Third-Party Data, insofar as we hold their data in our systems. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

5. Use of cookies
The Website uses cookies in order to provide certain services and features, as well as to help users improve their online experience and to tailor advertising offers. You can find more information about this in our Cookie Policy.

6. Changes to the privacy policy
Savia Bruta Flower School S.L. reserves the right to modify this Privacy Policy in accordance with the legislation applicable at any time. We therefore recommend that you review this Privacy Policy periodically to stay informed of how the personal data you provide to us is processed and protected.

7. Commercial communications
In addition to the above, in compliance with article 21 of the LSSI (Spanish Information Society Services Act), we inform you that where there is a prior contractual relationship, the email address provided by the user may be used to send commercial communications relating to products or services similar to those initially contracted by the customer.
You can object to receiving commercial communications both when making the purchase and in each of the commercial communications sent to you, all free of charge.
By objecting, the user indicates that they do not consent to their personal data being processed and communicated for commercial and advertising purposes regarding products, services, offers and promotions relating to products similar to those contracted; carrying out surveys, statistics and market trend analysis; and building User profiles in order to personalise and improve the service of Savia Bruta Flower School S.L.

8. Customer accounts and subscriptions
If you subscribe to El Club, we create a customer account with your name and email address to give you access to the content and manage your subscription. The legal basis is the performance of the contract you enter into with us. We keep this data while the subscription is active and, afterwards, for the legal periods required for tax and accounting purposes. You can cancel the subscription at any time from your account and request the deletion of your data by writing to hola@saviabrutaflowerschool.com.

9. Payments
Payments are processed through Stripe and PayPal, which act as data processors on behalf of Savia Bruta Flower School. The school never stores your full card details: they are handled directly by the payment gateway, in accordance with its own privacy policies and industry security standards.

10. Contact
The user can contact us at any time, and unsubscribe from the service, by sending an unsubscribe request to hola@saviabrutaflowerschool.com