Privacy Policy

Introduction

This Privacy Policy has been developed in accordance with the applicable Organic Law on the Protection of Personal Data, as well as Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, hereinafter the GDPR.
This Privacy Policy is intended to inform the personal data subjects whose information is being collected about the specific aspects relating to the processing of their data, including, among other things, the purposes of the processing, contact details for exercising their rights, data retention periods, and security measures.

Data Controller

The data controllers responsible for processing your data are:

  • HABITUS GLOBAL RETAIL, S.L.U, the company currently operating as the supplier of products under the “MUY MUCHO” brand:
  • Tax ID: B‑26612754
  • Postal address: Carrera de Sant Esteve 29, 08173, Sant Cugat del Vallès, Barcelona, Spain.
  • DPO contact:  932890410
  • Email: Contac@muymucho.com

Type of data we will process

We inform you that the categories of data we may process are defined below: 

  • Identification and Contact Data: name, postal addresses, telephone numbers, email addresses, national ID or passport number, as well as details of your social media profiles and other identification and contact data that may be necessary for the purposes set out in this policy.
  • Professional Data: for managing your résumé. 
  • Purchase Data: Order number, details of the items purchased or service commissioned, details of the payment method used, delivery and billing addresses, messages and direct communications related to the purchase and performance of the service.
  • Payment Data: billing addresses, credit card details
  • Website Usage Data: When you interact with our website, as described in the cookie policy.
  • Social Media: If you use social media, the social media operators determine the nature, scope, and purposes of the processing of data on their platforms.
  • Image: based on video surveillance cameras. 

Data Processing

The personal data requested, where applicable, will consist only of the information strictly necessary to identify and address the request made by the data subject, hereinafter referred to as the data subject. This information will be processed fairly, lawfully, and transparently in relation to the data subject. Furthermore, personal data will be collected for specific, explicit, and legitimate purposes and will not subsequently be processed in a manner incompatible with those purposes.
The data collected from each data subject will be adequate, relevant, and not excessive in relation to the purposes applicable in each case, and will be updated whenever necessary.

Before collecting their data, the data subject will be informed of the general matters governed by this policy so that they can provide express, specific, and unequivocal consent to the processing of their data, in accordance with the following aspects.
Purposes of processing.

The specific purposes for which each processing activity is carried out are set out in the information clauses included in each data collection method (web forms, paper forms, recorded messages or signs, and information notices).

Depending on how you use our website, we will process your personal data for the following purposes:

PURPOSE

MORE INFORMATION

Data for user registration

Anyone who decides to register as a user of our website must provide us with their data to identify them as a user; only in this way can we give them access to the features, products, and services available to you as a registered user. The data subject may delete their data at any time.

Data for the development, performance and execution of the sales or service contract entered into with Us on the website

The purposes included in connection with this processing of your data are:

1. Contacting the Customer regarding modifications, updates, or informational communications related to the products purchased.

2. Managing payment for products purchased by the Customer, as well as invoicing, receipt management, and invoice issuance.

3. Preventing and detecting improper use of the website, as well as potential fraud.

4. Managing shipments and any changes or returns, as well as product warranties, complaints, and requests for information about products.

5. Customer service management.

To handle requests made by the Customer and/or user through the “Customer Service” channel

When necessary to respond to a request for information from users and/or Customers.

Managing requests to exercise data protection rights.

For Marketing

The data will be processed to carry out promotional activities. It will also be used to manage subscriptions and send personalized information about the controller’s products or services through various electronic means, such as email or SMS.

Newsletter management

Manage participation in potential contests or prize draws

Data for the development, performance and execution of the sales or service contract entered into with Us at the establishment

Manage the request submitted by the data subject for the sale of products and services.

Purchase management and invoice issuance.

Manage shipments and potential exchanges or returns, as well as product warranties, complaints, and requests for information about products.

Video surveillance

Video surveillance to ensure the safety of people, property, and facilities.

CVs

Manage personnel selection processes and assess candidates’ suitability for future positions within the company

Cooperation with public authorities and third parties

When required to cooperate with:

  • Judges and courts
  • The Spanish Data Protection Agency
  • The State Tax Administration Agency
  • State law enforcement and security forces

Whistleblowing channel

Personal data will be processed to manage the Whistleblowing Channel’s information system and, specifically, to manage, process, and investigate all acts or omissions contrary to ethical standards or the law, ensure compliance with them, and adopt the appropriate disciplinary or legal measures and, where applicable, prosecute criminal offenses and enforce criminal penalties arising from the Whistleblowing Report received, as well as process and resolve it.

However, the data subject’s personal data will be processed solely to provide an effective response and handle the requests submitted by the user, as specified alongside the option, service, form, or data collection system used by the controller.

Legal basis for data processing

TYPE OF DATA

LEGAL BASIS

Data for user registration

The legal basis for processing is the need to process the data to perform the terms governing use of the website, as registration is only possible if the data is processed. If the data comes from a social network, the consent given for its disclosure on that network is the legal basis for processing. (Art. 6.1 a) and b) GDPR)

Data for the development, performance and execution of the sales or service contract entered into with Us on the website

The processing of your data is necessary for the performance of the sales contract entered into with the Customer. (Art. 6.1 b) GDPR)

 The legal basis for processing this data will vary: for some processing activities associated with the purchasing process, the Customer’s consent may be required (e.g. storing payment details), while other data may be processed on the basis of our legitimate interest (e.g. carrying out checks to prevent potential fraud). (Art. 6.1 f GDPR)

To handle requests submitted by the Customer and/or user through the “Customer Service” channel

The legal basis for processing is the necessity of processing for the performance of the contract or the provision of services that connect us with the user, or the user's own consent (Article 6.1(b) GDPR).

If the processing results from the exercise of data subjects' rights or from claims related to the data controller's products or services, the legal basis will be compliance with our legal obligations (Article 6.1(c) GDPR).

If the processing concerns the management of incidents related to the purchased product, the processing will be necessary for the performance of the sales contract.

Marketing and Newsletter

The legal basis for processing is the user's consent (Article 6.1(a) GDPR). It legitimizes the possibility of displaying personalized information to users. The legitimate interest in creating a profile based on the information we have about users (Article 6.1(f) GDPR).

Data for the development, performance and execution of the sales or service contract entered into with Us at the establishment

Performance of the contract in connection with the sale of products (Article 6.1(b) GDPR)

 

 

Video surveillance

The legitimate interest of the data controller (Article 6.1(f) GDPR)

 

 

CVs

The data subject's consent (Article 6.1(a) GDPR) when submitting their résumé, and the application of pre-contractual measures (Article 6.1(b) GDPR) if they are considered for a vacancy.

Cooperation with public authorities and third parties

Based on compliance with a legal obligation (Article 6.1(c) GDPR)

 

Whistleblowing channel

Compliance with the legal obligations applicable to the data controller (Article 6.1(c) GDPR), Regarding the obligation to have a whistleblowing channel, in accordance with Articles 24 and 8 of Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, and Article 30.2 of Law 2/2023.

Data retention period

As a general rule, we store your personal data for as long as necessary to fulfill the purpose for which it was collected, and in accordance with the legal basis for processing it under applicable law. We will retain your personal information while a contractual and/or commercial relationship with you exists, or until you exercise your right to erasure or restriction of the processing of your data. In these cases, we will keep the information duly blocked, without using it for any purpose, for as long as it may be necessary to exercise or defend against claims, or as long as any form of judicial, legal, or contractual liability may arise from its processing that must be addressed and for which processing is necessary.

The retention period for personal data will vary depending on the purposes for which it is processed, as follows:

TYPE OF DATA

RETENTION PERIOD

Data for user registration

We will process your data while you retain your status as a user, that is, until you unsubscribe.

Data for the development, performance and execution of the sales or service contract entered into with Us on the website

We will process your data for as long as necessary to manage the products purchased, including any possible exchanges, returns, complaints or claims regarding the product purchased.

To handle requests submitted by the Customer and/or user through the “Customer Service” channel

We will process your data for as long as necessary to handle the request submitted.

Marketing

We will process your data until you cancel your subscription to our Newsletter or withdraw your consent to receive commercial communications.

Data for the development, performance and execution of the sales or service contract entered into with Us at the establishment

Throughout the commercial relationship, until deletion is requested and for the periods legally required for tax matters

Data collected for the Loyalty Program

Loyalty card-related data will be retained while the program remains active, or until you request its deletion, except where retention is required for legal reasons.

Video surveillance

Maximum period of 30 days, except for security reasons.

CVs

They will be retained for a maximum of one year from receipt, after which they will be deleted, unless the candidate renews their consent or is hired.

Whistleblowing channel

The data will be retained for the time strictly necessary to decide whether to initiate an investigation into the reported facts. In any event, three (3) months after receipt of the report, if no investigative proceedings have been initiated, the data will be deleted, unless it is necessary to retain them as evidence of the system’s operation. Under no circumstances will communications and internal investigations be retained for more than ten years.

Recipients

As a general rule, we do not transfer or disclose data to third-party entities, except where legally required, necessary for managing purchases and sales and shipping products (logistics and transport companies), or where they provide us with technological services (information storage and processing, security services). In such cases, we will have the corresponding data-processing agreements in place. However, where necessary, such transfers or disclosures of data will be communicated to the data subject through the informed consent clauses contained in the various channels for collecting personal data. 

Source

As a general rule, personal data is always collected directly from the data subject. However, in certain exceptional cases, data may be collected through third parties, entities, or services other than the data subject. In this regard, this fact will be communicated to the data subject through the informed consent clauses contained in the various information-collection channels and within a reasonable period after the data is obtained, and no later than one month.

Browsing data

Regarding browsing data that may be processed through the website, if data subject to regulations is collected, we recommend consulting the Cookie Policy published on our website.

Minors

If you are underage, please do not attempt to register as a user of our websites, applications, or products. If we discover that we have accidentally obtained personal information from a minor, we will delete that information as soon as possible.

Rights of data subjects

Data protection regulations grant a series of rights to data subjects or data owners, users of this website or users of our social media profiles and those of the companies adhering to this policy,
These rights granted to data subjects are as follows:

  • Right of access: the right to obtain information about whether their own data is being processed, the purpose of the processing being carried out, the categories of data processed, the recipients or categories of recipients, the retention period, and the source of that data.
  • Right to rectification: the right to obtain the rectification of inaccurate or incomplete personal data.
  • Right to erasure: the right to obtain the erasure of the data in the following circumstances:
    • When the data is no longer necessary for the purpose for which it was collected
    • When the data subject withdraws consent
    • When the data subject objects to the processing
    • When it must be erased in compliance with a legal obligation
    • When the data was obtained through an information society service based on Article 8(1) of the European Data Protection Regulation.
  • Right to object: the right to object to specific processing based on the data subject’s consent. Therefore, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
  • Right to restriction: the right to obtain restriction of the processing of the data when one of the following circumstances applies:
    • When the data subject contests the accuracy of the personal data, for a period enabling the company to verify its accuracy.
    • When the processing is unlawful and the data subject objects to the erasure of the data.
    • When the company no longer needs the data for the purposes for which it was collected, but the data subject needs it for the establishment, exercise or defence of claims.
    • When the data subject has objected to the processing while it is being verified whether the company’s legitimate grounds override those of the data subject.
  • Right to data portability: the right to obtain the data in a structured, commonly used and machine-readable format, and to transmit it to another controller when:
    • The processing is based on consent
    • The processing is carried out by automated means
  • Right to lodge a complaint with the competent supervisory authority.

Data subjects may exercise the rights indicated by contacting HABITUS GLOBAL RETAIL, S.L.U. in writing, sent to the following email address (DPO): contact@muymucho.es, indicating in the Subject line the right they wish to exercise, or by post to Carrera de Sant Esteve 29, 08173, Sant Cugat del Vallès, Barcelona, Spain. You may also lodge a complaint with the competent supervisory authority by contacting the AEPD: C/ Jorge Juan, 6. 28001 - Madrid.