Privacy and Data Handling Policy

NOVADELTA – COMERCIO DE CAFES ESPAÑA, SA. (hereinafter “GRUPO NABEIRO”), a company with registered office at Carretera de Caceres (KM 84), 6007 Badajoz, Spain, with the registration number no. A-06049985, in the execution of its activities on the website www.gruponabeiro.com (“Website”), processes personal data, meaning any information relating to an identified or identifiable natural person (henceforth “Data subject(s)”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In the cases where GRUPO NABEIRO determines the purposes and means of the processing of personal data within the performance of its activities it shall be considered as a controller, ensuring full compliance with Data Protection Legislation.

According with the aforementioned Legislation, GRUPO NABEIRO stands for the processing of personal data pursuant to all applicable principles: Principle of Lawfulness, Principle of Fairness and Transparency; Principle of Purpose Limitation; Principle of Data Minimisation; Principle of Accuracy; Principle of Storage Limitation; Principle of Integrity and Confidentiality.

In full accordance with the principles outlined above, GRUPO NABEIRO fully respects the data protection rights of Data Subjects. Hence, Data Subjects may contact GRUPO NABEIRO to obtain any information related to the processing of personal data, using the contacts provided in Paragraph 9.

For the foregoing, this Data Protection and Privacy Policy is established in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and other related legislation applicable (hereinafter “Data Protection Legislation”) GRUPO NABEIRO undertakes any and all data processing operations in accordance with the following paragraphs:

Legal Basis and Purposes for the Processing of Personal Data

The personal data of Data Subjects will be processed by GRUPO NABEIRO with the following legal basis:

Lawful Basis	What does it consist of?
Consent	The Data Subject may consent to the processing of his/her Personal Data through a free, specific, informed and explicit expression of will by which he/she accepts, by means of a declaration (in writing or orally) or unequivocal positive act (by filling in an option), that his/her Personal Data will be processed.
Pre-contractual information’s or performance of a contract	Personal Data may be processed if it is necessary, without limitation, for the performance of a contract for the provision of services and/or supply of products to which you are a party as an Employee, Customer and/or Supplier, or to carry out pre-contractual measures at your request.
Compliance with a legal obligation	Personal Data may be processed to ensure and guarantee the fulfilment of legal obligations to which it is subject under the law of a Member State and/or the European Union.
Defence of vital interests of the Data Owner	Personal Data may be processed to ensure the protection of your vital interests, in particular where such processing is essential to your life.
Legitimate Interests	GRUPO NABEIRO, other Responsible Persons or Third Parties, may treat Personal Data provided that such treatment does not prevail over their interests or fundamental rights and freedoms.

Taking into account the abovementioned, the collection of personal data on the basis of the grounds of lawfulness set forth will be primarily for purposes related to the development of GRUPO NABEIRO purposes.

Processing of personal data

Within its scope GRUPO NABEIRO processes the Data Subject’s personal data as follows:

Personal Data

Purpose

Legal Basis

Retention Period

Buyer Identification Details

(Name, tax identification number, phone number, SAP number)

Shipping and Array preparation

Customer Account Service

Performance of a Contract

Applicable legal term at any time for each legal obligation to be complied with.

Product Details

(product, amount, marketplace status, discount, freight, seller freight, interest value, gross, total value)

Order Information for

Shipping and Array preparation

Performance of a Contract

Applicable legal term at any time for each legal obligation to be complied with.

Address Details (country, city, street name, number, zip-code and neighbourhood and receiver name)

Shipping and Billing

Performance of a Contract

Applicable legal term at any time for each legal obligation to be complied with.

Payment Details

(payment method, value, market placed)

Payment verification for Shipping and Array preparation

Performance of a Contract

Applicable legal term at any time for each legal obligation to be complied with.

Processing Methods

The processing of personal data will be executed automated and manually by computer tools, which are strictly related to the mentioned purposes and, in any case, guaranteeing the security and confidentiality of personal data.

Disclosure and Transmission of Personal Data

Regarding the disclosure and transmission of personal data, GRUPO NABEIRO’s employees will process personal data and, as a result, they can access to the personal data of Data Subjects. The referred GRUPO NABEIRO employees will solely process personal data of Data Subjects for the purposes specified in this Policy and in strict compliance with current or future Data Protection Legislation.

Third parties who may process personal data on behalf of GRUPO NABEIRO, and may also access to personal data of Data Subjects as subcontractors, including without limitation the providers of IT services required for the operation of information systems, outsourcing service providers or cloud computing services, professionals and consultants.

Data Subjects have the right to obtain a complete and up-to-date list of the subcontractors (if any) elected by GRUPO NABEIRO and for this purpose they shall submit a specific request to GRUPO NABEIRO under the terms specified in Paragraph 9 of this Policy.

International Transfers

GRUPO NABEIRO may transfer Your Personal Data outside the European Economic Area (“EEA”) to locations that may not guarantee the same level of protection.

However, GRUPO NABEIRO only transfer Your Personal Data outside the EEA:

When the transfer is made to a location or by a method or in circumstances that the European Commission considers to ensure adequate protection of Personal Data;
When standard data protection clauses approved by the European Commission or a competent data protection supervisory authority have been implemented; or,
When none of the above apply, but the law may still allow such transfer, for example, if it is necessary for the declaration, exercise or defence of a right in a judicial proceeding.

You may request detailed information on the security measures that GRUPO NABEIRO has implemented regarding Personal Data transfers outside of the EEA and, where applicable, a copy of the standard data protection clauses in force at GRUPO NABEIRO through the terms specified in Paragraph 9 of this Policy.

Data Subjects Rights

Under current or future Data Protection Legislation, GRUPO NABEIRO informs that Data Subjects have the right of access, rectification, limitation, portability, erasure and the right to object to the processing of personal data in certain circumstances, which may be exercised under the terms of this chapter of the Data Protection and Privacy Policy.

Rights	What do they consist in?
Right to information	The Data Subject has the right to obtain clear, transparent and easily understandable information on how GRUPO NABEIRO uses his/her Personal Data and what his/her rights are. It is for this reason that GRUPO NABEIRO provides all this information in this Privacy Policy.
Right of access	The Data Subject has the right to obtain information about what Personal Data GRUPO NABEIRO handles (if any) and certain information (similar to that provided in this Privacy Policy) about how such Data is handled. This right allows you to know and confirm that we use your Data in accordance with the Data Protection Legislation. GRUPO NABEIRO may refuse to provide the information requested where, in order to do so, GRUPO NABEIRO must disclose Personal Data of another person or the information negatively impacts the rights of another person.
Right to rectification	If the Data Subject’s Personal Data is incorrect or incomplete (for example, if your name or address is incorrect), a request may be made to GRUPO NABEIRO to take reasonable steps to correct it.
Right to erasure	This right is also known as the “right to be forgotten” and, in a simple way, allows you to request to permanently erase your data, as long as there are no valid grounds for GRUPO NABEIRO to continue using them or their use is illicit. This is not a general right to erasure, since exceptions are allowed (for example, where such data are necessary for the defence of a right in a judicial proceeding).
Right to restriction of processing	The Data Subject has the right to obtain and reuse certain Personal Data for his/her own purposes in various organisations. This right applies only to the Personal Data provided to GRUPO NABEIRO and which GRUPO NABEIRO handles with the consent and those processed by automated means.
Right to data portability	You have the right to obtain and reuse certain Personal Data for your own purposes in various organizations. This right applies only to the data that you have provided to GRUPO NABEIRO and that GRUPO NABEIRO deals with your consent and those that are handled by automated means.
Right to object	The Data Subject has the right to object to certain types of processing, on grounds relating to his/her particular situation, at any time, for the legitimate interest of GRUPO NABEIRO or of third parties. GRUPO NABEIRO may continue to process such Data if it can provide evidence of “overriding legitimate reasons for processing that override its interests, rights and freedoms” or if such Data is necessary for the establishment, exercise or defence of a right in a legal proceeding.
Right to lodge a complaint	The Data Subject has the right to lodge a complaint with the competent supervisory authority, Agencia Española Protección de Datos – AEPD (Spanish Agency for Data Protection), if he/she considers that the processing of his/her personal data violates his/her rights and/or the Data Protection Legislation. For more information, please refer to www.aepd.es

If the lawfulness of the processing of your Personal Data is based on your consent or legitimate interest, you may withdraw your consent or object to the processing at any time, without any consequences, but without this compromising the lawfulness of the processing carried out in the meantime. If consent is withdrawn or if you expressly object, GRUPO NABEIRO will immediately cease processing your personal data for the purpose in question, unless it is necessary to process the data in order to comply with legal and/or contractual obligations.

You may at any time, in writing, exercise the rights enshrined in the Data Protection Legislation and other applicable legislation through the methods described in Paragraph 9 of this Policy.

Confidentiality and Security

To ensure the security and confidentiality of the collected personal data collected, GRUPO NABEIRO uses protected databases including, but not limited to, adequate firewalls and passwords, in accordance with current and future Data Protection Legislation and other applicable legislation. Access to personal data is only possible for authorized employees who have an effective need to use the data, in accordance with the principles of security and confidentiality. Violations of the present Data Protection and Privacy Policy by GRUPO NABEIRO employees may result in disciplinary action. Compliance with standards and procedures by GRUPO NABEIRO’s staff is monitored and verified periodically.

Use of Cookies

With regard to the processing of Personal Data that GRUPO NABEIRO performs through the use of cookies, please consult the GRUPO NABEIRO Cookie Policy and customize your settings according to your preferences.

How to Contact GRUPO NABEIRO for Data Protection and Privacy Matters

Data Subjects may exercise their rights by contacting GRUPO NABEIRO by sending an email to privacy@gruponabeiro.com.

Data Subjects may also contact GRUPO NABEIRO Data Protection Officer by sending an email to dpo@gruponabeiro.com.