DATA PROTECTION POLICY

Bora Creations, S.L.U. (hereinafter: "we") appreciates your interest in our company and our products. It is important to us that you feel secure when visiting the websites operated by us (hereinafter: "website"), also with regard to the protection of your personal data.

This privacy policy informs you about the type, scope and purpose of the personal data we process when you use our website and all sub-pages. If you wish to make use of certain services on our website it is necessary to process your personal data. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behaviour.

You can navigate directly to the relevant topics via the links below to find out how we process personal data relating to you. You can also read, save and print this privacy policy as a whole document.

Contents of the privacy policy

Please click on the links below to go directly to the relevant topics.

Information on the responsible person, data protection officer
Collection and processing of personal data when visiting our website
Disclosure of personal data in general
Your rights as a data subject
Updating the privacy policy

1. Information on the controller, data protection officer

(a) Controller

Bora Creations, S.L.U.
Calle Velázquez 11
E-07157 Andratx (Pt. d'Andratx)
Baleares
Spain
E-mail: info@boracreations.eu

You can find more information about us in the imprint.

(b) The Data Protection Officer of the Controller is:

Moritz Görmann
CTM-COM GmbH
Marienburgstraße 27
64297 Darmstadt
Germany
Phone: +49 6151 394272
www.ctm-com.de

2. Collection and processing of personal data when visiting our website

When using the website for information purposes only, i.e. if you do not send us any other information, we only collect the personal data that your browser sends to our server. We collect the following data, which is technically necessary for us to display our website in the version and language that suits you and to ensure stability and security and to create general reports on the use of our website (legal basis is Art. 6 para. 1 s. 1 lit. f GDPR):

IP address
Date and time of the request
Content of the request (concrete page)
Website from which the request comes
Browser
Operating system

The above data will be deleted immediately when it is no longer needed for the aforementioned purposes, at the latest 30 (thirty) days after we have collected it.

Insofar as you provide us with further personal data, e.g. within the scope of a registration, a contact form, we use this data for the purposes mentioned and for customer administration purposes, in each case to the extent necessary for this.

If you contact us by e-mail (e.g. to the address given above) or by other means (e.g. messenger), the personal data transmitted with your message will be stored and used for processing the conversation.

The legal basis for the processing of data transmitted in the course of sending a message is Art. 6 para. 1 s. 1 lit. b and lit. f GDPR. This data is used solely for processing the contact; this also constitutes the necessary legitimate interest in processing the data within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected, which is the case when the respective conversation with the user has ended. The conversation is terminated when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

3. Disclosure of personal data in general

(a) Transfer to service providers

In some cases, we use service providers bound by instructions for certain data processing activities, who process the data on our behalf and according to our instructions (commissioned processing).

(b) Disclosure to public authorities, injured parties and for legal proceedings

If it is necessary to clarify illegal or abusive use of our website or for legal prosecution, personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties. However, this only happens if there are indications of illegal or abusive behaviour.

Disclosure may also occur if it serves to enforce terms of use or other agreements. We are also legally obliged to provide information to certain public authorities upon request. These are law enforcement agencies, authorities that prosecute administrative offences subject to fines and the tax authorities.

The legal basis for this is Art. 6 para. 1 s. 1 lit. b, Art. 6 para. 1 s. 1 lit. c, Art. 6 para. 1 s. 1 lit. d and Art. 6 para. 1 s. 1 lit. f GDPR.

(c) Disclosure in the context of corporate transactions

As our business evolves, we may change the structure of our business by changing its legal form, establishing, buying or selling subsidiaries, divisions or components. In such transactions, customer information may be passed on to the acquirer or legal successor together with the part of the company to be transferred.

Whenever we disclose personal data to the extent described above, we will ensure that this is done in accordance with this Privacy Policy and applicable data protection law.

(d) Transfer to recipients outside the EU

We may transfer personal data to countries outside the EU ("third countries"). Any transfer of data to a recipient in a third country is carried out in compliance with the applicable data protection law. If the European Commission has not established the existence of an adequate level of protection for a third country, we provide appropriate safeguards to ensure adequate protection of the personal data relating to you. This can be done in particular by entering into data processing contracts that contain EU standard data protection clauses and provide adequate safeguards as decided by the European Commission (available at: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm). Please contact us for further details, such as the text of the EU standard data protection clauses.

4. Your rights as a data subject

(a) Right to information

You have the right to request information from us at any time about the personal data we process about you within the scope of Art. 15 GDPR. For this purpose, you can submit a request, e.g. by post or by e-mail to the contact address provided.

(b) Right to rectify inaccurate data

You have the right to demand that we immediately correct the personal data concerning you in accordance with Art. 16 GDPR if it is incorrect. To do so, please contact us at the address provided.

(c) Right to erasure

You have the right to request that we delete the personal data concerning you under the conditions described in Article 17 of the GDPR. These conditions provide in particular for the right to erasure if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, as well as in cases of unlawful processing, the existence of an objection or the existence of an erasure obligation under Union law or the law of the Member State to which we are subject. To exercise your right to erasure, please contact us at the address provided.

(d) Right to restrict processing

You have the right to demand that we restrict processing in accordance with Article 18 of the GDPR. This right exists in particular if the accuracy of the personal data is disputed between the user and us, for the duration that the verification of the accuracy requires, as well as in the event that the user requests limited processing instead of erasure in the case of an existing right to erasure; furthermore, in the event that the data are no longer necessary for the purposes pursued by us, but the user requires them for the assertion, exercise or defence of legal claims, as well as if the successful exercise of an objection is still disputed between us and the user. To exercise your right to restrict processing, please contact us at the contact address provided.

(e) Right to data portability

You have the right to receive from us the personal data concerning you that you have provided to us in a structured, common, machine-readable format in accordance with Art. 20 GDPR. To exercise your right to data portability, please contact us at the address provided.

(f) Right of objection

You have the right to object at any time to the processing of your personal data on the basis of Art. 6 (1) sentence 1 lit. e or lit. f GDPR for reasons arising from your particular situation in accordance with Art. 21 GDPR. We will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the assertion, exercise or defence of legal claims.

(g) Right of withdrawal (in case of consent given)

You have the right to revoke your consent in accordance with Art. 7 (3) GDPR with effect for the future. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

(h) Right of appeal

You also have the right to contact a supervisory authority for data protection in the event of complaints. The supervisory authority responsible for us is:

The Hessian Data Protection Commissioner
Gustav-Stresemann-Ring 1, 65189 Wiesbaden
PO Box 31 63, 65021 Wiesbaden
Phone: +49 611 14080
Fax: +49 611 1408 - 900
E-mail: poststelle@datenschutz.hessen.de
Internet: http://www.datenschutz.hessen.de

5. Updating the privacy policy

This privacy policy is valid as of June 2022. Changes to our offer may make it necessary to also change this privacy policy. Therefore, please inform yourself regularly about the content of our data protection declaration. We will also inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.