1. Data controller
- Company name: Especialidades Médicas Tonal, S.L.
- Tax identification number (CIF): B61666038
- Address: C/ Pensamiento, 27, izquierda 3.º 3.ª, 28020 Madrid (Spain)
- Telephone: +34 937 804 799
- Email for data protection matters: info@papacarie.eu
The company has not appointed a Data Protection Officer.
This policy complies with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
2. Data we process
We process identification and contact details (first and last name, company or clinic, tax identification number, postal address, telephone number and email address), order and billing details, and the IP address from which forms are submitted.
We do not process patient data or health data.
3. Purposes and legal basis
| Purpose | Legal basis | Retention period |
|---|---|---|
| Manage orders, shipments, invoicing, issues and returns | Performance of a sales contract (Art. 6(1)(b) GDPR) | For the duration of the business relationship and thereafter for the statutory periods (six years for accounting records) |
| Comply with tax and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) | For the periods required by law |
| Respond to contact form enquiries | Consent (Art. 6(1)(a) GDPR) | For as long as necessary to respond, up to a maximum of one year |
| Send news about our products | Consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time | Until consent is withdrawn |
4. Recipients
We do not disclose data to third parties except where required by law (for example, to the Spanish Tax Agency or courts).
The website hosting and maintenance provider, the carrier delivering orders and the bank processing payments may access data as processors, solely to provide their services to us.
No international transfers of data outside the European Economic Area are envisaged. If a provider requires such a transfer, it will be carried out with the safeguards required by the GDPR.
5. Rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time, by writing to info@papacarie.eu or to the postal address indicated above. Your request must be accompanied by a document allowing us to verify your identity.
If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
6. Security
We implement appropriate technical and organisational measures to protect data against loss, alteration or unauthorised access, in accordance with Article 32 of the GDPR. The website uses an encrypted connection (HTTPS).
7. Changes to this policy
We may update this policy to reflect legal or service changes. The current version is always the one published on this page.
