Privacy policy

At EURO OUTLET CLUB we process the personal data of our customers and users in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD). This policy describes how, why and with what safeguards we process your data when you buy from or browse our online shop.

1. Data controller

• Identity: SENIOR ONLINE WORLD IO, S.L.
• Privacy contact address: soporte@eurooutletclub.com

2. Data we process

We only process the categories of data we need in order to serve you:

• Identification and contact data: first name and surname, email address and telephone number.
• Delivery data: postal address, postcode, town and province, together with any delivery instructions you give us.
• Order data: items, sizes, amounts and order reference.
• Account data: if you register, your email address and your password, which is stored encrypted and to which we have no access.
• Technical data: your IP address, which we use on a transient basis to limit the number of orders per minute and to prevent abuse and fraud.

All the data requested in the order form is mandatory: without it we cannot prepare or deliver your purchase, and we would therefore be unable to enter into the contract. Delivery instructions and registering an account are voluntary, and not providing them has no consequences. We do not process special categories of data, nor do we take automated decisions or build profiles from your information.

3. Purposes of the processing

We process your personal data for the following purposes:

• Order management: processing the purchase, preparing and dispatching the order, handling cash-on-delivery payment and dealing with delivery, exchange or return incidents.
• User account: if you create an account, managing your registration, authentication and order history.
• Customer service: answering your enquiries, complaints or requests relating to your orders or to the exercise of your rights.
• Transactional communications: sending you the emails required to perform the contract (order confirmation, dispatch notice, returns handling).

We do not use your data for marketing or advertising purposes unless you have expressly consented to it through a channel provided for that purpose.

4. Legal basis

The legal basis for this processing is, depending on the case:

• The performance of a contract (art. 6.1.b GDPR) for order management, the user account and the customer service arising from a purchase.
• Compliance with legal obligations (art. 6.1.c GDPR) in commercial, accounting and tax matters, which requires us to keep sales records for the periods set out in section 7.
• Our legitimate interest (art. 6.1.f GDPR) in preventing fraud and abuse of the shop, which covers the transient processing of your IP address in order to limit how often orders can be placed.
• The data subject's consent (art. 6.1.a GDPR) for any additional processing that may be specifically requested, such as sending commercial communications.

5. Recipients of the data

Your data is not disclosed to third parties except where required by law. However, in order to provide the service, certain suppliers access strictly the data they need in their capacity as processors, under a contract guaranteeing the confidentiality and security required by the GDPR:

• Hosting provider: hosts the technical infrastructure on which the Site runs.
• Courier/transport company: receives the contact details and delivery address needed to get the order to you.
• Transactional email provider: sends the order confirmation, dispatch and after-sales emails on our behalf.
• Database and authentication provider: stores the orders and, if you register, manages your account credentials and session.

6. International transfers

Some of the suppliers acting as processors — specifically those providing hosting, database and authentication, and transactional email — are companies established outside the European Economic Area, mainly in the United States, or may access the data from there in order to provide the service. In those cases the transfer relies on one of the safeguards provided for in Chapter V of the GDPR: the adequacy decision for the EU-US Data Privacy Framework where the provider is certified or, failing that, the standard contractual clauses approved by the European Commission together with any supplementary measures that may be necessary.

You may request further information about these transfers and a copy of the safeguards applied by writing to soporte@eurooutletclub.com.

7. Retention periods

The data associated with an order will be kept for as long as necessary to manage the commercial relationship and, thereafter, for the limitation periods of the legal, tax and accounting liabilities that may arise from the purchase (as a general rule, up to 6 years for commercial and tax purposes). Your user account data will be kept for as long as your account remains active; if you ask us to close it, the data will be deleted or blocked, unless there is a legal obligation to retain it.

8. Your rights

As a data subject, you may exercise the following rights at any time:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request the deletion of your data when it is no longer necessary.
• Objection: to object to a particular processing of your data.
• Portability: to receive your data in a structured, commonly used format.
• Restriction: to request that the processing of your data be restricted in certain cases.

You may exercise these rights by writing to soporte@eurooutletclub.com, stating the right you wish to exercise and attaching a copy of a document proving your identity.

9. Complaint to the supervisory authority

If you consider that the processing of your personal data does not comply with the legislation in force, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency), through its official website (www.aepd.es), particularly if you have not obtained satisfaction in the exercise of your rights.

10. Security measures

We apply reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or alteration, appropriate to the risk of the processing.