PRIVACY POLICY

Information requirements according to Art. 12, 13 ff. GDPR

1. Name and Contact Details of the Controller

Controller within the meaning of the European General Data Protection Regulation („EU GDPR“) is:

Selecta Cut Flowers SAU
Avenida Beniamino Farina, 135 1r Piso
08340 – Vilassar de Mar (Barcelona)
Correo electrónico: cutflowers@selecta-one.com / Tel. +3993 750 66 56

(hereinafter referred to as „we“, „us“ or „our“)

2. Name and Contact Details of the Data Protection Officer

To ensure the protection of your personal data, we have appointed a data protection officer. Please ask all questions around the topic of data protection and data security directly to our data protection officer:

Selecta Cut Flowers SAU
Protección de Datos
Avenida Beniamino Farina, 135 1r Piso
08340 – Vilassar de Mar (Barcelona)
Correo electrónico: dpo-spain@selecta-one.com / Tel: +3493 750 66 56 (extensión 113)

3. General Information on Data Processing

a. Scope of processing of personal data

We only process your personal data as far as this is necessary for the purposes of order processing, fulfilment of the contract, for internal administrative purposes and / or for the provision of services including the use of our website. The processing of your personal data takes place only based on your consent or if the processing is permitted by a legal permission.

b. Legal Bases for Processing Personal Data

If we obtain your consent to process personal data, we process your data on basis of Art. 6 para. 1 lit. a EU-GDPR.

Is the processing of personal data required to fulfil a contract between you and us, Art. 6 para. 1 lit. b EU-GDPR serves as legal basis. This also applies to processing operations for the implementation of pre-contractual measures.

If processing of personal data is required to fulfil a legal obligation to which we are subject, we will process your data based on Art. 6 para. 1 lit. c EU GDPR.

If vital interests of you or another natural person require the processing of personal data, Art. 6 para.1 lit. d EU-GDPR serves as legal basis.

If the processing is necessary to protect a legitimate interest of us or a third party and your interests, fundamental rights and fundamental freedoms do not outweigh our interest, we process your data based on Art. 6 para. 1 lit. f EU-GDPR.

c. Data Erasure and Storage Period

Your personal data will be deleted or blocked as soon as the purpose of the storage is omitted or the statutory retention period expires.
It may be that by EU law regulations, laws or other regulations to which we are subject, your data will be stored even after the expiry of the purpose limitation due to the legal storage period.

d. Data Transfers to Third Countries

Third countries within the meaning of GDPR are all countries outside the EU.
As an international company, we also have production facilities and suppliers in third countries, e.g. in Kenya and Uganda. For the fulfilment of our contractual obligations in the context of consignments, your personal data may therefore be transmitted to the necessary extent to these suppliers and the employees of the production facilities. For reasons of quality assurance, your goods will in this case be shipped directly from these locations. It may be necessary to use your address data for this purpose and to pass them on to customs authorities and freight forwarders if necessary. The legal basis for the transmission of your personal data is Art. 6 para. 1 lit. b EU-GDPR.
To support our operational processes, we use different software systems. When processing data, we take great care to ensure that the processing, in particular the storage, takes place on servers within the EU and that external IT service providers are located in Germany or the EU.

However, in exceptional cases, the transfer to a third country, especially into the US, is done for technical reasons or for reasons related to the selection of subcontractors by our service providers. In this case, we insist on a contract that guarantees data processing at the level of European data protection laws.
Of course, we pay attention to reliability when selecting our suppliers and service providers and they contractually agree to comply with European data protection laws.

e. Internal Organization

All our employees are obliged to maintain confidentiality and observe external and internal privacy policy regarding the processing of your data. We protect your data from unauthorized access and disclosure as well as from loss and destruction with many technical and organisational security measures. Our security measures are regularly checked and kept up to date.

4. Provision of the Website and Creation of Logfiles

a. Legal Basis for Data Processing

Legal basis for the processing of your personal data in the context of the provision of the website and the creation of log files is Art. 6 para. 1 lit. f EU-GDPR.

b. Purpose of Data Processing

Your personal data will be automatically transmitted to us by your browser. These are

  • browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

The temporary storage of your personal data by us is necessary so that the website can be displayed on your computer. Your personal data is stored in log files for the duration of your session in order to ensure the functionality of the website, to optimize the website and to ensure the security of our information technology systems.

These purposes reflect our legitimate interest in the processing of data pursuant to Art. 6 para. 1 lit. f EU-GDPR.

We do not use your personal data for any other purpose.

c. Duration of Storage

Your personal data will be deleted as soon as they are no longer necessary to achieve the above mentioned purpose. In this case, once the session has ended.In the case of storage of your personal data in log files, these will be deleted after seven days at the latest.

d. Possibility of Objection and Removal

The collection and storage of your personal data in log files is essential to provide the website. Therefore it is not possible to object to this.

5. Usage of Cookies (Session-Cookies)

a. Legal Basis for Data Processing

Legal basis for the processing of your personal data in the context of the use of technically necessary cookies is Art. 6 para. 1 lit. f EU-GDPR.

b. Purpose of Data Processing

Session cookies are used to simplify the use of our website. Some features of our website cannot be offered without the use of cookies. These require that your Internet browser is recognized even after changing websites or that the website call-up in two windows can be associated to your session. These purposes reflect our legitimate interest in the processing of data pursuant to Art. 6 para. 1 lit. f EU-GDPR.
We do not use the information from session cookies for creating profiles.

c. Duration of Storage

Your personal data will be deleted as soon as they are no longer necessary to achieve the above-mentioned purpose. This is usually done after the end of your session by closing the browser.

d. Possibility of Objection and Removal

Cookies are stored on your computer and transmitted by it to our website. You have the option to disable the storage and transmission of cookies or to restrict the transmission by changing the settings in your Internet browser. Saved cookies can also be deleted there. We would like to point out that if you deactivate or restrict cookies, you may no longer have access to all functions of our website.

6. Use of Google Analytics (Webtracking and Web-Analysis)

a. Scope of Processing

This website uses functions of the web analytics service Google Analytics. Provider is Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (hereafter "Google"). Google Analytics uses so-called "cookies". These are text files that are stored on your computer and that allow an analysis of how the website is used by you. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

We have activated the function IP anonymization on this website. As a result, your IP address will be truncated by Google within member states of the European Union or other contracting parties to the Agreement on the European Economic Area prior to transmission to the United States. Only in exceptional cases the full IP address will be sent to a Google server in the US and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google information.

b. Legal Basis for Data Processing

Google Analytics cookies are stored based on Art. 6 para. 1 lit. f EU-GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimize both its website and its advertising.

c. Purpose of Data Processing

The processing of your personal data enables us to analyse your browsing habits and in doing so we can compile information about the use of the individual components of our website. This is important to constantly improve our website and make it more user-friendly. This also reflects our legitimate interest in the processing of your personal data pursuant to Art. 6 para. 1 lit. f EU-GDPR. We take the protection of your personal data into account by anonymizing your IP address.

d. Duration of Storage

Your personal data will be deleted as soon as it is no longer needed for our above-mentioned purposes.

e. Possibility of Objection and Removal

You can prevent the storage of cookies by a corresponding setting of your browser software; However, please be aware that in this case you may not be able to use all features of this website.

In addition, you may prevent that Google collects the data generated by the cookie and related to your use of the website (including your IP address) as well as prevent the processing of this data by Google by downloading the browser plug-in, which is available under the following link, and installing: https://tools.google.com/dlpage/gaoptout?hl=en You can prevent the collection of your data by Google Analytics by clicking on the following link. An opt-out cookie will be set that prevents the collection of your data on future visits to this website: disable Google Analytics.

For more information on how to handle user data on Google Analytics, please refer to the Google Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=en

7. Newsletter

Through our website, you can subscribe to an electronic newsletter which keeps you informed about different topics. When registering for the newsletter, you will only be required to input data that is necessary for its delivery.

In order to avoid unauthorized people subscribing to the newsletter on your behalf, our website works according to the double opt-in process. This means you will receive an email with a confirmation link, and only once you have clicked on it will you be included on our mailing list.

a. Legal Basis for Data Processing

We send the newsletter on the legal basis of consent pursuant to Art. 6 para. 1 lit. a EU GDPR. This consent is obtained through the double-opt-in procedure.

b. Purpose of Data Processing

The collection of your e-mail address is needed to send the newsletter to you. The purpose is to promote sales of goods or services and general corporate communications.

c. Duration of Storage

Your personal data will be deleted as soon as they are no longer necessary to achieve the above-mentioned purpose. Your e-mail address will be stored for this purpose until you unsubscribe from the newsletter.

d. Possibility of Objection and Removal

Of course, you have the option to unsubscribe from the newsletter at any time. To do so, please use the ‘unsubscribe’ link that is included in every newsletter.

8. Contact Form and Contact via E-Mail

a. Legal Basis for Data Processing

The processing of the data entered to the contact form is based on your consent (Article 6 para. 1 lit. a EU-GDPR).

If the contact is made via the contact form or by e-mail for the purpose of concluding a contract, Art. 6 para. 1 lit. b EU-GDPR is an additional legal basis for the processing.

b. Purpose of Data Processing

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you entered there, will be stored for the purpose of processing the request and in case of follow-up questions. We will not share this information without your consent.

c. Duration of Storage

The information you provide in the contact form will remain with us until you ask us to delete it, revoke your consent to storage, or the purpose for data storage ceased (for example, after your request has been solved). Mandatory statutory regulations, in particular retention periods, remain unaffected.

d. Possibility of Objection and Removal

At any time you can revoke your consent or object to the processing of your personal data in the context of contacting us via the contact form or by e-mail at any time in the future. If doing so, the conversation between you and us cannot continue. All personal data stored in the course of contacting will be deleted in this case.

9. YouTube

Our website uses plugins from YouTube, which is operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our pages featuring a YouTube plugin, a connection to the YouTube servers is established. The YouTube server is informed about which of our pages you have visited.

If you're logged in to your YouTube account, you allow YouTube to associate your browsing behaviour directly with your personal profile. We neither store nor use any personal data related to this.

a. Legal Basis for Data Processing

YouTube is used to help make our website appealing. This constitutes a justified interest pursuant to Art. 6 para. 1 lit. f EU-GDPR.

b. Possibility of Objection and Removal

You can prevent the association of your browsing behaviour with your personal profile by logging out of your YouTube account.

Further information about handling user data, can be found in the data protection declaration of YouTube under https://www.google.de/intl/de/policies/privacy.

10. Direct Marketing

a. Legal Basis for Data Processing

The legal basis for processing your personal data as part of direct marketing by post is Art. 6 para. 1 lit. f EU GDPR.

b. Purpose of Data Processing

The purpose of processing your personal data as part of direct marketing by post is to promote turnover generated by selling goods or services. This purpose reflects our legitimate interest in the data processing in accordance with Art. 6 para. 1 lit. f EU GDPR.

c. Duration of Storage

Your personal data are deleted as soon as they are no longer required to achieve the purpose of their collection or you object to the processing for this purpose.

d. Possibility of Objection and Removal

You can object to the processing of your personal data for this purpose at any time with effect for the future by informing us. The information of your objection will be stored in our systems.

11. Legal Defence and Law Enforcement

a. Legal Basis for Data Processing

The legal basis for processing your personal data as part of a legal defence and law enforcement is Art. 6 para. 1 lit. f EU GDPR

b. Purpose of Data Processing

In certain cases it may be necessary for us to process your personal data in the context of legal defence and enforcement for the purpose of defence against unauthorized use and the legal enforcement of claims and rights. For this purpose, it is our legitimate interest to process data pursuant to Art. 6 para. 1 lit. f EU-GDPR

.

c. Duration of Storage

Your personal data are erased as soon as they are no longer required to achieve the purpose of their collection.

d. Possibility of Objection and Removal

The processing of your personal data in the context of legal defence and law enforcement is mandatory for legal defence and law enforcement. It is therefore not possible to object to this.

12. Categories of Recipients

Within our company, those departments receive personal data which they need to fulfil the purposes mentioned above. For certain activities, we hire different service providers and, in some cases, transfer your personal data to other trusted recipients. These recipients are for example:

  • Affiliated companies of Selecta
  • IT service providers
  • Banks
  • Debt collection companies
  • Credit agencies
  • Authorities
  • Tax consultants and tax auditors
  • Lawyers and courts

13. Rights of the Data Subject

If we process your personal data, you are the data subject within the meaning of EU GDPR and you have the following rights in relation to us:

a. Right of Access (Art. 15 EU-GDPR)

You have the right to obtain confirmation from us as to whether or not personal data which concern you are being processed. If this is the case, you have the right to access to your personal and the following information:

  • the purposes of data processing;
  • the categories of personal data concerned;
  • the recipients resp. the categories of recipients to whom your personal data have been or will be disclosed;
  • the envisaged period for which your personal data will be stored or, if this specific information is not possible, the criteria used to determine that period;
  • the rights you are entitled to in this case: The right of rectification or erasure of your personal data, the right of restriction of processing or the right of objection to processing;
  • the right to lodge a complaint with a supervisory authority.
  • all available information about the source of the data, if the personal data have not been collected from you;
  • whether there is a process for automated decision-making including profiling according to Art. 22 para. 1 and 4 of the EU GDPR and, at least in these cases, meaningful information about the logic involved and the consequences and intended effects of such processing on you;
  • whether your personal data are transferred to a third country or an international organization. In this context you may request information on the appropriate safeguards pursuant to Art. 46 EU GDPR relating to this transfer.

Please find below further information to your rights.

b. Right to Rectification (Art. 16 EU-GDPR)

You have a right of rectification and/or completion in relation to us if the processed personal data concerning you is incorrect or incomplete. We must immediately make the correction.

c. Right to Restriction of Processing (Art. 18 EU-GDPR)

You may request the restriction of the processing of personal data, if:

  • you contest the accuracy of the personal data for a period that allows us to verify the accuracy of the personal data;
  • the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
  • we no longer need the personal data for processing purposes, but they are required by you for the establishment, exercise or defence of legal claims or
  • you have objected to processing pursuant to Art. 21 para. 1 EU-GDPR and it has not yet been determined whether our legitimate grounds overweigh your legitimate grounds.

If the processing of your personal data has been restricted, these data may be stored, except for their storage, only with your consent or to establish, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing according to the above-mentioned conditions has been restricted, we will inform you before the restriction is lifted.

d. Right to Erasure (Art. 17 EU-GDPR)

i. Erasure Obligation

You have the right to demand erasure of personal data concerning you and we are obliged to erase these data immediately, if:

  • the personal data concerning you are no longer necessary for the purposes for which they were collected or processed,
  • you withdraw your consent on which the processing is based pursuant to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a EU-GDPR and there is no other legal basis for processing the data.
  • you object to the processing pursuant to Art. 21 para. 1 EU-GDPR and there are no overriding legitimate grounds for the processing or you object to the processing pursuant to Art. 21 para. 2 EU-GDPR,
  • your personal data have been unlawfully processed,
  • the erasure of your personal data is necessary to comply with legal obligations in EU or Member State law to which we are subject,
  • your personal data have been collected in relation to information society services offered in accordance with Art. 8 para. 1 EU-GDPR.

ii. Information to Third Parties

Have we made the personal data concerning you public and we are obliged to erase them acc. Art. 17 para. 1 of the EU GDPR, we take appropriate measures, including technical means - taking into account available technology and implementation costs - to inform data controllers who process your personal data that you have requested the erasure of any links to such personal data or copies or replications of such personal data.

iii. Exceptions

The right to erasure does not apply to the extent that processing is necessary for:

  • exercising the right of freedom of expression and information;
  • compliance with a legal obligation which requires processing by EU or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of the official authority vested in us;
  • reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i as well as Art. 9 para. 3 EU-GDPR;
  • archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 EU GDPR insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  • the establishment, exercise or defence of legal claims.

e. Right of Information (Art. 19 EU-GDPR)

If you have claimed against us the right to rectify, delete or restrict the processing, we are obliged to notify all recipients to whom your personal data have been disclosed of this correction or deletion of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort. You have the right to be informed about those recipients.

f. Right of Data Portability (Art. 20 EU-GDPR)

You have the right to receive your personal data, which you have provided us, in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit this personal data provided to us to another controller without hindrance by us, if

  • the processing is based on consent pursuant to Art. 6 para. 1 lit. a EU-GDPR or Art. 9 para. 2 lit. a EU-GDPR or on a contract pursuant to Art. 6 para. 1 lit. b EU-GDPR and
  • the processing is carried out by automated means.

In exercising this right, you also have the right that your personal data are transmitted directly by us to another controller, as far as this is technically feasible. Freedoms and rights of other persons may not be affected.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority that has been delegated to us.

g. Right to object(Art. 21 EU-GDPR)

At any time, you have the right, for reasons that arise from your particular situation, to object against the processing of your personal data, which pursuant to Art. 6 para. 1 lit. e or f EU-GDPR takes place; this also applies to profiling based on those provisions.
We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, pursuing or defending legal claims.
If your personal data are processed for purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling when it is associated with such direct mail.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
Regardless of Directive 2002/58 / EC, you have the option, in the context of the use of information society services, of exercising your right to opt-out by means of automated procedures that use technical specifications.

h. Right to object to the Data Protection Declaration of Consent

You have the right to withdraw your data protection declaration of consent at any time for the future. The revocation of your consent does not affect the lawfulness of the processing that took place based on the consent up to the time of revocation.

i. Automated Decision on an Individual Basis Including Profiling (Art. 22 EU-GDPR)

You have the right not to be subject to a decision based solely on automated processing - including profiling - that will have legal effect or similarly significantly affects you.
This does not apply if the decision

  • is required for the conclusion or performance of a contract between you and us,
  • is permitted by Union or Member State law to which we are subject, and which contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
  • with your explicit consent.

However, these decisions must not be based on special categories of personal data under Art. 9 para. 1 EU GDPR, unless Article 9 para. 2 lit. a or g EU-GDPR applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.
With regard to the cases referred to above, we will implement suitable measures to protect the rights and freedoms and your legitimate interests, including at least the right to human intervention by us, and to express our own point of view and to contest the decision.

j. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority, in particular in the Member State of your place of residence, employment or the place of the alleged infringement, if you think that the processing of your personal data violates the EU-GDPR. Our competent supervisory authority is:

Agencia Española de Protección de Datos
Calle Jorge Juan, 6
28001-Madrid
Tel. +34 901 100 099/+34 912 663 517

The supervisory authority to which you have lodged a complaint informs you of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 EU GDPR.

If you have any questions, please do not hesitate to contact our data protection officer.