Legal

Privacy policy

This policy explains which personal data we process when you use merch.pekata.es, for what purpose, for how long and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

1. Data controller

  • Company name: Reloting, S.L. (trading name: Pekata)
  • NIF: B19932771
  • Registered office: C/ Casanova 270, Ático 1ª, 08021 Barcelona (Spain)
  • E-mail: hola@pekata.es
  • Domain name: merch.pekata.es

Reloting, S.L. is not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any question relating to this policy you can write to the e-mail address given above.

2. What data we process and why

a) Quote request

  • Data collected: first name and surname, company, e-mail address, telephone (optional), delivery country and postcode, intra-Community VAT number (optional, for European Union companies outside Spain), desired delivery date, comments and the products, quantities and branding you have chosen.
  • Purpose: to prepare and send you the quote, answer your questions about it and manage the order if you accept it.
  • Legal basis: the application of pre-contractual measures at your request (Art. 6(1)(b) GDPR). The subsequent commercial follow-up of your request is based on our legitimate interest in attending to those who have asked us for a quote (Art. 6(1)(f) GDPR); you can object to it at any time.

b) Logo

  • Data processed: the file containing your logo, if you decide to send it to us after requesting the quote.
  • Purpose: to prepare the branding mock-up and, if you accept the quote, to produce the order.
  • Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR).

c) VAT number verification

If you provide us with an intra-Community VAT number, we check it in the European Commission's VIES system in order to apply the correct tax treatment to your quote. The check is an automated query to the European Union's public service and is based on compliance with our tax obligations (Art. 6(1)(c) GDPR).

d) Browsing the site

This site does not use analytics or advertising cookies. The servers record technical data for each request (IP address, date and time, page requested and browser) for the sole purpose of ensuring the security of the service and detecting abuse, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). You will find details of the storage your browser uses in the Cookie policy.

3. Retention periods

We keep the data from your request while the quote is being handled and, if it becomes an order, for the duration of the commercial relationship and the periods required by commercial and tax legislation. A quote that does not become an order is kept for a maximum of two years from the last contact. The servers' technical logs are kept for a maximum of twelve months. Once these periods have elapsed, or your request for erasure has been dealt with, the data will be blocked — available exclusively to judges, courts and public authorities — for the limitation periods of any potential liabilities (Art. 32 LOPDGDD) and destroyed thereafter.

4. Recipients and data processors

We do not disclose your data to third parties, except where legally required. To provide the service we rely on data processors with whom we have signed the contracts required by Article 28 GDPR:

  • Hetzner Online GmbH (Germany): hosting of the site and of our platform, within the European Economic Area.
  • ActiveCampaign, LLC (Postmark) (United States): sending of transactional e-mails, such as the confirmation of your quote request.

If the quote becomes an order, we will pass on to the manufacturers and suppliers who produce and brand the products, all of them established in the European Union, the data strictly necessary to manufacture and deliver it: the logo, the contact details and the delivery address.

5. International transfers

Sending transactional e-mails through Postmark may involve a transfer of data to the United States. This transfer is covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified, and, in the alternative, by the standard contractual clauses approved by the European Commission. No other transfers outside the European Economic Area are envisaged.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time. Simply write to hola@pekata.es stating the right you wish to exercise; we may ask you for additional information to confirm your identity.

If you consider that we have not handled your rights properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

7. Security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, protecting the data against unauthorised access, loss, destruction or accidental damage.