Aviso legal

WEBSITE PRIVACY POLICY
www.avyloxcompany.com

I. PRIVACY AND DATA PROTECTION POLICY
In compliance with current legislation, Avylox Company (hereinafter also “Website”) is committed to adopting the necessary technical and organizational measures, according to the level of security appropriate to the risk of the data collected.

Laws incorporated into this privacy policy
This privacy policy is adapted to the current Spanish and European regulations regarding the protection of personal data on the Internet. Specifically, it complies with the following regulations:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

  • Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPD-GDD).

  • Royal Decree 1720/2007, of 21 December, approving the Regulation implementing Organic Law 15/1999, of 13 December, on the Protection of Personal Data (RDLOPD).

  • Law 34/2002, of 11 July, on Services of the Information Society and Electronic Commerce (LSSI-CE).

Identity of the data controller
The data controller of the personal data collected on Avylox Company is: Ivan Deyanov Ivanov, with NIF: Y0906466G (hereinafter, “Data Controller”). Contact details are as follows:

Registration of Personal Data
In compliance with the GDPR and LOPD-GDD, we inform you that the personal data collected by Avylox Company through the forms on its pages will be incorporated and processed in our file in order to facilitate, expedite, and fulfill the commitments established between Avylox Company and the User or to maintain the relationship established in the forms filled out by the User, or to attend to a request or inquiry from them. Likewise, in accordance with the GDPR and LOPD-GDD, unless the exception provided in Article 30.5 of the GDPR applies, a record of processing activities is maintained specifying, according to their purposes, the processing activities carried out and other circumstances established in the GDPR.

Principles applicable to the processing of personal data
The processing of the User’s personal data will comply with the following principles set out in Article 5 of the GDPR and Articles 4 and following of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights:

  • Lawfulness, fairness, and transparency: The User’s consent will be required at all times with full transparency about the purposes for which personal data are collected.

  • Purpose limitation: Personal data will be collected for specific, explicit, and legitimate purposes.

  • Data minimization: Personal data collected will only be those strictly necessary in relation to the purposes for which they are processed.

  • Accuracy: Personal data must be accurate and kept up to date.

  • Storage limitation: Personal data will only be kept in a way that allows the identification of the User for the time necessary for the purposes of processing.

  • Integrity and confidentiality: Personal data will be processed in a way that ensures security and confidentiality.

  • Accountability: The Data Controller will be responsible for ensuring that the above principles are complied with.

Categories of personal data
The categories of data processed on Avylox Company are limited to identifying data. No special categories of personal data are processed as defined in Article 9 of the GDPR.

Legal basis for the processing of personal data
The legal basis for the processing of personal data is consent. Avylox Company undertakes to obtain the User’s express and verifiable consent for the processing of their personal data for one or more specific purposes.

The User has the right to withdraw their consent at any time. Withdrawing consent will be as easy as giving it. As a general rule, withdrawal of consent will not affect the use of the Website.

Whenever the User must or may provide data through forms to make inquiries, request information, or for reasons related to the Website content, they will be informed if completing any of them is mandatory because they are essential for the proper execution of the requested operation.

Purposes of processing personal data
Personal data are collected and managed by Avylox Company in order to facilitate, expedite, and fulfill the commitments established between the Website and the User or to maintain the relationship established in the forms completed by the User or to attend to a request or inquiry.

Likewise, data may be used for commercial purposes, personalization, operational and statistical activities, and activities inherent to the corporate purpose of Avylox Company, as well as for data extraction, storage, and marketing studies to tailor the content offered to the User and improve the quality, functionality, and navigation of the Website.

When personal data are obtained, the User will be informed about the specific purpose(s) for which they will be used; that is, the use(s) of the information collected.

Retention periods for personal data
Personal data will only be retained for the minimum time necessary for the purposes of processing and, in any case, only for the following period: 18 months, or until the User requests deletion.

When personal data are obtained, the User will be informed of the period during which personal data will be retained or, when not possible, the criteria used to determine this period.

Recipients of personal data
The User’s personal data will be shared with the following recipients or categories of recipients:

  • Shopify Inc. 150 Elgin Street, 8th Floor Ottawa, Ontario K2P 1L4 Canada

If the Data Controller intends to transfer personal data to a third country or international organization, the User will be informed at the time of data collection about the third country or organization and the existence or absence of a Commission adequacy decision.

Personal data of minors
In compliance with Articles 8 of the GDPR and 7 of Organic Law 3/2018, only individuals over 14 years old may lawfully give consent for the processing of their personal data by Avylox Company. If the User is under 14 years old, parental or guardian consent is required, and processing is lawful only to the extent that consent has been granted.

Confidentiality and security of personal data
Avylox Company undertakes to adopt the necessary technical and organizational measures, according to the level of security appropriate to the risk of the data collected, to ensure the security of personal data and prevent accidental or unlawful destruction, loss, alteration, or unauthorized access to personal data transmitted, stored, or otherwise processed.

The Website has an SSL (Secure Socket Layer) certificate, which ensures that personal data are transmitted securely and confidentially, as data transmitted between the server and the User are fully encrypted.

However, since Avylox Company cannot guarantee the invulnerability of the Internet or the total absence of hackers or other unauthorized access, the Data Controller undertakes to inform the User without undue delay if a personal data security breach occurs that is likely to result in a high risk to the rights and freedoms of natural persons. According to Article 4 of the GDPR, a personal data security breach is any security breach causing accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access to personal data.

Personal data will be treated as confidential by the Data Controller, who commits to ensuring, through legal or contractual obligations, that such confidentiality is respected by employees, associates, and anyone granted access to the information.

Rights regarding the processing of personal data
The User has the following rights under the GDPR and Organic Law 3/2018:

  • Right of access: The right to obtain confirmation of whether Avylox Company is processing personal data and, if so, to access specific information about the data processed and the recipients.

  • Right of rectification: The right to have inaccurate or incomplete personal data corrected.

  • Right of erasure (“right to be forgotten”): The right to have personal data deleted when they are no longer necessary, consent has been withdrawn, data are unlawfully processed, or other legal conditions apply. The Data Controller must take reasonable steps to inform third parties processing the data of the deletion request.

  • Right to restriction of processing: The right to limit processing under certain circumstances, e.g., disputed accuracy or unlawful processing.

  • Right to data portability: The right to receive personal data in a structured, commonly used, machine-readable format and transmit them to another controller.

  • Right to object: The right to object to processing or to cease processing.

  • Right not to be subject to automated decision-making, including profiling: The User cannot be subject to decisions based solely on automated processing unless allowed by law.

These rights can be exercised by written communication to the Data Controller with the reference “GDPR-www.avyloxcompany.com”, specifying:

  • Name, surname, and a copy of the ID. If representation is allowed, identification of the representative and proof of representation is required.

  • Reason for the request or information desired.

  • Address for notifications.

  • Date and signature of the applicant.

  • Any supporting documents.

Requests and documents may be sent to:

Links to third-party websites
The Website may include hyperlinks to third-party websites not operated by Avylox Company. These websites have their own privacy policies and are responsible for their own files and practices.

Complaints to the supervisory authority
If the User considers there is a problem or violation regarding the processing of personal data, they have the right to judicial protection and to file a complaint with a supervisory authority. In Spain, the authority