Privacy policy

3.1 Data controller

MASET DE RATERA, SOCIEDAD LIMITADA, NIF B13962725, with registered address at Camino de la Ratera, 22, 08732 Castellví de la Marca (Barcelona), España, is the controller of the processing described in this policy. Data protection contact: succulon@gmail.com.

3.2 Data processed, purpose, legal basis and retention

A. User account

The data processed are first name, surname, email address, a password protected by WordPress, optional telephone number, country, botanical preferences, newsletter and order-alert choices, and the date on which the privacy policy and terms were accepted. The purposes are to create and administer the account, authenticate access, store preferences and provide the requested functions.

The legal bases are taking pre-contractual steps or providing the requested account service, consent for optional communications, and legitimate interests in protecting the service. Data are retained while the account remains active and are subsequently restricted for the periods required to address obligations or liabilities.

B. Contact form

The data processed are name, email, subject, message, language and evidence of the acceptance displayed on the form. The purposes are to respond to the enquiry and manage the requested relationship. The legal basis is consent and, where an enquiry concerns a possible contractual relationship, taking pre-contractual steps. As a proposed operating policy, closed enquiries will be deleted or anonymized within a maximum of 12 months unless they must be retained because of an active relationship, complaint or legal obligation.

C. Alerts and marketing communications

The data processed are email address, language, interest categories and evidence of consent. The purpose is to send only the selected alerts. The legal basis is consent, which may be withdrawn at any time through the mechanism included in the communication or by writing to succulon@gmail.com. After an unsubscribe request, a minimal suppression record may be retained to prevent further messages and demonstrate compliance.

D. Security, operation and preferences

The data processed may include IP address, date and time, technical identifiers, browser, security events, language, session, cookie consent and locally stored browsing interests where the person authorizes this. The purposes are to maintain security, prevent abuse, remember preferences and measure the service only where consent is required and has been given. The legal bases are legitimate interests in security, legal compliance and consent for non-essential technologies. Security logs will be retained for the minimum period compatible with investigating incidents; an ordinary maximum of 12 months is proposed, subject to validation by counsel and the hosting provider.

E. Future orders and payments

Checkout and payments are blocked. If ecommerce is activated after the corresponding controls, billing, delivery, order, traceability, complaint and payment-reference data may be processed. Before activation, this policy will be updated with the actual providers, legal bases, transfers and retention periods. SUCCULON does not need to store full payment-card data.

3.3 Mandatory data and consequences

Fields marked as mandatory are required for the requested function. If they are not provided, the account cannot be created, the enquiry cannot be sent or the relevant alert cannot be registered. Newsletter and marketing-preference options must be separate, voluntary and not preselected.

3.4 Recipients and processors

Data may be processed by providers supplying WordPress/Elementor hosting, maintenance, security and email delivery through Elementor Site Mailer and its subprocessors. Data will be disclosed to authorities only where a legal obligation applies. While catalog mode remains active, order data will not be disclosed to carriers and payment data will not be disclosed to payment providers because those operations are not enabled.

3.5 International transfers

Some technology providers or their subprocessors may operate outside the European Economic Area. Before this policy is published as final, SUCCULON must verify contracts, locations and applicable mechanisms, such as adequacy decisions or standard contractual clauses. No specific safeguard will be claimed without contractual evidence.

3.6 Rights

Data subjects may request access, rectification, erasure, objection, restriction and portability, and may withdraw consent without affecting prior lawful processing. Requests may be sent to succulon@gmail.com, stating the right being exercised and the information necessary to identify the account or interaction. Additional documentation will be requested only where necessary to verify identity.

A complaint may also be lodged with the Spanish Data Protection Agency at https://www.aepd.es. Exercising rights is free of charge, except for manifestly unfounded or excessive requests under the conditions permitted by law.

3.7 Minors

The website is not specifically directed at minors and does not seek to obtain their data for marketing. If an account or consent that does not meet the legal requirements applicable to minors is detected, measures will be taken to verify the situation and restrict or erase the relevant data.

3.8 Security and automated decisions

Access control, authentication, logging, backup and data-minimization measures proportionate to the risk are applied. Personalizing the order of certain products may use interests stored in the browser, but it does not produce legal effects or decisions of similarly significant importance. No advertising profiling is carried out without consent.

3.9 Policy changes

Material changes will be published with a new version and date. Where a change affects the basis of processing or requires new consent, that consent will be requested before the change is applied.