1.1 We are delighted that you are visiting our website and thank you for your interest. In the following we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The data controller on this website under the General Data Protection Regulation (GDPR) is ARRANCAMEMADRIDmail: info@arrancamemadrid.com

The person responsible for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the responsible person), this website uses an SSL or TLS encryption. An encrypted connection can be recognized by the character string "https://" and the padlock symbol in the browser line.

2) COLLECTION OF DATA WHEN VISITING OUR WEBSITE
If you use our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data which is technically necessary to show you the website:

Our website visited
Date and time at the time of access
Amount of data sent in bytes
Source/reference from which you came to the page
Browser used
Operating system used
IP address used (if necessary: anonymously)
The processing takes place in accordance with Article 6 paragraph 1 letter f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be communicated or used in any other way. However, we reserve the right to subsequently check the server log files if there are concrete indications of illegal use.3) HOSTING AND CONTENT DELIVERY NETWORK
Hosted by Shopify
We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify") for the purpose of hosting and displaying the online shop on the basis of a processing on our behalf. All data collected on our website is processed on Shopify's servers. Within the scope of the aforementioned Shopify services, data may also be processed in the context of further processing on behalf of Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA ) Inc. or Shopify (USA) Inc. In case of data transmission to Shopify Inc. in Canada, the adequate level of data protection is ensured by the adequacy decision of the European Commission. Further information on Shopify's data protection can be found on the following website: https://www.shopify.de/legal/datenschutz
Further processing on servers other than those of Shopify mentioned above takes place only within the scope communicated below.

4) COOKIES
To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"), some of these cookies remain on your end device for a longer period of time and allow you to save your page settings (so-called " persistent cookies"). In the latter case, you can find the retention period in the overview of the cookie settings in your web browser.
If personal data is also processed by individual cookies used by us, the processing takes place in accordance with Article 6 (1) (b) GDPR or for the fulfillment of the contract, in accordance with Article 6 (1) ( a) GDPR in case consent has been given or in accordance with Article 6 (1) (f) GDPR to protect our legitimate interests in the best possible functionality of the website and a simple and user-friendly design of the website visit effective for the customer.
You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general.
Please note that if cookies are not accepted, the functionality of our website may be limited.5) CONTACT US5.1 - Shopify chat
This website uses the live chat system Shopify Chat, a service of Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada ("Shopify") for customer support purposes. Shopify collects and stores anonymous user data to respond to support requests in real time. User profiles can be created from this anonymous data under a pseudonym. You can use cookies. Cookies are small text files that are stored locally in the cache of the website visitor's Internet browser. Cookies allow the recognition of the Internet browser. If the information collected in this way has a personal reference, the processing is carried out in accordance with Article 6 (1) (f) GDPR on the basis of our legitimate interest in effective customer service and statistical analysis of user behaviour. users for optimization purposes.
The data collected with Shopify technologies will not be used to personally identify the visitor of this website and will not be combined with personal data relating to the bearer of the pseudonym without the separate consent of the data subject. To prevent Shopify from storing cookies, you can set your Internet browser so that no more cookies are stored on your computer in the future or that cookies that have already been stored are deleted. However, disabling all cookies may mean that some functions of our website cannot be performed. You can object to the collection and storage of data for the purpose of creating a pseudonymised user profile with effect for the future at any time by sending us your objection informally by e-mail to the e-mail address given in the imprint.
In the case of data transfers to Shopify Inc. in Canada, the adequate level of data protection is guaranteed by the adequacy decision of the European Commission.

5.2 When contacting us (e.g. via contact form or e-mail), personal data will be processed – exclusively for the purpose of processing and responding to your inquiry and only to the extent necessary for this purpose. The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Article 6 (1) (f) GDPR. If your contact is for a contract purpose, the additional legal basis for the processing is Article 6 (1) (b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the facts in question have been definitively clarified and provided that there are no contrary statutory retention obligations.

6) DATA PROCESSING FOR ORDER PROCESSING
6.1 Insofar as it is necessary for the fulfillment of the contract for the purpose of delivery and payment, the personal data collected by us will be passed on to the commissioned transport company and the commissioned bank in accordance with Article 6 paragraph 1 letter b of the GDPR.If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you provide when ordering (name, address, e-mail address) to inform you within the framework of our legal information obligations pursuant to Article 6 paragraph 1 letter c GDPR via aappropriate communication channel (e.g. by post or email) about upcoming updates within the period required by law. Your contact details will be used strictly for notifications about updates due from us and will be processed by us only for this purpose to the extent that this is necessary for the information in question.

To process your order, we also cooperate with the following service providers, who support us fully or partially in the execution of the concluded contracts. Some personal data is transmitted to these service providers in accordance with the following information.

6.2 Use of payment service providers (payment services)

-Apple Pay
If you choose the payment method "Apple Pay" from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, your payment will be processed using the "Apple Pay" feature of your device running iOS, watchOS or macOS to be charged a payment card stored with "Apple Pay". Apple Pay uses security features built into your device's hardware and software to protect your transactions. To be able to unlock a payment it is therefore necessary to enter a code previously defined by you and verify it using the "Face ID" or "Touch ID" function of your device.
For payment processing purposes, the information you provide during the ordering process, along with your order information, will be sent to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is sent to the payment provider of the payment card stored in Apple Pay to process the payment. Encryption ensures that only the website through which the purchase was made can access your payment details. After you make your payment, Apple will send your device account number and a transaction-specific dynamic security code to the originating website to confirm your payment success.
If personal data is processed in the described transmissions, the processing is carried out exclusively for the purposes of payment processing in accordance with Article 6 (1) (b) GDPR.
Apple retains anonymous transaction information, including the approximate purchase amount, date and time, and whether the transaction was completed successfully. Anonymization completely excludes any personal references. Apple uses anonymized data to improve Apple Pay and other Apple products and services.When you use Apple Pay on your iPhone or Apple Watch to complete a purchase made through Safari on your Mac, your Mac and the authorizing device communicate through an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that personally identifies you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to Wallet & Apple Pay and turn off Allow Payments on Mac.
Further information on data protection with Apple Pay can be found at the following Internet address: https://support.apple.com/de-de/HT203027
- Clarna
If a Klarna payment service is selected, the payment will be processed by Klarna Bank AB (publ), https://www.klarna.com/de/, Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"). To enable payment processing, your personal data (first and last name, street, house number, postal code, city, gender, e-mail address, telephone number and IP address) as well as order data are collected ( eg invoice amount, item, type of delivery) to Klarna for the purpose of identity and credit checks, provided you have expressly consented to this according to Article 6 (1) (a) GDPR as part of the process of ordering . Here you can see which credit agencies your data can be forwarded to:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies
The credit report can contain probability values (so-called score values). As for the score values included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical process. Among other things, but not limited to, address data is included in the calculation of score values. Klarna uses the information received on the statistical probability of non-payment for a balanced decision on the establishment, implementation or termination of the contractual relationship.
You can withdraw your consent at any time by sending a message to the data controller or Klarna. However, Klarna may still be entitled to process your personal data if this is necessary for contractual payment processing.
Your personal information will be treated in accordance with the applicable data protection regulations and in accordance with the information in Klarna's data protection regulations for data subjects based in Germany https://cdn.klarna.com/1.0/ shared/content/legal/terms /0/de_de/privacy
or for data subjects based in Austria https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_at/privacy
treated.
- Paypal

When paying by PayPal, credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" or "payment in installments" via PayPal, we pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"), as well. The transfer takes place in accordance with Article 6 paragraph 1 letter b of the GDPR and only insofar as this is necessary for payment processing.
PayPal reserves the right to carry out a credit check for the arrangementspayment by credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" or "payment in installments" via PayPal. For this purpose, your payment data may be passed on to credit agencies in accordance with Article 6 (1) (f) GDPR on the basis of PayPal's legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check in relation to the statistical probability of non-payment for the purpose of deciding whether to provide the respective payment method. The credit report can contain probability values (so-called score values). As for the score values included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical process. Among other things, but not limited to, address data is included in the calculation of score values. Further information on data protection, including information on the credit agencies used, can be found in PayPal's data protection declaration: https://www.paypal.com/de/webapps/mpp/ua/privacy-fullYou can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for contractual payment processing.
- Shopify Payments
We use the payment service provider "Shopify Payments", 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered by the payment service provider Shopify Payments, your payment will be processed by the technical service supplier Stripe Payments Europe Ltd. , 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we send the information you provide during the ordering process together with information about your order (name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number) in accordance with Article 6 (1) (b) GDPR. Your data will only be passed on for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent necessary for this. For more information on the Shopify Payments privacy policy, please visit the following web address: https://www.shopify.com/legal/privacy.
Information on data protection at Stripe Payments Europe Ltd. can be found here: https://stripe.com/de/privacy

7) ONLINE MARKETING
Facebook pixel for creating custom audiences (with Cookie Consent Tool)
Within our online offer, the so-called "Facebook Pixel" of the social network Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Facebook"), is used.
If a user clicks on an ad placed by us, which is played on Facebook, the URL of our linked page is added by the Facebook Pixel. If our site allows data sharing with Facebook via pixel, this URL parameter is written to the user's browser via a cookie, which is set by our linked site. This cookie is then read by the Facebook Pixel and allows data to be forwarded to Facebook.
With the help of the Facebook pixel, Facebook is on the one hand able to determine the visitors of our online offer as a target group for displaying advertisements (so-called "Facebook Ads"). Accordingly, we use the Facebook pixel to show the Facebook ads we have placed only to those Facebook users who have shown interest in our online offer or who have certain characteristics (e.g. interest in certain topics or products, which based on visiting websites). With the help of the Facebook pixel, we also want to make sure that our Facebook ads match the potential interests of users and are not annoying. This allows us to further evaluate the effectiveness of Facebook ads for statistical and market research purposes by understanding whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion").
The data collected is anonymous to us, so we cannot draw any conclusions about your identity. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook data usage guidelines (https:// www.facebook.com/info/privacy/). The data may allow Facebook and its partners to place advertisements on and off Facebook.
The data processing associated with the use of the Facebook pixel will only take place with your express consentWith the help of the Facebook pixel, Facebook is on the one hand able to determine the visitors of our online offer as a target group for displaying advertisements (so-called "Facebook Ads"). Accordingly, we use the Facebook pixel to show the Facebook ads we have placed only to those Facebook users who have shown interest in our online offer or who have certain characteristics (e.g. interest in certain topics or products, which based on visiting websites). With the help of the Facebook pixel, we also want to make sure that our Facebook ads match the potential interests of users and are not annoying. This allows us to further evaluate the effectiveness of Facebook ads for statistical and market research purposes by understanding whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion").
The data collected is anonymous to us, so we cannot draw any conclusions about your identity. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook data usage guidelines (https:// www.facebook.com/info/privacy/). The data may allow Facebook and its partners to place advertisements on and off Facebook.
The data processing associated with the use of the Facebook pixel will only take place with your express consent in accordance with Article 6(1)(a) of the GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.

8) WEB ANALYSIS SERVICES
Google Analytics (universal).
This website uses Google (Universal) Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google (Universal) Analytics uses so-called "cookies", which are text files which are stored on your end device and which allow an analysis of your use of the website. The information generated by the cookie about your use of this website (including the shortened IP address) is usually transmitted to a Google server and stored there, but can also be transmitted to the servers of Google LLC. come to the United States.
This website uses Google (Universal) Analytics exclusively with the extension "_anonymizeIp()", which ensures anonymisation of the IP address by shortening it and excludes direct personal references. As a result of the extension, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google LLC server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. The IP address transmitted by your browser within the scope of Google (Universal) Analytics is not merged with other Google data.
Using a special function, the so-called "demographic characteristics", Google Analytics also allows the creation of statistics with age-related statements to the gender and interests of site visitors based on an evaluation of interest-based advertising and using third-party information tools. This enables the definition and differentiation of website user groups for the purpose of aligning marketing measures optimized for the target group. However, the data records collected via "demographic characteristics" cannot be assigned to a specific person.
Details on the processing initiated by Google Analytics and how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites
All processing described above, in particular the setting of Google Analytics cookies for reading information on the end device used, will only be carried out if you have given us your explicit consent in accordance with Article 6 (1) (a) GDPR . Without this consent, Google Analytics will not be used during your visit to the site.
You can withdraw your consent at any time with effect for the future. To exercise the revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website. We have concluded an order processing agreement with Google for the use of Google Analytics, which obliges Google to protect the data of our website visitors and not to pass it on to third parties.
For the transmission of data from the EU to the USA, Google relies on the so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection in the USA.
Further information on Google (Universal) Analytics can be found here: https://policies.google.com/privacy?hl=de&gl=de

9) RIGHTS OF THE INTERESTED PARTY
9.1 The applicable data protection legislation grants the data subject the following rights (rights of information and rights of intervention) vis-à-vis the controller of your personal data, with reference to the legal basis provided for the data processing personal respective exercise requirements:

Right to information pursuant to article 15 GDPR;
Right to rectification pursuant to Article 16 GDPR;
Right to erasure pursuant to Article 17 GDPR;
Right to restriction of processing pursuant to Article 18 GDPR;
Right to information pursuant to article 19 GDPR;
Right to data portability pursuant to Article 20 GDPR;
Right to revoke the consent granted pursuant to article 7 paragraph 3 of the GDPR;
Right of complaint according to article 77 of the GDPR.
9.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCE OF INTERESTS IN OUR PREVIOUS LEGITIMATE INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP THE TREATMENTOF THE DATA INVOLVED. HOWEVER, FURTHER PROCESSING REMAINS CONFIDENTIAL IF WE CAN DEMONSTRATE COMPLETE GROUNDS FOR THE PROCESSING WHICH OVERWEAR YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF THE PROCESSING IS FOR THE CERTIFICATION, EXERCISE OR DEFENSE OF LEGAL ACTIONS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT ADVERTISING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING. YOU MAY OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA INVOLVED FOR DIRECT MARKETING PURPOSES.

10) PERSONAL DATA CONSERVATION PERIOD
The duration of the storage of personal data is based on the respective legal basis, the purpose of the processing and, if applicable, also the respective statutory retention periods (e.g. commercial and tax retention periods).

In the case of processing of personal data on the basis of explicit consent in accordance with Article 6 paragraph 1 letter a of the GDPR, this data is stored until the data subject withdraws his consent.

If statutory retention periods exist for data processed within the framework of legal or similar obligations on the basis of Article 6(1)(b) of the GDPR, this data will be routinely deleted after expiry of the retention period, at provided it is not necessary they are no longer necessary to fulfill or initiate a contract and/or we have no legitimate interest in further storage.

When personal data is processed on the basis of Article 6 (1) (f) GDPR, this data is retained until the data subject exercises his or her right to object under Article 21 (1) GDPR, unless that we cannot provide compelling reasons worthy of protection for the processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

In the case of the processing of personal data for the purpose of direct advertising on the basis of Article 6 paragraph 1 letter f of the GDPR, this data is stored until the data subject exercises his right of objection pursuant to Article 21 paragraph 2 of the GDPR.Unless otherwise specified in the other information contained in this statement on specific processing situations, stored personal data will be deleted when they are no longer necessary in relation to the purposes for which they were collected or otherwise processed.