In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

This policy explains how CURTIDOS BADIA, S.A.U. processes and uses personal data supplied by its customers and/or users, both professionals (B2B) and end consumers (B2C), regardless of the collection channel, including the website, online store, telephone, email or in person.

This Privacy Policy may be updated at any time to reflect regulatory changes or strengthen security. CURTIDOS BADIA, S.A.U. will duly notify customers and users of any changes made to the processing of their personal data.

For this Privacy Policy, a “User” means any natural person interested in the products and services offered by CURTIDOS BADIA, S.A.U. through any available channel, including the online store at curtidosbadia.com.

1. Data controller

2. Purposes and legal bases for processing

2.1 Order management and contractual relationship (e-commerce)

We process the buyer’s name, company or business name, tax ID/VAT number, shipping and billing addresses, email address and telephone number to manage orders placed through curtidosbadia.com, issue invoices and send communications about order and shipping status.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.2 Provision of services and contractual relationship (traditional channel)

We process the data strictly necessary to perform contracts, agreements or instructions formalized by any legally accepted means in connection with CURTIDOS BADIA, S.A.U.’s business activities—the preparation, tanning and dyeing of hides and skins—and to communicate information about contracted or requested products and services.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.3 Shipping and logistics management

The recipient’s delivery address and contact details are disclosed to the carrier and/or logistics operator acting as processor solely to deliver orders placed through curtidosbadia.com.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.4 Payment management

Payment data is processed by Redsys Servicios de Procesamiento, S.L. / Comercia Global Payments EP S.L. and CaixaBank S.A., the secure payment platform acting as processor under Article 28 GDPR. CURTIDOS BADIA, S.A.U. does not store bank-card details or payment credentials.

Under the contract with Comercia Global Payments EP S.L.: personal data received from third parties is processed solely for payment-service purposes and disclosed only where required by the service; data is retained while authorizations or contractual relationships remain in force and subsequently for the limitation period applicable to claims arising from the service, solely to meet legal obligations; and data subjects may exercise access, rectification, erasure, restriction, objection and portability rights at www.comerciaglobalpayments.com/ejerciciodederechos, www.caixabank.com/ejerciciodederechos or through CaixaBank digital banking.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.5 Commercial and advertising communications and mailings

With the user’s express consent, we process data to send commercial, advertising and informational communications about CURTIDOS BADIA, S.A.U. products, news, offers and activities through any channel, including newsletters and email campaigns. This applies worldwide to professional customers (B2B) and end consumers (B2C).

Express consent is not required where the user freely and voluntarily supplied the data through forms provided for this purpose, or where the content forms part of services previously contracted. Consent remains valid after the relationship with CURTIDOS BADIA, S.A.U. ends, without prejudice to the data subject’s rights.

Users may withdraw consent at any time by using the unsubscribe link in each email or by writing to online@curtidosbadia.com with the subject “Unsubscribe from commercial communications”.

Commercial communications and mailings are managed through Clientify, a CRM and marketing-automation platform acting as processor under Article 28 GDPR. Clientify S.L. processes the user’s contact details—name, email and website-behavior data—solely to manage campaigns authorized by CURTIDOS BADIA, S.A.U.

Legal basis: consent (Article 6(1)(a) GDPR).

2.6 Compliance with legal obligations

We process data required to comply with applicable tax, accounting and legal obligations, including retaining invoices and transaction records under Spanish and international tax rules.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

How long do we retain personal data?

Personal data is retained for the duration of the contractual relationship with CURTIDOS BADIA, S.A.U. and/or for as long as the purpose for which it was provided remains in effect.

Order and transaction data is retained for at least ten (10) years from the transaction date in accordance with applicable tax and commercial regulations.

Newsletter and commercial-communication subscriber data is retained while the subscription remains active and until the data subject requests to unsubscribe.

3. Recipients of the data

Data processed by CURTIDOS BADIA, S.A.U. is used by assigned company professionals for correct management and provision of services. They have appropriate access authorization and are subject to effective protection and confidentiality controls.

Where appropriate, personal data may be disclosed to:

• Companies owned by and/or in which CURTIDOS BADIA, S.A.U. holds an interest, for correct delivery of services and information, commercial and promotional activities.
• United Parcel Service España Ltd y Compañia Src (UPS), or another authorized carrier/logistics operator: recipient shipping and contact data for e-commerce deliveries.
• Redsys Servicios de Procesamiento, S.L. / Comercia Global Payments EP S.L. / CaixaBank S.A.: payment data for secure transaction processing through the virtual POS. Transaction data may be disclosed to authorities or official bodies in or outside the EU to combat terrorism, money laundering and serious organized crime, under applicable law or agreements.
• Clientify S.L. (CRM and email marketing): contact management, newsletters, commercial communications and digital-marketing campaign tracking.
• CURTIDOS BADIA, S.A.U.’s tax and accounting advisers: billing data required for legal compliance.
• Public bodies, courts, police and administrative authorities where a certified legal obligation exists.
• Partners and providers that need access to personal data as processors when providing outsourced services.

CURTIDOS BADIA, S.A.U. enters into an Article 28 GDPR processing agreement with each relevant partner or provider. Processing is limited to agreed purposes and company instructions, appropriate technical and organizational measures must be applied, access is limited to what is strictly necessary, authorized personnel are bound by secrecy and confidentiality, and data must be returned and/or deleted when the service ends.

The principal processors and services include:

Customer personal data is not transferred or disclosed to third countries for commercial purposes. For international shipments outside the European Economic Area, strictly necessary delivery data is provided to the relevant carrier with appropriate safeguards under Article 46 GDPR.

4. Users’ rights

CURTIDOS BADIA, S.A.U. informs Users that they may exercise rights of access, rectification, objection, erasure, portability and restriction of processing, and may object to automated profiling of personal data collected by the company.

These rights may be exercised free of charge by the user or a representative through a signed written request sent by post to CURTIDOS BADIA, S.A.U., C/ Sol, number 52, 08700 Igualada (Barcelona), Ref. “Data protection”; or by email to online@curtidosbadia.com with the subject “Data protection”.

The request must state the user’s full name, notification address and specific request, and include a copy of the national identity document or passport. Representation must be proven by a reliable document. Email is recommended for faster handling.

5. Source of the data

Data supplied to CURTIDOS BADIA, S.A.U. may come from:

• Information supplied when placing an order through curtidosbadia.com.
• Information supplied when subscribing to newsletters or commercial communications through website forms.
• Information supplied when entering into a service contract with CURTIDOS BADIA, S.A.U.
• Information supplied when accepting a fee quotation that constitutes a service commitment.
• Information supplied when placing a specific instruction, including a verbal order, for products or services offered by CURTIDOS BADIA, S.A.U.
• Contact with the company by email, in person or by telephone for any reason relating to its activity.
• An in-person or telephone inquiry.
• A complaint, claim or suggestion.

Users receive all information concerning processing under this Privacy Policy and may be offered the option to give express consent for processing for purposes other than the main purposes.

6. Minimum age

CURTIDOS BADIA, S.A.U. services, website and online store are not directed at anyone under 18. By accepting this Privacy Policy and/or placing an order, users represent and warrant that they are at least 18 years old. Exceptional services for minors require all authorizations and consents from parents or legal guardians required by applicable law.

7. Confidentiality and security safeguards

CURTIDOS BADIA, S.A.U. undertakes to comply with its duty of confidentiality and to adopt measures necessary to prevent unauthorized alteration, loss, processing or access in accordance with applicable regulations.

Technical and organizational security measures are implemented with regard to the state of technology, the nature of stored data and risks arising from human action or the physical or natural environment.

To strengthen confidentiality and integrity, the company continuously supervises, controls and evaluates its processes in line with international standards. Personal data is processed confidentially and subject to secrecy, with technical and organizational measures appropriate to the risk.

8. Use of cookies

curtidosbadia.com uses first-party and third-party cookies required for correct operation of the website and WooCommerce store and for statistical browsing analysis. For details of the cookies used, their purposes and management options, see the Cookie Policy available on the website.