This Privacy Policy has been developed taking into account the provisions of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, “LOPD GDD”), as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons (hereinafter, “GDPR”).

This Privacy Policy aims to inform data subjects, from whom information is being collected, about specific aspects related to the processing of their data, including the purpose of the processing, possible recipients of the data, the rights of the data subjects, the retention periods for the information and security measures.

DATA CONTROLLER

Proyecto Japonarte SL

CIF: B57773624

DOMICILIO SOCIAL: C/ Caro 11, Palma de Mallorca, Illes Baleares, España

CORREO ELECTRÓNICO: info@urbansushi.es

TELÉFONO: 971730000

DATA CONTROLLER

Only personal data strictly necessary to identify and respond to the request made by the data subject (hereinafter, the “Data Subject”) will be requested. This information will be processed fairly, lawfully, and transparently in relation to the Data Subject. Furthermore, personal data will be collected for specific, explicit, and legitimate purposes and will not be further processed in a manner incompatible with those purposes.

The data collected from each Interested Party will be adequate, relevant and not excessive in relation to the corresponding purposes in each case and will be updated whenever necessary.

The data subject will be informed, prior to the collection of their data, of the general points regulated in this Policy, so that they can give express, precise and unequivocal consent for the processing of their data, in accordance with the following aspects:

• Purposes of the treatment:
  • Order processing and management for orders placed through the Website: the personal data collected will be processed for the purpose of contacting the Data Subject in order to properly process and manage orders placed through the Website. The legal basis for this processing purpose arises from the contractual relationship with the Data Subject.
  • Order tracking service: We will process your data to keep you informed, via electronic means, of the status of your order. The legal basis for this processing arises from the contractual relationship with you.
  • Handling complaints, claims or suggestions: we will process your data in order to properly handle them based on the contractual relationship derived from the contracted service.
  • Sending commercial communications: will manage the sending of commercial communications regarding its products, promotions and/or services (via email), based on legitimate interest and in accordance with Article 21.2 of Law 34/2002, of July 11, on information society services and electronic commerce, through the express consent of the Interested Party by checking the box accepting commercial communications.
  • Sending personalized offers: will manage the sending, via email, of personalized offers based on the profile of the Interested Party's data from the study and segmentation of personal and commercial information, based on legitimate interest, through the express consent of the Interested Party by checking the box accepting commercial communications.
  • Social media login: If the customer is a member of a social network, they can use the "Login" feature of that social network as an alternative to logging into the Website using the data provided by the social network. The data shared with the social network will be the customer's public social profile information. GZP may process this data, based on legitimate interest, for the purposes of managing the customer's relationship as a Website User and for the analysis and processing of their personal data.
  • Request for information for opening Franchises: will manage the request for information from the Interested Party for opening a Franchise when they provide their data through the Form collected in the "Franchise" section of the Website.
• Legitimation: As a general rule, prior to processing personal data, express and unequivocal consent is obtained from the data subject through the inclusion of informed consent clauses. However, if the data subject's consent is not required, the legal basis for the processing is detailed in each of the processing purposes described above.
• Recipients: We inform you that, as the owner of the ‘Urban To Go – Fast and Timely Home Delivery Sushi in Palma’ brand, we may grant a franchise of said brand to other companies for the purpose of its management by the franchisee. Therefore, if you place an order with a franchised establishment through the Website, the personal data you provide will be shared with that establishment so that it can process your order, handle any suggestions and/or complaints you may have, and send you marketing communications or personalized offers. Furthermore, to carry out all the purposes described above, we may collaborate with third-party service providers who may have access to your personal data as a result of providing the contracted services. In any case, it follows strict criteria for selecting these third parties in order to comply with its data protection obligations and signs its corresponding data protection agreement with them, where these third parties are obliged to comply with their data protection obligations, and specifically, to comply with the legal, technical and organizational measures, the processing of personal data for the agreed purposes, and the prohibition of processing said personal data for other purposes or transfer to third parties.
• Origin: As a general rule, personal data is always collected directly from the Data Subject. However, in certain exceptional cases, data may be collected through third parties, entities, or services other than the Data Subject. In this regard, this fact will be communicated to the Data Subject through the informed consent clauses contained in the different data collection methods and within a reasonable timeframe after obtaining the data, and at the latest within one month.
• Retention periods: The personal data of the Data Subject will be retained for as long as necessary to fulfill the purpose for which it was collected. Once that purpose has been fulfilled, the data will be deleted. This deletion will result in the blocking of the data, which will be retained solely for the use of Public Administrations, Judges, and Courts to address any potential liabilities arising from the processing during the applicable statute of limitations. Once this period has expired, the information will be destroyed.

RIGHTS OF INTERESTED PARTIES

Data protection regulations grant a series of rights to data subjects or owners, users of the Website or users of social media profiles of

These rights that the interested parties have are the following:

• Right of access: the right to contact the data controller to find out if your data is being processed and, if so, to obtain the following information: a copy of the personal data being processed, the purpose of that processing, the categories of data being processed, the recipients or categories of recipients, the retention period, the exercise of your rights, the right to lodge a complaint with a Supervisory Authority, the origin of that data, as well as the existence of automated decisions, including profiling.
• Right of rectification: the right to obtain the rectification of inaccurate personal data, as well as the completion of incomplete personal data.
• Right to object: the right to object to the controller processing personal data in the following cases:
  • When they are subject to processing based on a mission of public interest or legitimate interest, including profiling.
  • When the processing is for the purpose of direct marketing, including profiling.
• Right to erasure: the right to obtain the erasure of data when any of the following circumstances apply:
  • When the data is no longer needed for the purpose for which it was collected.
  • When the data subject withdraws consent, provided that the processing is not based on another legitimate ground.
  • When the interested party objects to the treatment.
  • When personal data has been unlawfully processed.
  • When they must be removed in compliance with a legal obligation.
  • When the data has been obtained in relation to the offer of information society services based on the provisions of Article 8 of the GDPR.
• Right to restriction of processing: the right to obtain restriction of the processing of data when any of the following circumstances apply:
  • When the interested party contests the accuracy of the personal data for a period that allows the company to verify it.
  • When the processing is unlawful and the interested party objects to the deletion of the data.
  • When the company no longer needs the data for the purposes for which it was collected, but the interested party needs it for the formulation, exercise or defense of claims.
  • When the interested party has objected to the processing while it is being verified whether the legitimate grounds of the company prevail over those of the interested party.
• Right to portability: the right to request the portability of your data so that it is sent directly to the entity designated by you in a structured, commonly used, machine-readable and interoperable format, provided that the processing is legitimized based on consent or within the framework of the execution of a contract.

Interested parties may exercise the aforementioned rights by writing to the following address:

Furthermore, it is important to note that the interested party or data subject may contact the Spanish Data Protection Agency at any time, located at C/ Jorge Juan, nº 6, C.P. 28001, Madrid.

SECURITY

The security measures adopted by [Company Name] are those required in accordance with Article 32 of the GDPR. In this regard, [Company Name], taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, has implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

In any case, it has implemented sufficient mechanisms to:

• Ensure the ongoing confidentiality, integrity, availability, and resilience of treatment systems and services.
• Restore the availability and access to personal data quickly, in the event of a physical or technical incident.
• Regularly verify, evaluate and assess the effectiveness of technical and organizational measures.
• Pseudonymize and encrypt personal data, where applicable.

NAVIGATION DATA

Regarding browsing data that may be processed through the Website, if data subject to regulations is collected, it is recommended to consult the Cookies Policy published on this Website.