Privacy Policy

1. Introduction

This Privacy Policy has been developed taking into account the provisions of the Organic Law on Personal Data Protection currently in force, as well as Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, hereinafter the GDPR.

This Privacy Policy is intended to inform the data subjects whose personal data is being collected about the specific aspects relating to the processing of their data, including the purposes of the processing, contact details for exercising their rights, data retention periods and security measures, among other matters.

2. Data Controller

The data controllers responsible for processing your data are:

HABITUS GLOBAL RETAIL, S.L.U, the company currently operating as the provider of “MUY MUCHO” branded products:
Tax ID: B‑26612754
Postal address: Carrera de Sant Esteve 29, 08173, Sant Cugat del Vallès, Barcelona, Spain.
DPO contact: 932890410
Email: Contac@muymucho.com

3. Type of data we will process

Please note that the categories of data we may process are defined below:

Identification and contact details: name, postal addresses, telephone numbers, email addresses, ID card or passport number, as well as details of your social media profiles and other identification and contact details that may be necessary for the purposes specified in this policy.
Professional data: for managing your CV.
Purchase data: Order number, details of the items purchased or service commissioned, details of the payment method used, delivery and billing addresses, messages and direct communications related to the purchase and provision of the service.
Payment Data: billing addresses, credit card details
Website usage data: When you interact with our website, as described in the cookie policy.
Social Media: If you use social media, social media operators determine the nature, scope and purposes of data processing on their platforms.
Image: based on images from video surveillance cameras.

4. Data processing

The personal data requested, where applicable, will consist solely of the information strictly necessary to identify and address the request made by the data subject, hereinafter referred to as the interested party. This information will be processed fairly, lawfully, and transparently in relation to the interested party. Furthermore, personal data will be collected for specific, explicit, and legitimate purposes and will not subsequently be processed in a manner incompatible with those purposes.

The data collected from each interested party will be adequate, relevant, and not excessive in relation to the purposes applicable in each case, and will be updated whenever necessary.

Before collecting their data, the data subject will be informed of the general matters governed by this policy so that they can provide express, specific, and unequivocal consent to the processing of their data, in accordance with the following aspects.

5. Purposes of processing.

The explicit purposes for which each processing activity is carried out are set out in the information clauses included in each data collection method (web forms, paper forms, recorded messages, or notices and information notes).

Depending on how you use our website, we will process your personal data for the following purposes:

PURPOSE	MORE INFORMATION
Data for user registration	Anyone interested in registering as a user of our website must provide us with their data to identify them as a user; only in this way can we give them access to the features, products, and services available to you as a registered user. The interested party may cancel their data at any time.
Data for the development, performance, and execution of the sales or services contract entered into with Us on the website	The purposes included in this processing of your data are: 1. Contacting the Customer regarding modifications, updates, or informational communications related to the products purchased. 2. Managing payment for products purchased by the Customer, as well as invoicing and managing receipts and issuing invoices. 3. Preventing and detecting improper use of the website, as well as potential fraud. 4. Managing shipments and any possible exchanges or returns, as well as product warranties, complaints, and requests for information about products. 5. Customer service management.
To handle requests submitted by the Customer and/or user through the “Customer Service” channel	When necessary to handle a request for information from users and/or Customers. Managing requests to exercise data protection rights.
For marketing purposes	The data will be processed to carry out promotional activities. It will also be used to manage subscriptions and send personalised information about the controller’s products or services through different electronic means (such as email or SMS). Newsletter management Manage participation in potential competitions or prize draws
Data for the development, performance, and execution of the sales or services contract entered into with Us at the store	Manage the request submitted by the data subject for the sale of products and services. Purchase management and invoice issuance. Manage shipments and any changes or returns, as well as product warranties, complaints and requests for information about products.
Video surveillance	Video surveillance to ensure the safety of people, property and facilities.
Resumes	Manage staff selection processes and assess candidates’ suitability for future positions within the company
Cooperation with public authorities and third parties	When required to cooperate with: Judges and courts. The Spanish Data Protection Agency. The Spanish State Tax Administration Agency. State security forces and law enforcement agencies
Whistleblowing channel	Personal data will be processed to manage the information system of the Whistleblowing Channel and, specifically, to manage, process and investigate all acts or omissions contrary to ethics or the law, ensure compliance with them, and adopt the appropriate disciplinary or legal measures; where applicable, this includes the prosecution of criminal offences and the enforcement of criminal sanctions relating to the Whistleblowing Report received, as well as its processing and resolution.

However, the data subject’s personal data will be processed solely to provide an effective response and address the requests submitted by the user, as specified alongside the option, service, form or data-collection system used by the data controller.

6. Legal basis for data processing

TYPE OF DATA	LEGAL BASIS
Data for user registration	The legal basis for processing is the necessity of processing the data to perform the terms governing use of the website, since registration is only possible if the data is processed. If the data comes from a social network, the consent given for its transfer on that network is the legal basis for processing. (Art. 6.1(a) and (b) GDPR)
Data for the development, performance, and execution of the sales or services contract entered into with Us on the website	The processing of your data is necessary for the performance of the sales contract linking us with the Customer. (Art. 6.1(b) GDPR) The legal basis for processing such data will vary. In some processing activities associated with the purchase process, processing may be based on the Customer’s consent (e.g. payment data storage), while other data may be processed on the basis that we have a legitimate interest (e.g. carrying out checks to prevent potential fraud). (Art. 6.1(f) GDPR)
To handle requests made by the Customer and/or user through the “Customer Service” channel	The legal basis for processing is the need to process the data for the performance of the contract or provision of services linking us with the user, or the user's own consent. (Article 6.1(b) GDPR) If the processing results from the exercise of data subjects' rights or from complaints relating to the data controller's products or services, the legal basis will be compliance with our legal obligations. (Article 6.1(c) GDPR) If the processing concerns the management of incidents relating to the purchased product, the processing will be necessary for the performance of the sales contract.
Marketing and Newsletter	The legal basis for processing is the user's consent. (Article 6.1(a) GDPR) It authorises the possibility of showing users personalised information; the legitimate interest in creating a profile based on the information we have about users. (Article 6.1(f) GDPR).
Data for the development, performance, and execution of the sales or services contract entered into with Us at the store	Performance of the contract in connection with the sale of products. (Article 6.1(b) GDPR)
Video surveillance	Legitimate interest of the data controller (Article 6.1(f) GDPR)
Resumes	Consent of the data subject (Article 6.1(a) GDPR) when submitting their CV, and the implementation of pre-contractual measures (Article 6.1(b) GDPR) if they are considered for a vacancy.
Cooperation with public authorities and third parties	Based on compliance with a legal obligation. (Article 6.1(c) GDPR)
Whistleblowing channel	Compliance with the legal obligations applicable to the data controller (Article 6.1(c) GDPR), regarding the obligation to have a whistleblowing channel and in accordance with Articles 24 and 8 of Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights and Article 30.2 of Law 2/2023.

7. Data retention period

As a general rule, we store your personal data for as long as necessary to fulfil the purpose for which it was collected, and in accordance with the legal basis for processing it under applicable law. We will retain your personal information for as long as a contractual and/or commercial relationship exists with you, or until you exercise your right to erasure or restriction of the processing of your data. In these cases, we will keep the information duly blocked and will not use it for any purpose while it may be necessary for the exercise or defence of claims, or while any judicial, legal or contractual liability may arise from its processing that must be addressed and for which such processing is necessary.

The retention period for personal data will vary depending on the purposes for which it is processed, as follows:

TYPE OF DATA	RETENTION PERIOD
Data for user registration	We will process your data while you retain your status as a user, that is, until you unsubscribe.
Data for the development, performance, and execution of the sales or services contract entered into with Us on the website	We will process your data for as long as necessary to manage the products purchased, including any potential exchanges, returns, complaints, or claims regarding the purchased product.
To handle requests made by the Customer and/or user through the “Customer Service” channel	We will process your data for as long as necessary to handle your request.
Marketing	We will process your data until you unsubscribe from our Newsletter or withdraw your consent to receive marketing communications.
Data for the development, performance, and execution of the sales or services contract entered into with Us at the store	Throughout the business relationship, until deletion is requested and for the legally required periods for tax purposes
Data collected through the Loyalty Program	Data related to the loyalty card will be retained while the program remains active or until you request its deletion, except where retention is required for legal reasons.
Video surveillance	Maximum period of 30 days, except for security reasons.
Resumes	They will be retained for a maximum of 1 year from receipt, after which they will be deleted, unless the candidate renews their consent or is hired.
Whistleblowing channel	The data will be retained for as long as necessary to decide whether to initiate an investigation into the reported facts. In any event, three (3) months after receipt of the report, if no investigative proceedings have been initiated, the data will be deleted, except where it is necessary to retain them to provide evidence of the system’s operation. Under no circumstances will communications and internal investigations be retained for more than ten years.

8. Recipients

As a general rule, we do not transfer or disclose data to third-party entities, except where legally required, necessary for managing purchases and sales and shipping products (logistics and transport companies), or where they provide us with technological services (information storage and processing, security services). In such cases, we will have entered into the corresponding data-processing agreements with them. However, where necessary, such data transfers or disclosures will be communicated to the data subject through the informed consent clauses included in the various methods of collecting personal data.

9. Source

As a general rule, personal data is always collected directly from the data subject. However, in certain exceptional cases, data may be collected through third parties, entities, or services other than the data subject. In this regard, this fact will be communicated to the data subject through the informed consent clauses included in the various methods of collecting information and within a reasonable period after the data is obtained, and no later than one month.

10. Browsing data

With regard to browsing data that may be processed through the website, if data subject to the regulations is collected, we recommend consulting the Cookie Policy published on our website.

11. Minors

If you are a minor, please do not attempt to register as a user of our websites, applications, or products. If we discover that we have accidentally obtained a minor’s personal information, we will delete it as soon as possible.

12. Data subjects’ rights

Data protection regulations grant a series of rights to data subjects or data owners, users of this website or users of our social media profiles and those of the companies adhering to this policy,
These rights available to data subjects are as follows:

Right of access: the right to obtain information about whether their own data is being processed, the purpose of the processing being carried out, the categories of data processed, the recipients or categories of recipients, the retention period, and the source of such data.
Right to rectification: right to obtain the rectification of inaccurate or incomplete personal data.
Right to erasure: right to obtain the erasure of the data in the following circumstances:
- When the data is no longer necessary for the purpose for which it was collected
- When the data subject withdraws consent
- When the data subject objects to the processing
- When the data must be erased to comply with a legal obligation
- When the data was obtained through an information society service based on the provisions of Article 8(1) of the European Data Protection Regulation.
Right to object: right to object to specific processing based on the data subject’s consent. Therefore, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to restriction: right to obtain restriction of the processing of the data when one of the following circumstances applies:
- When the data subject contests the accuracy of the personal data, for a period enabling the company to verify its accuracy.
- When the processing is unlawful and the data subject objects to the erasure of the data.
- When the company no longer needs the data for the purposes for which it was collected, but the data subject needs it for the establishment, exercise or defence of claims.
- When the data subject has objected to the processing while it is being verified whether the company’s legitimate grounds override those of the data subject.
Right to data portability: right to obtain the data in a structured, commonly used and machine-readable format, and to transmit it to another data controller when:
- The processing is based on consent
- The processing is carried out by automated means
Right to lodge a complaint with the competent supervisory authority.

Data subjects may exercise the rights indicated by contacting HABITUS GLOBAL RETAIL, S.L.U. in writing, sent to the following email address (DPO): contact@muymucho.es, indicating in the subject line the right they wish to exercise, or by post at Carrera de Sant Esteve 29, 08173, Sant Cugat del Vallès, Barcelona, Spain. You may also lodge a complaint with the competent supervisory authority by contacting the AEPD: C/ Jorge Juan, 6. 28001 - Madrid.