At Oxaan we are committed to ensuring that your professional and personal information is protected and is not misused.

In this document we explain who is responsible for the treatment, for what purpose your personal information will be processed, the legitimacy for the treatment, how we collect it, why we collect it, how we use it, the rights that assist you and also explain the processes we have put in place to protect your privacy.

By providing us with your personal information and using our websites, we understand that you have read and understood the terms related to the personal data protection information that is exposed. Oxaan assumes the responsibility of complying with current legislation on national and European data protection, and they have the objective of treating your data in a lawful, loyal and transparent manner.

AREA OF APPLICATION

This document applies to the website www.oxaan.com.

CONSIDERATIONS TO TAKE INTO ACCOUNT

WHO IS RESPONSIBLE FOR THE TREATMENT?

The definition of data controller is described in the General Data Protection Regulation, and is as follows:

RESPONSIBLE FOR THE TREATMENT" OR "RESPONSIBLE"

The natural or legal person, authority, service or other body that, alone or jointly with others, determines the purposes and means of processing.

If you have any kind of query, comment or concern, or if you would like to make any suggestions about how we use personal information, you can send an email to info@oxaan.com.

INFORMATION ABOUT OXAAN

Oxaan belongs to Oxaan International Trade, with NIF B13810403.

• Registered office: Calle Jardín 10, 45122 Argés, Toledo.
• Email: info@oxaan.com
• Telephone: +34 (If calling from outside Spain) 624 795 255
• N.I.F: 03794900S

Website: www.oxaan.com

FOR WHAT PURPOSE DO WE COLLECT YOUR PERSONAL OR PROFESSIONAL INFORMATION?

The main reason why we collect your personal information is to facilitate and improve the service that you as a customer expect from us.

We collect your personal information to manage your purchases, orders or requests that you make to us through our web pages or applications, by telephone or in any paper form.

Below, we include the main purposes that we have identified in Oxaan:

Compliance with legal obligations, including, without limitation, Law 10/2010 on the Prevention of Money Laundering.
Management of the contracting of products or services offered by any of the Oxaan companies, including distance selling and management of shipments and returns.
Create and manage a personal account with a single registration to be used in the acquisition of products and services offered in our online stores.
Channel requests for information, suggestions and customer complaints for their management and resolution.
Keep you informed about our latest products, offers, opportunities, etc. The channel we usually use is email.

HOW DO WE COLLECT INFORMATION ABOUT YOU?

We collect personal information about you through different means, in some cases you will contact us to share your personal information, and in other cases we collect your personal data using other means. Below we will explain the different ways in which we collect personal information about you and some examples in which we use such information.

INFORMATION YOU PROVIDE US

We collect personal information that you provide us through our website, email, mobile phone, when you contract a service, when you fill out a form, or others. In any case, at the time of collection you will be informed of the person responsible for the treatment, the purpose of the treatment, the recipients of the information, as well as the way to exercise the rights granted by current legislation on data protection.

For example: it is likely that you provide us with information when you contact our customer service, place a purchase order, register on our websites, update your preferences and account information, fill out a questionnaire, etc.

Generally, the personal information that you provide us is: name and surname, address, ID, email, contact telephone number and payment information.

INFORMATION WE COLLECT FROM YOUR VISITS ON OUR WEBSITES

We collect and store limited personal information and anonymous aggregate statistics from all users who visit our websites, whether you actively provide us with such information or are simply browsing our websites. The information we collect includes the Internet Protocol (IP) address of the device you are using, the browser program you are using, your operating system, the date and time of access, the Internet address of the website from which you accessed our websites and also information about how you use our websites.

We use this information to find out the loading time of our websites, how they are used, the number of visits to the different sections and the type of information that most attracts professionals. It also helps to identify if the web works correctly, and if we detect failures or errors in the operation, to solve them and improve the performance of our websites, in order to offer a better service to all users.

This information is collected through cookies, for more information consult the cookie policy that you can find on the Oxaan website.

WHAT IS THE LEGITIMATION FOR THE PROCESSING OF PERSONAL INFORMATION?

For the treatment of your personal information we rely on legitimacy for several reasons:

• For the fulfillment of a contract and/or commercial relationship.
• To comply with different legal obligations.
• For legitimate interest, for example, for security reasons, fraud prevention, to improve our services and products through market research, or to manage requests, queries or possible claims that may arise.
• With your consent, for example, for the sending of personalized offers from Oxaan.

TO WHOM CAN WE COMMUNICATE YOUR PERSONAL INFORMATION?

In some cases, it is necessary for us to communicate the information you have provided to third parties in order to provide you with the requested service, for example, logistics, transport and delivery services.

Likewise, there are companies that provide us with other types of services such as: information technology (information storage and processing), security services, financial services, audit services, etc.

These third parties only have access to the personal information they need to perform those services. They are required to keep your personal information confidential and may not use it in any way other than as requested by us.

In all cases, Oxaan assumes responsibility for the personal information you provide to us, and we ask those companies with whom we share your personal information to apply the same level of information protection as we do.

Likewise, your personal information will be available to the Public Administrations, Judges and Courts, for the attention of the possible responsibilities arising from the treatment.

INTERNATIONAL TRANSFER

The personal information we collect resides in Spain, although it is possible that some Oxaan companies have a presence in other countries and your personal information is collected in the country in which you reside.

LINKS TO THIRD PARTY WEBSITES

In the event that we provide links to websites that are not operated or controlled by Oxaan, you will be promptly informed. Oxaan has no control over such sites and is not responsible for their content, nor does it have control over how third parties collect and use your personal information, nor is it responsible or makes any representations about third party websites.

These websites may have their own privacy policies that explain how they use and share your personal information. We recommend that you carefully review the privacy policies before using these websites to ensure that you are happy with the way in which your personal information is collected and shared.

HOW LONG DO WE STORE YOUR PERSONAL INFORMATION?

We only store your personal or professional information to the extent that we need it in order to use it according to the purpose for which it was collected, and according to the legal basis of the treatment of the same in accordance with the applicable law. We will keep your personal information as long as there is a contractual and/or commercial relationship with you, or as long as you do not exercise your right to delete and/or limit the processing of your data.

In these cases, we will keep the information duly blocked, without giving it any use, as long as it may be necessary for the exercise or defense of claims or some type of judicial, legal or contractual responsibility may arise from its treatment, which must be addressed and for which its recovery is necessary.

HOW CAN YOU EXERCISE YOUR RIGHTS?

The data protection regulations allow you to exercise your rights of access, rectification, opposition, deletion, limitation of treatment, portability and not to be subject to individualized decisions before the data controller.

These rights are characterized by the following:

• Your exercise is free
• If the requests are manifestly unfounded or excessive (for example, repetitive), the controller may:
• Charge a fee proportional to the administrative costs incurred.

Refuse to act.

Requests must be answered within a month, although, if the complexity and number of requests are taken into account, the term can be extended for another two more months.

The person in charge is obliged to inform you about the means to exercise these rights. These means must be accessible and this right cannot be denied for the sole reason that you choose another means.

If the request is submitted by electronic means, the information will be provided by these means when possible, unless the interested party requests that it be otherwise.

If the person in charge does not process the request, they will inform, no later than one month, of the reasons for their non-action and the possibility of claiming before a Control Authority.

You can exercise your rights directly or through your legal representative.

It is possible that the person in charge is the one who attends to your request on behalf of the person in charge if both have established it in the contract or legal act that binds them.

RIGHT OF SUPPRESSION

The right of deletion may be exercised before the person in charge requesting the deletion of your personal data when any of the following circumstances occur:

If your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
If the processing of your personal data has been based on the consent that you gave to the person in charge, and you withdraw it, provided that the aforementioned treatment is not based on another cause that legitimizes it.
The treatment of the person in charge was based on the legitimate interest or in the fulfillment of a mission of public interest, and other reasons have not prevailed to legitimize the treatment of your data.
To have your personal data subject to direct marketing, including profiling related to said marketing.
If your personal data has been processed unlawfully.
However, this right is not unlimited, in such a way that it may be feasible not to proceed with the deletion when the treatment is necessary for the exercise of freedom of expression and information, for the fulfillment of a legal obligation, for the fulfillment of a mission carried out in the public interest or in the exercise of public powers vested in the controller, for reasons of public interest, in the field of public health, for purposes of archiving in the public interest, scientific or historical research purposes or statistical purposes, or for the formulation, exercise or defense of claims.

The person in charge of the treatment will be obliged to block the data when it proceeds to its rectification or deletion.

The blocking of the data consists of the identification and reservation of the same, adopting technical and organizational measures, to prevent its treatment, including its visualization, except for the provision of the data to the judges and courts, the Public Prosecutor's Office or the Competent Public Administrations, in particular the data protection authorities, for the requirement of possible responsibilities derived from the treatment and only for the limitation period thereof.

After this period, the data must be destroyed.

WHERE CAN YOU EXERCISE YOUR RIGHTS?

In order to exercise your rights, Oxaan places the following means at your disposal:

By means of a written and signed request addressed to Oxaan, Calle Jardín 10, 45122 Argés, Toledo, and must attach a photocopy of the ID or document proving the applicant's identity.

Sending an email along with a photocopy and/or scanned copy of the ID or document proving the applicant's identity to the email address info@oxaan.com.

Calling the Customer Service number (+34) 624 79 52 55

HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We are committed to protecting your personal information. We use appropriate technical and organizational measures to protect your personal information and privacy, and we review such measures periodically. We protect your personal information by using a combination of both physical and computer or logical security controls, including access controls that restrict and manage how your personal information and personal data is processed, administered and managed. We also make sure that our employees are properly trained to protect your personal information. Our procedures indicate that we may require proof of identity before sharing your personal information with you.

In accordance with our guarantee of security and confidentiality, we are especially interested in providing you with the highest level of security and protecting the confidentiality of the personal information you provide to us. Therefore, commercial transactions are carried out in a secure server environment under SSL (Secure Socket Layer) protocol.

If at any time you have problems accessing any part of our website, it may be due to the model or version of your browser or the configuration of its options.

ARE THE DATA OF MINORS PROCESSED?

At Oxaan we only allow access to adults. We prohibit access to our online stores to minors.

If we discover that we have inadvertently obtained personal information from a minor, we will delete such information as soon as possible.

WHAT PRECAUTIONS SHOULD BE TAKEN INTO ACCOUNT?

These are some of the precautions that we advise our clients should take:

Do not provide anyone with the username or password.
Do not write it down in easily accessible places: computer, diary, etc.
Always use our SSL security system.
Always disconnect the browser session after having accessed a security zone or having entered the user name or password into the system.
Modifications to this data protection information
We will review and update the data protection information when there are changes in the legislation or in any of the procedures for the treatment of your personal information.