Privacy Policy

1. Introduction

This Privacy Policy has been developed taking into account the provisions of the Organic Law on the Protection of Personal Data in force, as well as Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, hereinafter the GDPR.

The purpose of this Privacy Policy is to inform the data subjects whose personal data is being collected of the specific aspects relating to the processing of their data, including, among other things, the purposes of the processing, the contact details for exercising their rights, the periods for which the information is retained and the security measures, among other matters.

2. Data Controller

The data controllers are:

For online sales and the muy mucho website:

HABITUS GLOBAL RETAIL, S.L.U, a company currently operating as a supplier of products under the “MUY MUCHO” brand:
Tax ID: B‑26612754
Postal address: Carrera de Sant Esteve 29, 08173, Sant Cugat del Vallès, Barcelona, Spain.
DPO contact: 932890410
Email address: Contac@muymucho.com

For the MUY MUCHO Loyalty Club (registration, member identification, points/benefits, redemption, Club-related communications), customer service and general marketing for the MUY MUCHO brand:

HABITUS GLOBAL, S.L., a company currently operating as a supplier of products under the “MUY MUCHO” brand:
Tax ID: B-25873902
Postal address: Carrera de Sant Esteve 29, 08173, Sant Cugat del Vallès, Barcelona, Spain.
DPO contact: 932890410
Email address: rgpd@muymucho.com

When you identify yourself as a Club member in a purchase made through HABITUS GLOBAL RETAIL, S.L.U. will process your Club data on behalf of HABITUS GLOBAL, S.L., in its capacity as data processor.

3. Type of data we will process

We inform you that the categories of data we may process are defined below:

Identification and contact data: name, postal addresses, telephone numbers, email addresses, national identity card or passport number, as well as details of your social media profiles and other identification and contact data that may be necessary for the purposes set out in this policy.
Professional Data: for managing the CV.
Purchase Data: Order number, details of the items purchased or service commissioned, details of the payment method used, delivery and billing addresses, messages and direct communications related to the purchase and performance of the service.
Payment Data: billing addresses, credit card details
Data relating to website use: When you interact with our website as described in the cookie policy.
Social Media: If you use social media, the social media operators determine the nature, scope and purposes of processing the data on those platforms.
Image: based on video surveillance cameras.

4. Data processing

Any personal data requested, where applicable, will consist solely of data that is strictly necessary to identify and address the request made by the data subject, hereinafter referred to as the interested party. This information will be processed fairly, lawfully and transparently in relation to the interested party. Furthermore, personal data will be collected for specified, explicit and legitimate purposes and will not subsequently be processed in a manner incompatible with those purposes.

The data collected from each data subject will be adequate, relevant, and not excessive in relation to the corresponding purposes in each case, and will be updated whenever necessary.

Before collecting their data, the data subject will be informed of the general matters regulated in this policy so that they can provide express, specific, and unequivocal consent to the processing of their data, in accordance with the following aspects.

5. Purposes of the processing.

The specific purposes for which each processing activity is carried out are set out in the information clauses included in each of the data collection channels (web forms, paper forms, recorded messages or signs, and information notices).

Depending on how you use our website, we will process your personal data for the following purposes:

PURPOSE	MORE INFORMATION
Data for user registration	Anyone interested in registering as a user on our website must provide us with their data to identify them as a user; only in this way can we give them access to the features, products, and services available to them as a registered user. The interested party may delete their data at any time.
Data for the development, performance and execution of the contract for the sale of goods or provision of services entered into with Us on the website	The purposes of this processing of your data are: 1. Contact the Customer regarding modifications, updates, or informational communications related to the products purchased. 2. Manage payment for the products purchased by the Customer, as well as billing and the management of receipts and invoice issuance. 3. Prevent and detect improper use of the website, as well as potential fraud. 4. Manage shipments and any possible exchanges or returns, as well as product warranties and claims and requests for information about products. 5. Managing customer service.
To respond to requests made by the Customer and/or user through the “Customer Service” channel	When necessary to respond to a request for information from users and/or Customers. Managing requests to exercise data protection rights.
For marketing	The data will be processed to carry out promotional activities. It will also be used to manage subscriptions and send personalized information about the controller's products or services through various electronic means, such as email or SMS. Managing the newsletter Managing participation in potential contests or prize draws You may object at any time to your data being used to create a profile for marketing purposes, without affecting your ability to continue receiving non-personalized communications if you maintain your consent to receive them.
Data for the development, performance and execution of the contract for the sale of goods or provision of services entered into with Us in the store	Managing the request submitted by the data subject to purchase products and services. Managing purchases and issuing invoices. Managing shipments and any changes or returns, as well as product warranties, claims, and requests for product information.
Video surveillance	Video surveillance to ensure the safety of people, property, and facilities.
Resumes	Managing recruitment processes and assessing candidates' suitability for future positions within the company
Collaboration with public authorities and third parties	When required to cooperate with: Judges and courts. The Spanish Data Protection Agency. The State Tax Administration Agency. State security forces and law enforcement agencies
Whistleblowing channel	Personal data will be processed to manage the Whistleblowing Channel information system and, specifically, to manage, process, and investigate all acts or omissions contrary to ethics or the law, ensure compliance with them, and adopt the appropriate disciplinary or legal measures and, where applicable, prosecute criminal offenses and enforce criminal penalties arising from the Report received, as well as process and resolve it.

However, the data subject's personal data will be processed solely to provide an effective response and handle the requests submitted by the user, as specified alongside the option, service, form, or data collection system used by the data controller.

6. Legal basis for data processing

TYPE OF DATA	LEGAL BASIS
Data for user registration	The legal basis for processing is the necessity of processing the data for the performance of the terms governing the use of the website, since registration is only possible if the data is processed. If the data comes from a social network, the consent given for its transfer on that network is the legal basis for the processing. (Article 6.1(a) and (b) GDPR)
Data for the development, performance and execution of the contract for the sale of goods or provision of services entered into with Us on the website	The processing of your data is necessary for the performance of the sales contract between us and the customer. (Article 6.1(b) GDPR) The legal basis for processing such data will vary: some processing activities associated with the purchasing process may be activated by the customer's consent (e.g., storing payment data), while other data may be processed on the basis of our legitimate interest (e.g., carrying out checks to prevent possible fraud). (Article 6.1(f) GDPR)
To handle requests submitted by the Customer and/or user through the “Customer Service” channel	The legal basis for the processing is the necessity of processing for the performance of the contract or the provision of services that bind us to the user, or the user's own consent. (Article 6.1(b) GDPR) If the processing results from the exercise of data subjects' rights or from complaints relating to the controller's products or services, the legal basis will be compliance with our legal obligations. (Article 6.1(c) GDPR) If the processing concerns the management of incidents related to the purchased product, the processing will be necessary for the performance of the sales contract.
Marketing and Newsletter	The legal basis for the processing is the user's consent. (Article 6.1(a) GDPR) It permits the display of personalized information to users; the legitimate interest in creating a profile using the information we have about users. (Article 6.1(f) GDPR).
Data for the development, performance and execution of the contract for the sale of goods or provision of services entered into with Us in the store	Performance of the contract in connection with the sale of products. (Article 6.1(b) GDPR)
Video surveillance	Legitimate interest of the data controller (Article 6.1(f) GDPR)
Resumes	Consent of the data subject (Article 6.1(a) GDPR) when submitting their CV and the application of pre-contractual measures (Article 6.1(b) GDPR) if they are considered for a vacancy.
Collaboration with public authorities and third parties	Based on compliance with a legal obligation. (Article 6.1(c) GDPR)
Whistleblowing channel	Compliance with the legal obligations applicable to the data controller (Article 6.1(c) GDPR), regarding the obligation to have a whistleblowing channel and in accordance with Articles 24 and 8 of Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights and Article 30.2 of Law 2/2023.

7. Data retention period

As a general rule, we store your personal data for as long as necessary to fulfill the purpose for which it was collected, and according to the legal basis for processing it in accordance with applicable law. We will retain your personal information while a contractual and/or business relationship exists with you, or while you do not exercise your right to erasure or restriction of the processing of your data. In these cases, we will keep the information duly blocked, without using it for any purpose, for as long as it may be necessary to exercise or defend against claims or as long as any judicial, legal or contractual liability may arise from its processing that must be addressed and for which its processing is necessary.

The retention period for personal data will vary depending on the purposes for which it is processed, as follows:

TYPE OF DATA	RETENTION PERIOD
Data for user registration	We will process your data while you retain your status as a user, that is, until you unsubscribe.
Data for the development, performance and execution of the contract for the sale of goods or provision of services entered into with Us on the website	We will process your data for as long as necessary to manage the products purchased, including any possible exchanges, returns, complaints or claims regarding the purchased product.
To handle requests submitted by the Customer and/or user through the “Customer Service” channel	We will process your data for as long as necessary to handle the request submitted.
Marketing	We will process your data until you cancel your subscription to our Newsletter or withdraw your consent to receiving marketing communications. In France, data will be retained for 3 years from the last interaction, purchase, login or contact with us, unless there is a legal obligation to retain it for longer or you exercise your rights; once this period has elapsed, your data will be deleted or anonymized, without affecting your membership card: simply reactivating it will resume the count. In Italy, data processed with your consent for marketing purposes is retained for a maximum of 1 year from its collection or from the last interaction; data processed for profiling purposes is retained for a maximum of 2 years, unless you interact with us again, in which case the period is renewed. Once these periods have elapsed without renewal, the data will be deleted or anonymized solely for marketing or profiling purposes, without affecting your Club membership.
Data for the development, performance and execution of the contract for the sale of goods or provision of services entered into with Us in the store	During the business relationship, until deletion is requested, and for the periods legally required for tax purposes
Data collected for the Loyalty Program	Data related to the loyalty card will be retained while the program remains active, or until you request its deletion, except for legal reasons. In France, data will be retained for 3 years from the last interaction, purchase, login or contact with us, unless there is a legal obligation to retain it for longer or you exercise your rights; once this period has elapsed, your data will be deleted or anonymized, without affecting your membership card: simply reactivating it will resume the count. In Italy, data processed with your consent for marketing purposes is retained for a maximum of 1 year from its collection or from the last interaction; data processed for profiling purposes is retained for a maximum of 2 years, unless you interact with us again, in which case the period is renewed. Once these periods have elapsed without renewal, the data will be deleted or anonymized solely for marketing or profiling purposes, without affecting your Club membership.
Video surveillance	Maximum period of 30 days, except for security reasons.
Resumes	They will be retained for a maximum of 1 year from receipt, after which they will be deleted, unless the candidate renews their consent or is hired.
Whistleblowing channel	The data will be retained for the time strictly necessary to decide whether to initiate an investigation into the reported facts. In any event, three (3) months after receipt of the report, if no investigation has been initiated, the data will be deleted, unless it is necessary to retain it as evidence of the system's operation. Under no circumstances will communications and internal investigations be retained for more than ten years.

8. Recipients

As a general rule, we do not transfer or disclose data to third parties, except where legally required, where necessary to manage the sale and purchase and shipment of products (logistics and transport companies), or where third parties provide us with technology services (information storage and processing, security services). We will have entered into the corresponding data processing agreements with them. However, where necessary, such data transfers or disclosures will be communicated to the data subject through the informed consent clauses contained in the different channels used to collect personal data.

Loyalty Club: in order to accumulate and redeem your points/benefits at any participating MUY MUCHO establishment, your Club data will be consulted and updated by those establishments and by HABITUS GLOBAL RETAIL, S.L.U., all acting on behalf of HABITUS GLOBAL, S.L. and with limited access to the information necessary to manage the Club.

9. International Data Transfers

As a general rule, your data is processed and stored within the European Economic Area (EEA). If any of our technology providers, such as CRM, marketing or web analytics tools, is located outside the EEA, that transfer will always be carried out under an adequacy decision by the European Commission, Standard Contractual Clauses, or any other safeguard permitted under Chapter V of the GDPR.

10. Source

As a general rule, personal data is always collected directly from the data subject; however, in certain exceptional cases, data may be collected through third parties, entities or services other than the data subject. In this regard, this will be communicated to the data subject through the informed consent clauses contained in the different information collection channels and within a reasonable period after the data is obtained, and no later than one month.

11. Browsing data

With regard to browsing data that may be processed through the website, if data subject to regulations is collected, we recommend consulting the Cookie Policy published on our website.

12. Minors

Our websites, applications and Loyalty Club are intended for persons[JLC2.1] over 16 years of age. If you are under 16, please do not register or provide your data without the authorization of the person exercising parental authority or legal guardianship. If we discover that we have obtained data from a minor under that age without such authorization, we will delete it as soon as possible.

13. Data subject rights

Data protection regulations grant a series of rights to data subjects or data owners, users of this website or users of our social media profiles and of the companies adhering to this policy,
These rights available to data subjects are as follows:

Right of access: right to obtain information on whether their own data is being processed, the purpose of the processing being carried out, the categories of data processed, the recipients or categories of recipients, the retention period, and the origin of such data.
Right to rectification: right to obtain the rectification of inaccurate or incomplete personal data.
Right to erasure: right to obtain the erasure of data in the following cases:
- When the data is no longer necessary for the purpose for which it was collected
- When the data subject withdraws their consent
- When the data subject objects to the processing
- When they must be erased in compliance with a legal obligation
- When the data has been obtained in connection with an information society service pursuant to Article 8(1) of the European Data Protection Regulation.
Right to object: the right to object to specific processing based on the data subject's consent. Therefore, they have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to restriction: the right to obtain restriction of the processing of the data when one of the following circumstances applies:
- When the data subject contests the accuracy of the personal data, for a period allowing the company to verify its accuracy.
- When the processing is unlawful and the data subject objects to the erasure of the data.
- When the company no longer needs the data for the purposes for which they were collected, but the data subject needs them for the formulation, exercise or defence of claims.
- When the data subject has objected to the processing while verifying whether the company's legitimate grounds override those of the data subject.
Right to data portability: the right to obtain the data in a structured, commonly used and machine-readable format, and to transmit it to another data controller when:
- The processing is based on consent
- The processing is carried out by automated means
Right to lodge a complaint with the competent supervisory authority.

Data subjects may exercise the rights indicated by contacting HABITUS GLOBAL RETAIL, S.L.U. in writing, sent to the following email address (DPO): contact@muymucho.com, indicating in the Subject line the right they wish to exercise, or by post at Carrera de Sant Esteve 29, 08173, Sant Cugat del Vallès, Barcelona, Spain. You may also lodge a complaint with the competent supervisory authority by contacting the AEPD: C/ Jorge Juan, 6. 28001 - Madrid.