PRIVACY POLICY

At El Workshop OÜ we are committed to ensuring that your personal data is protected and not used for purposes other than those indicated in this Privacy Policy. For this reason, in this section we inform users and interested parties of everything concerning the processing of their personal data, thus complying with the data protection regulations applicable in our country: General Data Protection Regulation (EU) 2016/679, of April 27, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter, " RGPD" ) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, " LOPDGDD" ).

This Privacy Policy applies to the data processing carried out by El Workshop OÜ through this website: www.el-workshop.com (hereinafter, the " Website ") and/or any other information indicated. We recommend that you read it carefully before using this Website or providing your data through it. You can contact us with any questions regarding this matter by emailing contacto@el-workshop.com.

TABLE OF CONTENTS

In this Policy, you will find all the information regarding the processing of your personal data and the rights you can exercise to maintain control over them. In this regard, you will find information about:

  1. Who is responsible for the processing of your data?
  2. What requirements must you meet to provide us with your personal data?
  3. What data processing we carry out through the Website and what its main characteristics are, explaining:
  • What data we collect and how we collect it.
  • For what purposes do we collect the data we request from you?
  • What is the legitimacy for its treatment?
  • How long we keep them.
  1. To which recipients your data is communicated.
  2. Existence of international transfers of your data.
  3. What your rights are and how you can exercise them.
  4. How we protect your personal information.
  5. Modifications to this policy.

  1. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR PERSONAL DATA?

Your personal data will be processed by the company El Workshop OÜ (“El-Workshop”), with NIF 17204480 and whose contact details are as follows:

  • Address : Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia.
  • Contact phone number : +34657217262
  • Contact email : contacto@el-workshop.com
  1. WHAT REQUIREMENTS MUST YOU MEET TO PROVIDE US WITH YOUR PERSONAL DATA?

2.1. Minimum age . To provide us with your personal data, you must be at least 14 years old and/or, where applicable, have sufficient legal capacity to use this Website.

2.2. Truthfulness . When you provide us with your data to use our services, you guarantee that the data and information provided is real, truthful, up-to-date, and belongs to you and not to a third party.

In addition, you must notify us of any changes to the information you provide, and you are responsible for the truthfulness and accuracy of the information provided at all times.

2.3. Age and Veracity Control . From El-Workshop We reserve the right to verify your age and identifying information at any time, if necessary, including by requesting an official document or equivalent, and, in the event of fraud detection and if it is proven or suspected that you are under the indicated age, to delete, temporarily deactivate and/or cancel your account.

  1. DEFINITIONS

Apart from the terms defined in this Privacy Policy, the following terms shall have the meanings set forth below:

  • Marketplace : The digital platform provided by El-Workshop for the sale of products and that allows Buyers and Sellers to connect.
  • Buyer : This is the person who purchases products through the Marketplace.
  • Seller : Company that manufactures and sells the products offered in the Marketplace.
  1. WHAT DATA PROCESSING DO WE CARRY OUT THROUGH THE WEBSITE AND WHAT ARE ITS MAIN FEATURES?

Below, we explain how we treat your personal information and provide you with all the relevant information regarding your privacy:

  1. When you contact us through our channels (contact form, chat, email):

What are the ways in which data is collected?

  • Contact form
  • Chat
  • Sending emails to contacto@el-workshop.com or other El-Workshop email addresses.

What data do we collect?

Identification and contact information . We collect your identification information (first and last name) and email address, as well as any other information you voluntarily include in the communications you send us.

We may request additional information from you if necessary to fulfill your request or requirement.

What are the purposes of processing your personal data?

Respond to your requests . The main purpose of processing this data will be to respond to your requests, resolve your questions, and/or provide you with the information you require, as well as, where appropriate, follow up on your requests.

Customer service via chat on the Website is provided by automated software ( chatbot ) to categorize the query and then route it to the appropriate person.

Improve customer service . All the information derived from questions, queries, and advice provided to interested parties, as well as the way in which requests are resolved, allows us to understand how we provide our own customer service, allowing us to improve its quality.

Likewise, all information collected, after the retention period indicated below, is anonymized and used to analyze the most frequently asked questions via chat and automate the most frequently asked questions, develop FAQs, or retain it for statistical purposes to develop commercial strategies.

What is the legal basis that allows us to process your data? Is the provision of this data mandatory?

Consent . The data provided for the aforementioned purposes will be processed based on your consent, which you voluntarily give when you contact us through the means made available to you to request information or make a request.

Legitimate interest . We will process all information collected by the Customer Service Department for statistical purposes, which will help us improve the quality of our customer service. You can request more information about the weighting of our legitimate interests by contacting us at contacto@el-workshop.com.

The information you must provide will be indicated with an asterisk or similar. Without this information, we will not be able to respond to your inquiries or requests.

How long do we retain your information?

We will process all your personal information while your requests are being processed and, if necessary, to follow up on them. After this period, El-Workshop will retain this information, which is blocked, for the periods established by law to address potential liabilities and demonstrate compliance with our obligations. From this point on, El-Workshop will only process the information in an anonymous form, so it will not be possible to link the statistical information to the specific users to whom it refers.

To whom do we share your personal information?

We do not make any additional transfers to carry out this processing other than those indicated, in general, in section 4. To whom do we share your personal information? In this regard, some channels through which you can contact us are managed by service providers, who act as Data Processors. You will find more information about how these service providers operate in section 4, mentioned above.

  1. When you subscribe to our newsletter and other marketing communications:

What are the ways in which data is collected?

  • Newsletter subscription form.
  • Subscription box for the newsletter or receipt of commercial information on the contact form.

Or:

  • Data derived from the contractual relationship between the Parties.

What data do we collect?

Identification and contact information : To send commercial information electronically, we use the identification data (name) and contact information you provide on the corresponding form for subscribing to our commercial communications.

If you have a contractual relationship with us, we may use your email address information that we have based on our contractual relationship.

What are the purposes of processing your personal data?

Sending publications and commercial communications related to our products/services : We may send you, via electronic means, our newsletter and other commercial communications related to our products and services.

What is the legal basis that allows us to process your data? Is the provision of this data mandatory?

Commercial communications are sent:

  • based on our legitimate interest, due to the existence of a prior contractual relationship between the parties in accordance with the electronic commerce regulations (LSSI); or
  • based on your consent, requested at the time of registration on the specific form or by checking a corresponding box on the contact form

You may unsubscribe from these marketing communications at any time through the mechanism indicated in each email or by indicating your wish to unsubscribe by sending an email to contacto@el-workshop.com.

How long do we retain your information?

If the sending of commercial communications is based on your consent, we will retain the information for as long as you are subscribed to our distribution list for this type of information. Once you unsubscribe, it will remain blocked for the legally established time periods to address potential liabilities.

If commercial information is sent based on our contractual relationship, we will retain all your personal information for the duration of the contractual relationship. Once the relationship ends, El-Workshop will retain this information, which is blocked, for the periods established by law to address potential liabilities and demonstrate compliance with our obligations.

To whom do we share your personal information?

There are no specific transfers of your personal data to fulfill the purposes indicated in this section. However, we may use the services of email marketing service providers or other advertising and marketing service providers, who will have limited access to the data and will be bound by a duty of confidentiality (for more information on how our service providers operate, see section 4. To whom do we share your personal information? > Service Providers ).

  1. When you register as a Buyer user on our Website and purchase products (aimed at Buyers).

What are the ways in which data is collected?

  • Registration form
  • Purchase form

What data do we collect?

When you create your account: To complete your registration on our Website, we ask for your first and last name, email address, and a password.

When placing an order through the Website, once you have registered as a user, we ask you:

  • Identification and contact information. We collect your identification information (first and last name), email and postal addresses, and other contact information.
  • Financial and transactional information (information about order history, returns, etc.). Payments will be processed through a payment gateway provided by our payment service provider, so we will not have any information about your bank cards in these cases.

What are the purposes of processing your personal data?

Manage your registration as a user of our Website . When you register as a user on our website, we process your data to identify you as a user and give you access to the various features and services we offer.

In your account, you'll have access to your order history, as well as your personal information, delivery and billing addresses, which you can modify at any time.

We will also contact you and send you, when necessary, communications regarding updates to our General Conditions, security updates, and other administrative communications necessary to maintain your account.

Allow you to execute and maintain the contractual relationship with the Sellers and manage your orders. If you place an order through the Marketplace, the primary purpose of processing this data will be to allow you to manage your orders, purchase, and execute the contractual relationship between you, the Buyer, and the Seller. This may include contacting you in the event of any issues with your payments, as well as responding to inquiries and complaints via the web or electronically. Remember that in this case, your data will be transferred to the Seller so they can process your order, in accordance with the provisions of Section 5.

Send you electronic commercial communications. If you have checked the corresponding box, we may send you our commercial communications. Information about this purpose can be found in section 3.2.

Prevent, detect, and take action against illegal activities or those that violate the website's terms of use. We may process data to monitor and prevent any form of abuse of our services, such as fraudulent activities, denial-of-service attacks, spam, unauthorized access to our users' accounts, as well as any other practice that violates the General Terms and Conditions of Use or endangers the security of information or the integrity of the website.

What is the legal basis that allows us to process your data? Is the provision of this data mandatory?

Contract execution. The processing of your data is necessary for the execution of the contract when you create an account on our Website.

The transfer of your data to Sellers will also be based on contractual performance, to enable the purchase and the execution of the contractual relationship between Buyer and Seller.

Legitimate interest: The processing we carry out to prevent illegal activities and other activities related to website security will be based on our legitimate interest in ensuring network and information security and preventing events that could compromise the availability, authenticity, integrity, and confidentiality of personal data or the platform itself. You can request more information about the weighing of our legitimate interests by contacting us at contacto@el-workshop.com.

All data requested and processed for the aforementioned purposes are necessary to fulfill the stated purposes. Failure to provide this information will prevent us from executing the contract that binds us or performing the administrative tasks associated with it.

How long do we retain your information?

We will process your data for as long as you are registered on our website and our contractual relationship is valid. When you decide to unsubscribe as a registered user, we will keep your information blocked for the periods required by law to address potential liabilities and demonstrate compliance with our obligations. Your data will then be deleted.

To whom do we share your personal information?

We do not make any additional transfers to carry out this processing other than those indicated, in general, in section 4. To whom do we transfer your personal information? In this regard, we may use service providers to provide certain auxiliary services (for example, management software), who act as Data Processors. You will find more information about how these service providers operate in section 4, mentioned above.

  1. Website Navigation (cookies)

On this Website, we use cookies and other tracking tools to collect information about how users use the Website.

For more information about the processing we perform through these tracking tools, please visit our Cookie Policy.

  1. Using social plug-ins or add-ons:

When you use our services, you can share information on social media, such as Facebook, Instagram, TikTok, Pinterest, or other social media platforms, using an implemented social plugin (such as a "Share" button). If you choose to share information via a social plugin, the following data will be transferred to the relevant social media platform:

  1. Date and time of visit;
  2. The Internet address or URL for the address you are temporarily visiting;
  3. The IP address;
  4. The browser you are using;
  5. The operating system you are using;
  6. Where applicable, your username and password and, if you are a registered user of the social network, your first and last name; and
  7. The information for which you have used the specific plug-in.

The above information will be used to perform the action you have indicated (sharing, liking, etc.), in accordance with the terms and conditions of the corresponding social network. Therefore, we encourage you to stay informed about the purpose and scope of the information collected through social plugins. If you wish, you can block social plugins in your browser settings.

Please note that we have no influence over the information that the social network collects through the use of plug-ins.

  1. El-Workshop profiles on social networks.

El-Workshop has a profile on major social media platforms, including Facebook, TikTok, Instagram, and Pinterest.

When you follow one of our pages on social media, your data will be processed according to the terms of use, privacy policies, and access regulations of the corresponding social network, which you have previously accepted.

El-Workshop, in this regard, will process your data for the purposes of properly managing its presence on the social network, informing you about activities, products, or services, as well as for any other purposes permitted by social network regulations.

Please note that we have no influence over the information collected by social networks or how they process it, so we recommend that you stay informed about the purpose and scope of the information collected through these social networks.

  1. WHO DO WE TRANSFER YOUR PERSONAL INFORMATION TO?

Generally, El-Workshop will not share your data with third parties. However, in addition to the transfers we specifically indicate in the section explaining the details of the different operations (point 3), we inform you of the communications we may make, in general terms, that affect all of the aforementioned processing and their legal basis.

  1. To Sellers who list their products on the Marketplace: If you purchase products through the platform, your data may be shared with Sellers to fulfill your order. Before purchasing products from a Seller, we recommend that you review their privacy policy.
  2. Providers of essential services to perform the service we offer you (for example, hosting companies or platforms for sending commercial communications). Notwithstanding the foregoing, these entities have signed the corresponding confidentiality agreements and will only process your data according to our instructions. They may not use it for their own purposes or for purposes other than the service they provide to us.
  3. Public Bodies . We may disclose your data and any other information in our possession or accessible through our systems to the relevant public authorities when required by law, for example, to prevent or prosecute abuse of our services or fraudulent activities through our Website or webpage. In these cases, the personal data you provide will be retained and made available to the administrative or judicial authorities.
  4. In the event of a corporate transaction: In the event of a merger, acquisition, sale of all or a portion of its assets, or any other corporate transaction involving a third party, we may share, disclose, or transfer user data to the successor entity (including during the pre-transaction phase).
  5. To third parties after aggregation or anonymization: We may disclose or use aggregated or anonymized data (i.e., data that cannot be linked to an identified or identifiable natural person) for any purpose.
  6. To third parties with the user's consent or another legitimate basis: If we wish to share data with third parties outside the scope of this Privacy Policy, your consent will always be requested or you will be informed of the consent and its legitimate basis.

We also inform you that this Privacy Policy only addresses the collection, processing, and use of information (related to personal data) by us through your interaction with our Website. Access to third-party websites that you may access through links from the Website have their own privacy policies, over which we have no control. Therefore, before providing them with any personal information, we recommend that you familiarize yourself with their Privacy Policies.

  1. ARE YOUR PERSONAL DATA TRANSFERRED TO THIRD COUNTRIES OUTSIDE THE ECONOMIC AREA?

Some of our service providers are located in countries outside the European Economic Area (“ EEA ”).

The location of these companies outside the EEA implies an international transfer of your personal data, which may result in a lower level of protection than that required by European regulations. However, at El-Workshop, we have implemented measures to ensure that these transfers do not result in a lower level of protection for your personal data.

In this regard, service providers located outside the EEA have a valid mechanism for carrying out international transfers: (i) they are either located in a country or territory declared to have an adequate level of protection by the European Commission; in the case of US companies, they may be certified by the EU-US Data Privacy Framework (DPF) Adequacy Decision; or (ii) they have signed the corresponding standard contractual clauses approved by the European Commission (" SCC "), an agreement signed between both entities by which the non-EU company guarantees that it applies European data protection standards.

Therefore, the use of these providers does not result in a lower level of protection of your personal data than that which would occur if you used providers located in the European Union.

You can consult the content of the CCTs and the Decision on Adequacy to the EU-U.S. Data Privacy Framework at the following links:

Below, we list the international transfers we make from El-Workshop:

Name: Google - Country: USA - Transfer mechanism: Data Privacy Framework

Name: Shopify Inc. - Country: USA - Transfer Mechanism: CCT

  1. WHAT ARE THE RIGHTS YOU CAN EXERCISE AS AN INTERESTED PARTY?

You can exercise your legal rights regarding the processing of your personal data by contacting us at contacto@el-workshop.com.

We will resolve any rights request we receive as quickly as possible and, in any case, within the maximum period established by law from the date we receive it. In some cases, we may need to request a copy of your ID or other identifying document if it is necessary to verify your identity.

The rights that correspond to you as an interested party are the following:

  1. Right to withdraw consent granted

You may revoke your consent at any time for all processing based on it. However, the withdrawal of consent will not affect the lawfulness of processing based on consent prior to its withdrawal.

  1. Right of access

You have the right to know what data is being processed, if applicable, and, if so, to obtain a copy of it, as well as to obtain information regarding:

  • the origin and recipients of the data;
  • the purposes for which they are processed;
  • if there is an automated decision-making process, including profiling;
  • the data retention period; and
  • the rights provided for by the regulations.
  1. Right of rectification

You have the right to obtain rectification of your personal data or to complete it when it is incomplete.

  1. Right to erasure

You have the right to request the deletion of your personal data if it is no longer necessary for the purpose for which it was collected or, where applicable, if we are no longer authorized to process it.

  1. Right to data portability

You have the right to request data portability in the case of data processing based on your consent or the performance of a contract, provided that the processing is carried out by automated means. If you exercise this right, you will receive your personal data in a structured, commonly used, and machine-readable format. However, you can also request, where possible, that your data be transmitted directly to another company.

  1. Right to limit the processing of your personal data

You have the right to restrict the processing of your data in the following cases:

  1. When you have requested the rectification of your personal data during the period in which we verify its accuracy.
  2. When you believe we are not authorized to process your data. In this case, you can ask us to limit its use instead of requesting its deletion.
  3. When you consider that it is no longer necessary for us to continue processing your data and you want us to retain it for the purposes of exercising or defending claims.
  4. In cases where processing is based on our legitimate interest and you have exercised your right to object, you can ask us to restrict the use of your data while we verify whether those interests outweigh yours.
  5. Right to object

You have the right to object at any time to the processing of your personal data based on our legitimate interest, including profiling.

Opting out of commercial communications : Remember that you can opt out of receiving these types of communications at any time by sending us an email to contacto@el-workshop.com. You can also opt out of this service by following the instructions at the bottom of each electronic communication we send you.

  1. Right to lodge a complaint with the Supervisory Authority

Remember that, at any time, and if you consider that we have violated your right to the protection of your data, you may contact the corresponding Control Authority in your defense, in the case of Spain, the Spanish Data Protection Agency ( www.aepd.es ).

  1. HOW DO WE GUARANTEE THE CONFIDENTIALITY OF YOUR INFORMATION?

The security of your personal data is a priority for us. Therefore, El-Workshop has implemented all necessary security measures to ensure the effective use and processing of the personal data provided by the user, safeguarding the privacy, confidentiality, and integrity of said data and using the necessary technical means to prevent alteration, loss, unauthorized access, or processing of said data, depending on the state of technology at any given time.

Consequently, we comply with the recommended security standards to protect them. However, it is impossible to completely guarantee their security due to the very nature of the internet and the potential for malicious acts by third parties beyond our control.

We are committed to acting quickly and diligently if data security is compromised or threatened, and to informing you if relevant.

  1. MODIFICATIONS TO THIS POLICY

El-Workshop may modify the content of this Privacy Policy at any time, especially when there are legislative, jurisprudential, or interpretation changes by the competent authorities that affect the data processing carried out by El-Workshop through this Website. Any new version of this Privacy Policy will enter into force on the published effective date.

If the revised version includes a material change that affects the processing of your data, we will notify you at least 30 days in advance by posting a notice on our website or communicating with you via email. Notwithstanding the foregoing, we recommend that you periodically review this Privacy Policy to be informed of how your personal data is processed and protected, as well as of your rights.

This Privacy Policy was modified on February 19, 2025.