- Identification of the Data Processor
- Group subsidiaries
- Purpose and legitimising basis of the treatments
- Obligation to provide data
- Recipients of your data
- Security measures
Identification of the Data Processor
The data provided by the user will be processed by SCANBUY RETAIL, with registered office at Calle José Castán Tobeñas 1, 28020, Madrid, and tax identification number A-88093232 (hereinafter the “Responsible Party”) and other subsidiaries of the SCANBUY GROUP for the purposes set out in section 3. You may contact the Person Responsible through the email of the data protection officer email@example.com.
- SCANBUY SPAIN, S.L. with registered office at Calle José Castán Tobeñas 1, 28020, Madrid, and CIF B87664967.
- SCANBUY INC. with registered office at 10 East 39th Street, 10th Floor, New York City, NY 10016 and VAT no. E1610134160561
Purpose and legitimising basis of the treatments
Below, we provide details about the purposes of the processing carried out by the Data Processor, the legitimising bases and the period of conservation of the data.
- To answer the questions that the data subject sends to the Data Processor.
- Legal basis: Consent of the data subject.
- Period of conservation: The data shall be kept until the issue raised by the data subject has been resolved and for five (5) years to deal with the formulation, exercise or defence of claims.
- Provision of the dcoupon service described in the Conditions of Use:
- Manage the user registration of the interested party through the registration form.
- Generate the coupons chosen by the user and provide anonymised history information to manage the correct redemption of coupons to:
- The distributors of retail products, such as supermarkets where the interested party redeems the coupon.
- Manufacturers and brands of the consumer products for which the person generates the coupon or their agencies.
- Keep a history of the coupons generated and redeemed.
- Retention period: The personal data provided will be kept for the duration of the contractual relationship with the interested party and for five (5) years to deal with the formulation, exercise or defence of claims.
- Legal basis: Execution of a contract.
- Elaboration of profiles on the preferences of the interested party. The person in charge carries out the elaboration of profiles, based on automated processing according to the coupons and other promotions chosen by the interested party, aimed at evaluating the preferences of the interested party with regard to consumer products.
- Legal basis: Legitimate interest of the person responsible.
- Foreseen consequences: the processing of the data does not foresee any consequences that could have any legal effect or in any other way that could significantly affect the data subject. The service offered is not altered in the event that the user does not consent to such processing.
- Logic used: an automated procedure is used to process the data, where all the coupons downloaded and redeemed are filtered in order to classify the interested party according to his/her circumstances and preferences (age range, place of purchase, type of products purchased, monthly expenditure in the supermarket or pharmacy, etc).
- Data retention criteria: data relating to profiling will be retained for a maximum period of one year from the last update. In this sense, after this period without updating your data, the information will be blocked in such a way that it will not be available to companies. Once three years have passed without updating the information, the data will be deleted, guaranteeing full respect for confidentiality, both in processing and in subsequent destruction.
- Submit personalised promotional information about coupons, offers or promotions from third parties published on dcoupon, by means of e-mail and notifications in the Apps themselves.
- Legal basis: express consent of the interested party.
- We inform you that you may withdraw the consent given at any time, without affecting the legality of the processing carried out previously by the Data Processor.
- Storage period: The personal data provided by the user will be kept as long as he/she does not withdraw his/her consent.
- Drawing up of statistics relating to the association and redemption of coupons by the interested party. These statistics include information about when and where a coupon was associated to the account of the interested party, as well as when and where each coupon was redeemed.
- Retention period: The personal data provided will be kept for the duration of the contractual relationship with the data subject. Once the relationship has ended, the data will be subject to anonymization operations and will be kept by the Data Processor.
- Legal basis: Execution of a contract. Compatible purpose.
- Assessment and management of the job application for the selection and contracting of personnel, in order to offer positions that fit your profile.
- Legal basis: Consent of the interested party.
- Period of conservation: the personal data will be conserved for a maximum period of one year.
- Geolocation of the data subject.
- Legal basis: Consent of the data subject. The data subject may authorise or activate the geolocation permit so that, by means of its location, the nearest dcoupon establishments are shown to him/her.
- Period of conservation: the personal data will be conserved for a maximum period of one year.
Obligation to provide data
By marking the corresponding boxes and entering data in the fields marked with an asterisk (*) on the contact form or presented on download forms, the USERS expressly accept, freely and unequivocally, that their data are necessary to attend to their request, on the part of the provider, the inclusion of data in the remaining fields being voluntary. The USER guarantees that the personal data provided to the RESPONSIBLE are true and is responsible for communicating any changes to them.
The DATA PROCESSOR OFFICER informs that all the data requested through the website are compulsory, as they are necessary to provide the USER with an optimum service. In the event that all the data are not provided, it is not guaranteed that the information and services provided will be completely adapted to your needs.
Recipients of your data
The Data Processor Officer contracts with third parties in charge of processing the data in order to provide its services. Specifically, the Data Processor has signed agreements with the following service providers:
- SCANBUY INC.
- Amazon Web Services EMEA SARL (AWS).
- The Rocket Science Group (Mailchimp)
- Hubspot, INC
- Microsoft 365
- AVIVA VOICE SYSTEMS & SERVICES, S.L.
- Mapp Digital c/o Webtrekk GmbH
- Google Analytcs, Google Ads, and Firebase
In addition, we inform the interested party that their data relating to registration (treatment no. 2) and those relating to the allocation and redemption of coupons may be communicated in an anonymous form (that is, without the data being associated with their identity through the use of encryption techniques on the user ID, providing a different encryption for each recipient of the data) to the following categories of recipients:
- Retailers of products, such as supermarkets where the person redeems the coupon.
- Manufacturers and brands of the consumer products for which the coupon is generated by the data subject or their agencies
Please note that this communication is not a block transfer. The communication to any one recipient will depend on the recipient’s coupons that the individual associates with his or her user account. For example, if brands A and B each issue a coupon on our platform and the person concerned associates brand A with his or her account, we will only communicate the details of the association of this coupon with his or her user account to brand A. The third party will not receive your name and email address, just a hash of your user ID.
With the exception of the above-mentioned entities, your data will not be communicated to other third parties. If for any reason it is necessary to communicate such data to third parties, you will be informed beforehand and, where appropriate, asked for your consent and the purposes of the communication and the identity of the third party to whom it is to be communicated will be specified.
All of the above, with the exception of those cases in which a legal requirement obliges the communication of such data to a third party.
Persons who provide us with their data have the following rights in relation to their data:
- Right of access: Any person has the right to obtain confirmation from the responsible person whether or not personal data concerning him or her is being processed and, if so, the right to access the personal data.
You can exercise this right by logging into your user account, in the “My Account” section.
- Right to rectification: This is the right to obtain the rectification of personal data held by us and concerning you.
You can exercise this right by logging into your user account, in the “My account” section, and clicking on the “Delete my account” tab.
- Right to erasure: This is the right to obtain the deletion of your personal data.
You can exercise this right by logging into your user account, in the “My account” section.
- Right to restrict processing: This is the right to have your data no longer subject to the corresponding processing operations when one of the following conditions is met:
- When you have exercised your rights to rectification or objection and the Dara Processor is in the process of determining whether the request is appropriate.
- If the data processing is unlawful, which implies the deletion of the data, but you do not wish your data to be deleted by the Data Processor.
- If the data are no longer necessary for processing, which implies deletion of the data, but you wish the Data Processor to limit the processing of the data and to keep them in order to be able to formulate, exercise or defend against claims.
You can exercise this right by sending an e-mail to our address firstname.lastname@example.org.
- Right to data portability: This is the right to obtain from the Data Processor, in case of automatic processing of your data, a copy of these data in a structured format, for common use and mechanical reading or that this copy is directly transmitted to the Data Processor you indicate. Please note that this right does not apply to:
- The data of third parties that you have provided to the person in charge.
- Data related to you but provided to the Data Processor by third parties.
- Right to object: This is the right to object to the processing of your personal data. With regard to the processing carried out by the Data Processor, you may object to the sending of commercial communications both by yourself and by third parties.
To do so, you must log in to your user account, in the “My Account” section, and configure your options.
If you wish to obtain more information about your rights, we suggest that you visit the website of the Spanish Data Protection Agency (See LINK here).
In addition, we inform you about the possibility of filing a complaint with the competent Control Authority, in this case the Spanish Data Protection Agency, especially in the event that you have not been satisfied with the exercise of your rights. You may contact the Spanish Data Protection Agency by telephone on 901 100 099 and 912 663 517 or by visiting them at their address at C/ Jorge Juan, 6. 28001 – Madrid.
In accordance with the provisions of the regulations in force on personal data protection, the Data Processor undertakes to comply with all the applicable legal provisions, in particular with the GDPR and the LOPDGDD for the processing of personal data for which he is responsible, and clearly with the principles described in article 5 of the GDPR, by which they are processed in a lawful, loyal and transparent manner in relation to the data subject and are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
The Responsible Party guarantees that it has implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of USERS and has communicated to them the appropriate information to enable them to exercise these rights.
For further information on the guarantees of privacy, please contact the Person in Charge at SCANBUY RETAIL S.A., Calle José Castán Tobeñas, 1 – 28020 Madrid (Madrid) or send an e-mail to: