PRIVACY POLICY

What treatments do we carry out with your personal data?

In compliance with Regulation (EU) 2016/679 and the Organic Law on Personal Data Protection, we inform you that your personal data may be subject to the following treatments:

• TR04 - Advertising campaigns (Legal basis: Law 34/1988, of November 11, General Advertising Law.)

• TR08 - Collecting opinions from interested parties (Legal basis: Regulation (EU) 2016/679 on data protection and LOPD.)

• TR03 - Own staff selection (Legal basis: Royal Legislative Decree 3/2015, of October 23, approving the consolidated text of the Employment Law.)

• TG01 - Own accounting and book management, as the data controller (Legal basis: Royal Decree 1514/2007, of November 16, regulating the General Accounting Plan.)

• TG25 - Data collection for own tax management (Legal basis: Law 58/2003, of December 17, General Tax Law.)

• TG12 - Own labor management: data collection (Legal basis: Royal Legislative Decree 1/1994, of June 20, approving the consolidated text of the General Social Security Law.)

• TR09 - Security measures on technical and organizational aspects of applied software (Legal basis: Regulation (EU) 2016/679 on data protection and LOPD.)

• TE08 - Personal Data Protection (Legal basis: Regulation (EU) 2016/679 and Organic Law 3/2018.)

• TE02 - Occupational risk prevention (Legal basis: Law 31/1995, of November 8, on Occupational Risk Prevention.)

• TE07 - Document destruction (Legal basis: Regulation (EU) 2016/679)

• TV01 - Sales / Service provision (Legal basis: Commercial and Tax Legislation)

• TE03 - Transportation and/or package shipping services (Legal basis: Royal Decree of August 22, 1885, publishing the Commercial Code.)

• TR05 - Email communications (Legal basis: Commercial Code and applicable legislation.)

• TR01 - Information requests received (Legal basis: Commercial Code and other commercial provisions.)

• TR07 - Incident and/or security breach management (Legal basis: Regulation (EU) 2016/679 on data protection and LOPD.)

• TE04 - Management of own legal matters (Legal basis: Applicable commercial and labor legislation.)

• TE01 - Maintenance of IT systems (Legal basis: Commercial Code.)

Who are we?

We are responsible for the processing of your data. Therefore, we explicitly, precisely, and unequivocally inform both the data subjects and the competent authorities of the following details about the data controller:

MANUKA WORLD, S.L.

B66443284

CALLE MOLL DE BARCELONA, S/N, EDIFICIO SUR, 2ND FLOOR, BARCELONA 08039, SPAIN

Data Protection Officer: FORMACIÓN Y CERTIFICACIÓN DE DELEGADOS DE PROTECCIÓN DE DATOS, S.L., NIF: B73982266 (dpd@gruposmz.es)

What do we use your personal data for?

In this organization, we may process your personal data exclusively for the purposes outlined below:

• Verifying that all necessary technical measures for proper data management are implemented in the applied software.

• Sending commercial and/or advertising information via email.

• Managing information requests received from the data subject regarding our products or services.

• Exclusively managing internal incidents detected in compliance with GDPR requirements.

• Conducting advertising campaigns to promote our services and/or products.

• Collecting opinions from interested parties.

• Selecting staff to fill necessary job vacancies.

• Complying with all requirements provided by the Occupational Risk Prevention Law.

• Sending packages and correspondence.

• Managing any legal issues affecting the company.

• Managing, maintaining, and repairing data storage systems.

• Actions to carry out own labor management.

• Actions to carry out own tax and accounting management.

• Complying with the principle of limiting the retention period for personal data.

• Meeting the requirements of Regulation (EU) 2016/679 and Organic Law 3/2018.

• Administrative management of individual clients.

• Carrying out the sale or provision of the contracted service.

A commercial or user profile may be created based on the information provided or obtained. It is explicitly stated that no profiles will be created using the data of minors.

Your personal data will be retained as long as the contractual relationship lasts or until you exercise your right to object or withdraw the consent granted. To do so, you can go to the relevant section on our website or send an email to the address indicated in the section related to the data controller.

Why do we use your data?

We are authorized to process your personal data for the following reasons:

• Your unequivocal, informed, and express consent in cases where it is legally required. The withdrawal of such consent will not condition the execution of other treatments whose legitimacy derives from other grounds, nor will it affect the legality of the treatment prior to its withdrawal.

• A legal obligation of the data controller.

• Execution of the service provision and/or product sales contract signed by you.

• A legitimate interest of the data controller. This interest is supported by a prior proportionality or balancing test between the legitimate interest of the controller and the interests or rights and freedoms of the data subjects. This balancing involved assessing the interest, evaluating the impact of the treatment on the data subjects, weighing these factors, and implementing additional safeguards.

With whom can we share your personal data?

Your personal data will be shared with the following entities and organizations:

• Tax Agency

• State Public Employment Service

• General Social Security Treasury

• National Data Protection Agency

• Banks and financial institutions

Your personal data will not be transferred to any third country or international organization.

What rights can you exercise?

We guarantee your ability to exercise your rights related to the processing of your personal data, including:

• Confirming whether your data is being processed.

• Exercising the right to access your personal data and obtaining information about the purposes of the processing, data categories, possible recipients, retention periods, data sources, and profiling or automated decision-making, if applicable.

• Exercising the right to rectification to ensure your data reflects reality. Notify us of any changes, as you are responsible for inaccuracies or omissions.

• Opposing data processing for reasons related to your particular situation, unless legitimate grounds prevail.

• Requesting data deletion when no longer necessary or when the legal basis for processing is absent.

• Requesting data portability when processing is automated and based on a contract or consent, allowing receipt or transfer of data to another controller.

• Requesting limitation of data processing under specific circumstances, retaining the data only for legal claims.

• Opposing automated decision-making, including profiling.

These rights can be exercised free of charge unless otherwise legally specified.

Additionally, you can lodge complaints with the Spanish Data Protection Agency (https://www.agpd.es/) or the relevant supervisory authority. You may also seek recourse in courts for compensation claims.

Finally, we periodically assess threats and impacts related to data processing and apply security measures to mitigate potential risks, ensuring compliance with data protection principles.

For further clarification, feel free to contact us via the provided email address.

Sincerely,

The Data Controller