1: INTRODUCTION AND OVERWIEW

About us and our website

BOJ Olañeta S.L.U. (hereinafter, BOJ), is the owner of this website, with registered office at:

  • BOJ OLAÑETA S.L.U.
  • Matsaria Kalea 21, 20600 Eibar. Gipuzkoa. SPAIN.
  • Tax Identification Number (CIF): B20016333

To contact us, please go to:

Guiding Principles

We take the protection of your information very seriously. Therefore, we take care of the processing of your personal data and comply with the data protection regulations. In order to protect all our web pages from threats in the processing of personal data, all technical and organisational security measures have been implemented. The third parties that collaborate with us in the management of this website, comply with the same guidelines.

Collection of navigation data

You can gain access without revealing your identity to all areas of our website that do not require access keys. Generally, we record any use of our website in order to prevent attacks, fix bugs and investigate any security incident. You can find more information on the collection of navigation data in the section on: “How do we process your data?”.

What authorisations do we have to process your data?

We respect your privacy. For this reason, we only process your personal data when we are authorised to do so. You will find a summary of the different scenarios in which we are authorised to process your personal data at the end of this Data Protection Policy. On the one hand, you can give us your consent for the processing of your personal data, when such processing so requires. In other cases, we process your data because we are legally authorised to do so. If, for example, you place an order on our website, we are authorised to process your data for the execution of that contract. The same applies when you use other services on our website that require your data for the performance thereof. We are also authorised to process your data when our interest in it is legitimate. An example of this is the registering of entries we collect to ensure, for example, that our website operates without faults (including technical maintenance of the website). In any case, we will inform you on the processing of personal data that is carried out, and of course, your rights and interests will always be considered. In case you have any query about your personal data, you will find your data protection rights at the end of this page.

In the next section, you will find a detailed description of the assumptions that allow us to process your personal information. You can find detailed information on the collection, processing and use of your data in the same section of our website (e.g., type, scope and purpose of data processing).

What else should I know?

Users under 16 must only provide their information with the consent of their parents or legal guardians.

Our website may contain links to other pages, which are not managed by us. BOJ is not responsible for the processing of your data on these third-party pages or for the compliance of the latter regarding provisions on data protection. Please consider the Information on Data Protection that they provide.

DATA PROCESSING ON THE WEBSITE

How do we process your data (appearance of the website, connections, cookies, tracking, etc.)?

1. Appearance of the web page, navigation data

To display the web page on your browser, we use multiple devices to ensure that all content (text, images, video, etc.) is always up to date. To ensure that your user experience, in particular the loading speed of the web, is constantly improving, we also use technical service providers that allow us to display the content that is required for the appearance of the web (hereinafter, “Content Distribution Network” or “CDN”). These technical service providers of CDN work in accordance with the instructions of BOJ, having signed with the latter the corresponding Data Controller agreement. The data collected for this purpose may only be used to display the contents of the web page in your browser more quickly and will be deleted immediately after you have accessed the page.

For technical reasons, every time your web browser accesses our website, it automatically sends information to our server (e.g. browsing data). Part of this information is stored in log files, such as:

  • access date
  • access time
  • Page URL
  • HTTP protocol version
  • files accessed
  • volume of data transferred
  • internet browser type and version
  • type of operating system
  • IP address (anonymized)

Navigation data does not include personal data. We only analyse the navigation data when necessary, especially for fixing bugs in the operation of our website or to resolve security incidents. We store this data indefinitely.

Occasionally, we find it necessary to collect the IP address of your device, as well as the navigation data to resolve faults or to keep evidence related to security incidents. This data is eliminated once the fault has been resolved or the security incident has been resolved completely, or if the initial purpose of the processing has ceased to exist for other reasons. In the event of a security breach, we will communicate the relevant connection data to the investigating authorities, whenever necessary and permitted by law.

We store browsing data separately from other collected data related to the use of our website.

2. Register on our website

You can register on our website to use different services. As part of the registration process, we collect and process the following data:

Required data:

  • Processing
  • Name and surname
  • Full address
  • Phone number
  • E-mail address
  • Password

Optional data:

Consent to receive advertising and the possibility of revoking it

We store the data of registered users until the user deletes their account Registered users can delete their account at any time, through the “My Data” section within their user account. The user account also allows the user to modify or delete at any time the information provided at the time of registration.

3. Quick registration (Registration option through a social network)

To register on our website, you can also use the quick registration (through a social network). This option is available on various social networks. To register, you will be redirected to the website of the corresponding social network, where you can register using your access data to said network. This page will link the profile you have on the social network with your user account on our website. On linking, we will automatically receive the data required for registration from your social network. If you want to know which data is communicated to us from the social network when you register, please review the terms and conditions and privacy policy of the social network. We only store and process your name and e-mail address in order to provide our services.

On linking both accounts, you no longer need to additionally register on our website. To do this, a cookie will be installed in your browser and will be used on your next visit to the web.

The purpose of the processing of personal data in this context is to be able to provide the services of our website, specifically, the option of registration through a social network. We store data of registered users until the account is deleted. Registered users can delete their accounts at any time through the “My Data” page. The user account also gives you the option of changing or deleting, at any time, any data that was entered during registration.

9. BOJ blog subscription

Our website offers the option to subscribe to a newsletter with the latest publications of our blog. If you subscribe to receive these newsletters and, therefore, consent to us sending you them, your data will only be used for this purpose and you will not receive any additional communication. We are authorised to process your data in this context with your consent, which you may revoke at any time. Regarding the latter, a link is included on each copy of our newsletters and we will take note of your decision to opt-out in our data base.

11. Participation in promotions / draws

When you register for promotions / draws, we store and use the information you provide us with, to carry out the promotion / draw and to fulfil any later phase thereof. The data we collect for this purpose depends on the registration form on the page of the draw or contest in question.

Your personal data will be deleted when no longer needed for the promotion / draw or for the follow-up thereof.

14. Our pages on Social Networks

The protection of your privacy in the processing of personal data is important to us. We process the personal data transmitted to us and that which is collected during your visit to our respective pages on social networks (for example, Facebook Fanpage, Instagram / Pinterest Page), confidentially and only in accordance with legal provisions.

The Controller for the processing of your data through our pages on social networks is the operator of the corresponding social network (see examples below), together with us. To the extent that the processing of this data takes place within our scope of responsibility, we are at your disposal in all matters relating to data protection and the exercise of your rights in accordance with the content of this information on data protection.

Data processed by the Social Networks provider

The social media service processes your personal data when you access any of our pages. The processing of your data occurs, for example, in the following cases:

  • Viewing a page, post or video from a page
  • Subscribing or unsubscribing from a page
  • Marking a page or message with a “Like” or “Unlike”, or similar functions
  • Recommending a page in an entry or comment
  • Commenting, sharing, or replying to an entry on the page (including the type of reply)
  • Hiding a post on a page or marking a report as spam
  • Clicking on a link to the social network from another website
  • Moving your mouse over the name or image of a profile of a page to view a content preview
  • Using the functions of the social network provider, such as the website, the telephone number, the “Plan route” button or any other button
  • Information on whether the login is carried out via a computer or a mobile device

In the data protection policy of the provider of the social network, you can find out what personal data they collect, how it is processed and what data protection rights you have against said provider. We are not responsible for the processing of data by the social network provider.

Data processed by us

On the website provided by us via the social network, the provider of said network grants us access to the following categories of data:

Statistical analyses which provide information on the use of our web page on the social network. The analyses which are visible to us do not allow us to individually analyse the usage behaviour of individuals. We can only see aggregated data (such as the number of visits, likes, followers, region of origin, age group, gender, etc.) that informs us about our audience and the use of our site. The user data underlying the analyses is not transmitted.

We can segment the target group we want to reach for the social network page or for individual publications. The configuration is based on general parameters (for example, age group, language, region, interest) that can be used to adapt our content to specific groups. It is not possible for us to address or identify individuals based on the data provided by the social network provider.

If you contact us directly through the social network provider or interact with us in any other way, transmitting personal data consciously (for example, via a chat or a direct message with us using the social network), we store and process this personal data for the purposes for which such information was transmitted to us.

We process this data exclusively in order to publicise the content of our social network page to the target group, as well as to better understand and optimise the use thereof.

In addition, we cannot decide on the purpose or the processing of data performed by the social network provider.

To find out what personal data is collected by the social network provider, how they are processed and what data protection rights you have against that provider, see the following data protection guidelines:

a) Facebook Inc. 1601 S California Ave, Palo Alto, California 94304, EE.UU.; http://www.facebook.com/policy.php. Facebook has submitted to the EU-US Privacy Shield.

b) Twitter, Inc. 1355 Market St, Suite 900, San Francisco, California 94103, EE.UU.; https://twitter.com/privacy. Twitter has submitted to the EU-US Privacy Shield.

c) Instagram, provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; https://help.instagram.com/519522125107875

d) Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland;https://policy.pinterest.com/en/privacy-policy

e) Snapchat for the countries of the European Union (EU), the European Economic Area (EEA) and Switzerland: SNAP GROUP LIMITED 7-11 Lexington Street, London, United Kingdom, W1F 9AF. For all other countries: SNAP Inc, 2772 Donald Douglas, Loop North Santa Monica, CA 90405 United States, USA. SNAP is subject to the EU-US Privacy Shield. La SNAP Inc has submitted to the EU-US Privacy Shield.

f) LinkedIn for the countries of the European Union (EU), the European Economic Area (EEA) and Switzerland: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For all other countries: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. The LinkedIn Corporation is subject to the EU-US Privacy Shield.

g) Xing SE, Dammtorstrasse 30, 20354 Hamburg, Germany; https://privacy.xing.com/en/privacy-policy

16. Below, we explain in detail what technologies and providers we use to analyse your user behaviour:

Google Ad Server

We use the online marketing tool Google Ad Server (formerly DoubleClick) of Google LLC,1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”).

Usage data will be deleted after 540 days from the time of collection. For more information on DoubleClick, visit: https://www.google.com/doubleclick Or the Google privacy policy in general: https://policies.google.com/privacy

We use the online marketing tools of Google at our own risk. To this end, we have agreed with Google on a data protection agreement that our customers’ data may only be processed based on our instructions, that it may not be transmitted to third parties and shall be sufficiently protected technically.

Non-acceptance / cancellation: To permanently prevent the collection of data on usage, Google has a plug-in for several web browsers: http://www.google.com/settings/ads/plugin

To disable only interest-based ads, you can block the use of third-party cookies or cookies from the domain “www.googleadservices.com” or disable interest-based ads using this link at: https://www.google.com/settings/ads

Facebook pixels and custom audiences

We use the online marketing tools “Facebook Pixels and Custom Audiences” from Facebook Inc. 1 Hacker Way, Menlo Park, CA 94025, EE.UU. and Facebook Ireland Ltd. 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland, if you are a resident of the EU (“Facebook”).

Facebook processes your data at its own risk as part of Facebook’s data usage policy. You can find information about Facebook ads and Facebook pixels at the following links: https://www.facebook.com/policy and https://www.facebook.com/business/help/651294705016616

Non-acceptance / cancellation: To permanently avoid the collection of data on usage, visit the Facebook data protection policy. As a registered user of Facebook, you can also set what types of ads are displayed within Facebook. To do this, click on the following link: https://www.facebook.com/settings/?tab=ads

Google Ads and Remarketing

This website uses the online marketing tools “Google Ads & Remarketing” of Google LLC,1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”). Google is subject to the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework

We use the online marketing tools of Google at our own risk.

The cookies used in this service generally lose their validity after 30 days and are not meant to identify you personally. Google only provides us with statistical evaluations and processes your information in accordance with Google’s data usage policy. You can find more information at the following link: https://policies.google.com/privacy

Non-acceptance / cancellation: To permanently prevent the collection of data on usage, Google has a plug-in for several web browsers: http://www.google.com/settings/ads/plugin To disable interest-based ads, you can block the use of third-party cookies or cookies from the domain “www.googleadservices.com” or disable interest-based ads through this link at: https://www.google.com/settings/ads https://www.google.com/settings/ads

Interest advertisements can also be disabled via the link: http://www.aboutads.info/choices if the provider has joined the self-regulation campaign: “About Ads”.

18. Social networks and similar networks and services.

The content of our website can be shared on social networks using the Share button. All the buttons that allow content sharing are integrated by using simple links instead of social plugins developed by social network providers. This ensures that your data is not automatically transmitted to social network servers when you access our website. In addition, when you share content on our website, we only transmit to the social network the information necessary to share the corresponding content (for example, the link to the content you want to share). In this context, we do not transfer personal data.

In turn, you can find simple links to our web pages on social networks If you access a link on our website from a social network, or if you enter your social network to share content on our website, your data will be processed by the social network provider in question.

If you are registered and logged into other networks or services that require registration while using our website or some individual functions (for example, Vimeo, YouTube), the respective network / service may collect information about its use or adopt configurations, such as Video playback status. However, this data is solely collected by the respective network / service under its own responsibility for data protection and processed by the corresponding provider.

For more information about the purpose and scope of such data collection, its subsequent processing and use on the part of the social network provider, as well as related rights and adjustment options to protect your privacy, please refer to the Data Protection Information published on the website of the respective provider.

22. Modifications to the Data Protection Policy

This Data Protection Policy has been drafted in view of the current data processing on our web site. In the event of changes in data processing, this data protection information will be updated accordingly. On our website, we always provide you with the latest version of this data protection information so that you can find out about the scope of data processing on our website.

3: USER RIGHTS

Additional information in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND THE COUNCIL of 27 April 2016 concerning the protection of natural persons with regard to the processing of personal data, the free movement of such data and repealing Directive 95/46/EC (General Data Protection Registry – GDPR)

Your rights

Below, there is a description of your rights:

To unsubscribe from receiving promotional communications: If you wish to revoke your consent to receive commercial communications by electronic means, you can use the unsubscribe link at the end of the corresponding email. Or, you can send an email to Data-Protection-EN@BOJg.com with the subject line: “Unsubscribe from receiving commercial communications by electronic means”, in the body of which you indicate your name, surname and email address. Exercising your data protection rights: Please use the following channels: info@bojglobal.com

Right of access to information on your data: Upon your request, we will provide you with information about the data we have about you.

Right of rectification of your data: when you notify us, we will correct any inaccurate personal data concerning you. If you request it, we will fill in the personal data that is incomplete, if it is necessary for the intended purpose for the processing of your data.

Right of deletion of your data: upon your request, we will delete the data we have on you. However, some data will only be deleted after a certain period of conservation, for example, when it must be kept for the fulfilment of a legal obligation, or because we need the data in order to comply with contractual obligations before you.

Right to block your data: In those cases where legislation allows the limitation in the processing of your data, it will be blocked.

Right to withdraw your consent: At any time, you can withdraw the consent given for the processing of your data, with such withdrawal taking effect from that moment. This will not affect the legality of the processing carried out until then.

Right of opposition to the processing of your data: You will have the right to object at any time to having your personal data subject to such processing based on the provisions of article 6, paragraph 1, letters e) and f) of Regulation (EU) 2016/679. In case you object, we will stop processing personal data, provided there are no compelling legitimate reasons to continue with such processing. For us, the processing of your data for direct marketing purposes will never constitute a compelling legitimate reason.

Right to portability: If you request it, we will provide you with the personal data that concerns you in a structured, commonly used and machine readable format.

Right to complain to a supervisory authority: You can file a data protection claim with the competent control authority. To do this, contact the authority responsible for data protection in your place of residence or the data protection authority of our jurisdiction (cited below).

Spanish Agency for Data Protection (AEPD); www.agpd.es

Transmission to recipients outside the EEA

We also transmit personal data to recipients located outside the European Economic Area (EEA), in the so-called third countries. In this case, we make sure – before sharing any data – that the recipient maintains an adequate level of data protection (for example, on the basis of an adequacy decision taken by the EU Commission for the respective country or through the signing of an agreement with EU standard contractual clauses between the European Union and the recipient) or that you have given your consent for such disclosure.

At your request, we will provide you with a list of recipients in third countries and a copy of the specific provisions agreed upon to ensure an adequate level of data protection. To make a request, please use the contact information provided in the section entitled: “Contact information for any matter related to data protection” of this Data Protection Policy.