The Owner informs you of its Privacy Policy regarding the processing and protection of the personal data of users and customers that may be collected when browsing, purchasing a product or contracting a service through the Website: https://castrocomposites.com

In this respect, the Owner guarantees compliance with current personal data protection legislation, as set out in Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPD GDD). It also complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (GDPR).

This Privacy Policy explains how your personal data is processed. The terms governing use of the website are set out in the Legal Notice.

Identity of the Controller

• Controller:  Resinas Castro S. L..
• Tax identification number (NIF): B-36640811
  Registered in the commercial register of Pontevedra, volume 473, book 473, section 8, folio 175, page 5533, entry 11.
• Address:  Polígono Industrial A Granxa, 3ª paralela, C/ C Cíes 190, Pontevedra – Spain.
• Email address:  admon@resinascastro.com
• Contact telephone:  +34 986 34 29 53
• Website:  https://castrocomposites.com

Principles applied to data processing

When processing your personal data, the Owner will apply the following principles, which comply with the requirements of the new European General Data Protection Regulation (GDPR):

• Principle of lawfulness, fairness and transparency: The Owner will process personal data on a lawful basis applicable to each purpose and provide clear information to the User. Where consent is required, it will be requested specifically and on an informed basis.
• Principle of data minimisation: The Owner will request only the data strictly necessary for the purpose or purposes for which it is requested.
• Principle of storage limitation: The Owner will retain the personal data collected only for as long as is strictly necessary for the purpose or purposes of processing. The Owner will inform the User of the applicable retention period according to the purpose.
  For subscriptions, the Owner will periodically review its lists and remove records that have been inactive for a considerable period.
• Principle of integrity and confidentiality: Technical and organisational measures appropriate to the risk will be applied to protect the security, confidentiality and integrity of personal data.
  The Owner takes the necessary precautions to prevent unauthorised access to, or misuse of, its users’ data by third parties.

Collection of personal data

You do not need to provide personal data to browse the Website.

You provide personal data in the following circumstances:

• When contacting us through contact forms or sending an email.
• When commenting on an article or page.
• When purchasing a product or contracting a service.
• When signing up through a subscription form or for a newsletter managed by the Owner through Mailchimp.

Your rights

The Owner informs you that you have the right to:

• Request access to the data held about you.
• Request rectification or erasure.
• Request restriction of processing.
• Object to processing.

You may also request portability of the personal data you have provided to us where it is processed by automated means on the basis of your consent or a contract, subject to applicable law. Where this right applies, you may receive the data in a structured, commonly used, machine-readable format and request its transmission to another controller.

You may exercise your rights by contacting admon@resinascastro.com, either directly or through a duly authorised representative. Please identify the right you wish to exercise and provide the information needed to locate your data. You do not routinely need to attach a copy of your identity document. If we have reasonable doubts about your identity or the representative’s authority, we may request the additional information necessary and proportionate to verify them.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before its withdrawal. Erasure and other rights are subject to the conditions and exceptions provided by law; an obligation to retain certain data does not generally exclude all your rights.

You may lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es). Where the UK GDPR applies, you may also contact the UK’s Information Commissioner’s Office (https://ico.org.uk). This does not limit your right to an effective judicial remedy.

Purposes of personal data processing

When you connect to the Website to email the Owner, write a comment on an article or page, subscribe to its newsletter or purchase a product or service, you provide personal information for which the Owner is the controller. This information may include personal data such as your IP address, first name and surname, physical address, email address, telephone number and other information. The Owner will process this information for the purposes and on the lawful bases described in this policy, using ProfesionalHosting as the website hosting provider. Further information is available on the following pages:

• Legal Notice
• Privacy Policy

The personal data collected and the purpose of its processing by the Owner depend on the method used to collect it:

• Contact forms: The Owner requests personal data, which may include your first name and surname, email address, telephone number and website address, to answer Users’ enquiries and provide information and demonstrations about its products and services, including quotations.
  For example, the Owner uses this data to respond to messages, questions, complaints, comments or concerns about information on the Website, the products and services provided through it, the processing of personal data, its legal texts, or other enquiries that are not governed by the Website’s terms or the terms of purchase.
• Comment forms: The Owner requests personal data, which may include your first name and surname, email address and website address, to respond to Users’ comments.
• Product and service order forms: The Owner requests personal data, which may include your first name and surname, identity document (tax identification number, foreign national identification number, passport or residence permit), email address, postal address, telephone number and payment details (payment methods or bank details), to maintain a commercial relationship with the User, ship orders, provide the contracted services, and invoice and collect payment for the products or services purchased.
• Content subscription forms: The Owner requests the following personal data: first name and surname, email address, telephone number and website address, to manage its subscription list and send newsletters, promotions and special offers. The personal data provided to the Owner will be held on the servers of The Rocket Science Group LLC d/b/a, based in the United States (Mailchimp).

The Owner also processes personal data for the following purposes:

• To ensure compliance with the conditions set out in the Legal Notice and with applicable law. This may include developing tools and algorithms to help the Website maintain the confidentiality of the personal data it collects.
• To support and improve the services offered by the Website.
• To analyse user browsing. The Owner collects other, non-identifying data obtained through cookies downloaded to the User’s computer when browsing the Website. Their characteristics and purposes are described in the Cookie Policy.
• To manage social media. The Owner has a presence on social media. If you follow its social media accounts, the processing of your personal data will be governed by this section and by the applicable terms of use, privacy policies and access rules of the relevant social network, which you have previously accepted.
  You can consult the privacy policies of the main social networks here:
  • Facebook
  • Twitter
  • Linkedin
  • YouTube
  • Instagram

  The Owner will process your personal data to manage its social media presence, inform you about its activities, products or services, and for any other purpose permitted by the social networks’ rules.

  The Owner will never use followers’ social media profiles to send individual advertising.

Security of personal data

To protect your personal data, the Owner takes all reasonable precautions and follows industry best practices to prevent its loss, misuse, unauthorised access, disclosure, alteration or destruction.

The Website is hosted by ProfesionalHosting. No system can guarantee absolute security. Safeguards must be appropriate to the risks of processing and reviewed when circumstances change.

The Owner informs the User that their personal data will not be disclosed to third-party organisations unless the disclosure is required by law or provision of a service requires a contractual relationship with a data processor. Access by a provider acting as a data processor must be governed by the corresponding contract and limited to the Owner’s instructions. Where a disclosure of data requires consent, it will be requested beforehand.

However, in some cases the Owner may collaborate with other professionals. In those cases, the User’s consent will be requested after identifying the collaborator and explaining the purpose of the collaboration. The strictest security standards will always be observed.

Content from other websites

Pages on this Website may include embedded content, such as videos, images or articles. Embedded content from other websites behaves in exactly the same way as if you had visited those websites.

Those websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with the embedded content.

Cookie Policy

For this Website to function correctly, it needs to use cookies, which are pieces of information stored in your web browser.

You can find full information about the collection and processing of cookies in the Cookie Policy.

Legal basis for processing

The legal bases for processing your data are:

• The data subject’s consent.
• Performance of a contract or steps taken before entering into a contract, in order to provide a product or service purchased from the Owner.
• Compliance with legal obligations.

Categories of personal data

The categories of personal data processed by the Owner are:

• Identification data.
• No special categories of personal data are processed.

Retention of personal data

We will retain personal data for as long as necessary for the purpose for which it was collected and to meet applicable legal obligations and liabilities. When it is no longer needed, we will erase or anonymise it, restricting it to legally required retention where applicable. Contact details and identifier check results will be reviewed according to their necessity, separately from documents that must be retained under commercial or tax obligations.

You can find information about how Google manages privacy in relation to cookies and other information in Google’s Privacy Policy: https://policies.google.com/privacy

You can also consult a list of the types of cookies used by Google and its partners, together with information about their use of advertising cookies, here:

• Types of cookies Google uses
• How Google uses cookies in advertising.

Web browsing

When you browse the Website, non-identifying data may be collected. This may include your IP address, geolocation, records of how you use services and sites, browsing habits and other data that cannot be used to identify you.

The Website uses the following third-party analytics services:

• Google Analytics.

The Owner uses the information obtained to gather statistical data, analyse trends, administer the site, study browsing patterns and collect demographic information.

The Owner is not responsible for the processing of personal data by websites you may access through links on this Website.

Accuracy and truthfulness of personal data

You undertake to provide the Owner with correct, complete, accurate and current data and to keep it duly updated.

As a User of the Website, you are solely responsible for the truthfulness and accuracy of the data you submit, releasing the Owner from any liability in this respect.

Acceptance and consent

This Privacy Policy explains how your personal data is processed. Reading it or using the Website does not by itself constitute consent to all the processing described. Each processing activity relies on its applicable lawful basis. Where consent is needed, we will request a specific affirmative action, separate from merely reading this policy. You may withdraw consent through the contact methods set out on this page.

Information about the planned Odoo/HMRC integration

Resinas Castro S. L. is preparing its own integration to check UK identifiers with HM Revenue & Customs (HMRC). Odoo has not yet been deployed in our live shop and its new HMRC VAT validation is not available to customers. This information describes a feature under development, not a service currently active in the shop.

The integration is designed to send the UK VAT or EORI number provided to HMRC, according to the relevant check. These are separate identifiers and checks. It does not request the customer’s HMRC sign-in credentials. The current design retains the check result, its dates and control data linked to the contact; it does not add the name or address returned by HMRC to the customer record.

The purpose of these checks will be to verify the accuracy of identifiers supplied for a commercial transaction and reduce invoicing or customs-processing errors. The envisaged lawful basis is our legitimate interest in keeping those details accurate, under Article 6(1)(f) of the GDPR and the UK GDPR where applicable. Checks will be limited to identifiers relevant to the transaction and will not be used for advertising or creditworthiness assessment.

The recipient of the check will be HMRC in the United Kingdom. Resinas Castro S. L. will be responsible for the processing it carries out through its integration. Identifiers, results and dates will be retained in accordance with the criteria in this policy; cache or recheck intervals are not statutory retention periods. Before the production launch, the application of protection and retention measures to the final deployment will be checked.

A technical failure during a check does not establish that the identifier is unregistered. Checking an EORI does not validate a VAT number or, by itself, grant a VAT exemption. VAT validation may require you to correct the billing address, retry the check or contact us before continuing. The EORI will be optional, and its absence alone will not block a purchase.

You may request a review of a result or correction of your details, and object to processing based on legitimate interests on grounds relating to your particular situation, by emailing admon@resinascastro.com. Administration will assess your request and the circumstances of the case in accordance with applicable law.

Privacy and security contact

To report possible data exposure, unauthorised access or a privacy or security issue relating to our services, email admon@resinascastro.com. Administration coordinates the handling of these reports with the technical lead. Please identify the affected service and describe the issue; do not send passwords, access keys or unnecessary third-party personal data.

Changes to this Privacy Policy

The Owner reserves the right to amend this Privacy Policy to reflect changes in legislation or case law and industry practices.

These policies will remain in force until they are replaced by other duly published policies.