PRIVACY POLICY OF THE WEBSITE
www.kukuchurro.com
I. PRIVACY POLICY AND DATA PROTECTION
In compliance with current legislation, Kukuchurro S.L.U (hereinafter also referred to as the Website) is committed to implementing the necessary technical and organisational measures appropriate to the level of security required for the collected data.
Laws included in this Privacy Policy
This privacy policy adheres to current Spanish and European regulations regarding personal data protection on the internet. Specifically, it complies with the following regulations:
Regulation (EU) 2016/679 of the European Parliament and of the Council, dated April 27, 2016, on the protection of individuals regarding the processing of personal data and the free movement of such data (GDPR).
Organic Law 3/2018, dated December 5, on Personal Data Protection and guarantee of digital rights (LOPD-GDD).
Royal Decree 1720/2007, dated December 21, which approves the regulation for implementing Organic Law 15/1999, dated December 13, on the Protection of Personal Data (RDLOPD).
Law 34/2002, dated July 11, on Information Society Services and Electronic Commerce (LSSI-CE).
Identity of the Data Controller
The data controller for personal data collected by Kukuchurro S.L.U is María Aránzazu Aroca González, with NIF: 77587453N (hereinafter, Data Controller). Contact details are as follows:
- Address: Plaza del Salvador 15, 41004 Seville
- Contact Phone: 625535903
- Contact Email: kukuchurro@gmail.com
Personal Data Registration
Following the GDPR and LOPD-GDD provisions, we inform you that the personal data collected by Kukuchurro S.L.U through forms on its pages will be incorporated and processed in our file to facilitate, expedite, and fulfill the commitments established between Kukuchurro S.L.U and the User, or maintain the relationship established in the forms filled out, or to respond to a request or inquiry. Furthermore, following the GDPR and LOPD-GDD, unless the exception provided in Article 30.5 of the GDPR applies, an activity log of treatment is maintained that specifies the treatment activities carried out and other circumstances established in the GDPR.
Principles Applicable to the Processing of Personal Data
The processing of the User’s personal data will adhere to the following principles stated in Article 5 of the GDPR and Articles 4 and onwards of Organic Law 3/2018:
Lawfulness, Fairness, and Transparency: The User’s consent is always required, with complete transparency regarding the purposes for which personal data is collected.
Purpose Limitation: Personal data will be collected for specific, explicit, and legitimate purposes.
Data Minimisation: The personal data collected will be strictly necessary for the purposes for which they are processed.
Accuracy: Personal data must be accurate and kept up to date.
Storage Limitation: Personal data will be stored in a form that allows identification of the User only for as long as is necessary for processing purposes.
Integrity and Confidentiality: Personal data will be processed securely, ensuring confidentiality.
Proactive Accountability: The Data Controller will ensure that the above principles are met.
Categories of Personal Data
Kukuchurro S.L.U only processes identification data. No special categories of personal data are processed within the meaning of Article 9 of the GDPR.
Legal Basis for the Processing of Personal Data
The legal basis for the processing of personal data is consent. Kukuchurro S.L.U commits to obtaining the User’s explicit and verifiable consent for the processing of their personal data for one or more specific purposes.
The User has the right to withdraw their consent at any time. Withdrawing consent will be as easy as giving it. Generally, the withdrawal of consent will not affect the use of the Website.
When the User must or may provide their data through forms to make inquiries, request information, or for reasons related to the content of the Website, they will be informed if completing any of these forms is mandatory because they are essential for the proper conduct of the operation.
Purposes of Processing Personal Data
Personal data is collected and managed by Kukuchurro S.L.U to facilitate, expedite, and fulfill the commitments established between the Website and the User, or to maintain the relationship established in the forms completed by the User, or to respond to a request or inquiry.
Additionally, data may be used for commercial purposes related to personalisation, operational and statistical activities, and other activities within Kukuchurro S.L.U’s corporate purpose. This includes data extraction, storage, and marketing studies to tailor the content offered to the User, as well as to improve the quality, functionality, and navigation of the Website.
At the time personal data is obtained, the User will be informed of the specific purpose(s) of the processing of their data; that is, how the collected information will be used.
Personal Data Retention Periods
Personal data will only be retained for the minimum time necessary for processing purposes and, in any event, no longer than the following period: 12 months, or until the User requests its deletion.
At the time personal data is obtained, the User will be informed about the retention period for which their data will be kept or, when that is not possible, the criteria used to determine this period.
Recipients of Personal Data
The User’s personal data will not be shared with third parties.
In any case, when personal data is collected, the User will be informed about the recipients or categories of recipients of the data.
Personal Data of Minors
In accordance with Article 8 of the GDPR and Article 7 of Organic Law 3/2018 of December 5 on Personal Data Protection and the guarantee of digital rights, only those over 14 years old can legally consent to the processing of their personal data by Kukuchurro S.L.U. For minors under 14, parental or guardian consent is required for data processing, and it will only be considered lawful to the extent that they have authorised it.
Confidentiality and Security of Personal Data
Kukuchurro S.L.U is committed to adopting the necessary technical and organisational measures according to the appropriate level of security for the risk of the collected data, ensuring the security of personal data and preventing the accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access to transmitted, stored, or otherwise processed personal data.
The Website uses an SSL (Secure Socket Layer) certificate to ensure that personal data is transmitted securely and confidentially, with data transmission between the server and the User being fully encrypted.
However, since Kukuchurro S.L.U cannot guarantee the invulnerability of the internet or the total absence of hackers or others who may access personal data fraudulently, the Data Controller commits to informing the User promptly in case of a data breach likely to pose a high risk to the rights and freedoms of individuals. According to Article 4 of the GDPR, a personal data breach is understood as any security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Personal data will be treated as confidential by the Data Controller, who commits to ensuring, through legal or contractual obligation, that this confidentiality is respected by employees, associates, and anyone to whom the information is made accessible.
Rights Arising from the Processing of Personal Data
The User has the following rights concerning Kukuchurro S.L.U, as recognised by the GDPR and Organic Law 3/2018 of December 5, on Personal Data Protection and the guarantee of digital rights:
Right of Access: The User has the right to obtain confirmation as to whether Kukuchurro S.L.U is processing their personal data and, if so, to access information about their personal data and the processing carried out by Kukuchurro S.L.U, including, where available, information on the origin of the data and the recipients of any communications of the same.
Right to Rectification: The User has the right to request the correction of inaccurate personal data or, considering the processing purposes, to complete incomplete data.
Right to Erasure (“Right to be Forgotten”): The User has the right to obtain the deletion of their personal data when it is no longer necessary for the purposes for which it was collected; the User has withdrawn their consent and there is no other legal basis for processing; the User objects to the processing and there is no other legitimate reason to continue it; the data has been processed unlawfully; the data must be deleted to comply with a legal obligation; or the data was obtained as a result of an information society service directly offered to a minor under 14. In addition to deleting the data, the Data Controller, considering available technology and application cost, should take reasonable steps to inform other controllers processing the personal data of the data subject’s request to erase any links to those personal data.
Right to Restriction of Processing: The User has the right to restrict the processing of their personal data. The User can restrict processing when they contest the accuracy of the data; if processing is unlawful; if the Data Controller no longer needs the data but the User requires it to make claims; or if the User has objected to processing.
Right to Data Portability: If processing is carried out by automated means, the User has the right to receive their personal data from the Data Controller in a structured, commonly used, and machine-readable format and to transfer it to another controller. Whenever technically possible, the Data Controller will directly transmit the data to that other controller.
Right to Object: The User has the right to object to the processing of their personal data, or for Kukuchurro S.L.U to cease processing the data.
Right Not to be Subject to Automated Decision-Making: The User has the right not to be subject to a decision based solely on automated processing, including profiling, unless required by current legislation.
The User may exercise their rights by sending a written communication to the Data Controller with the reference “GDPR-www.kukuchurro.com,” specifying:
Full name of the User and a copy of their ID. When representation is allowed, the representative must also identify themselves in the same way and provide proof of representation. The ID copy may be replaced by any other legally valid means that verifies identity.
A statement with the specific reasons for the request or the information to which they wish to gain access.
Address for notification purposes.
Date and signature of the applicant.
Any supporting documents relevant to the request.
This request and any other accompanying documents may be sent to the following address and/or email:
Postal Address: Plaza del Salvador 15, 41004 Sevilla
Email: kukuchurro@gmail.com
Links to Third-Party Websites
The Website may include hyperlinks or links that allow access to third-party websites that are not operated by Kukuchurro S.L.U. The owners of these websites will have their own data protection policies and are solely responsible for their own files and privacy practices.
Complaints to the Supervisory Authority
If the User believes there is an issue or infringement of current regulations regarding the processing of their personal data, they have the right to effective judicial protection and to file a complaint with a supervisory authority, particularly in the country where they have their habitual residence, place of work, or where the alleged infringement occurred. In Spain, the supervisory authority is the Spanish Data Protection Agency (https://www.aepd.es/).
II. ACCEPTANCE AND CHANGES TO THIS PRIVACY POLICY
The User must have read and agreed with the terms on personal data protection contained in this Privacy Policy and accept the processing of their personal data so that the Data Controller may proceed with it in the manner, for the duration, and for the purposes indicated. Use of the Website implies acceptance of this Privacy Policy.
Kukuchurro S.L.U reserves the right to modify its Privacy Policy at its discretion, or due to legislative, jurisprudential, or doctrinal changes by the Spanish Data Protection Agency. Changes or updates to this Privacy Policy will not be explicitly notified to the User. It is recommended that the User periodically check this page to stay informed of the latest changes or updates.
This Privacy Policy was updated to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, regarding the protection of individuals concerning the processing of personal data and the free movement of such data (GDPR), and Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights.
