Privacy Policy

GENERAL PRIVACY POLICY

1. Introduction

The right to privacy, and in particular the right to the protection of personal data is one of the values of IBERSPA SL, (hereinafter, IBERSPA) which is included in our Code of Ethics.

The objective of this policy is to explain how IBERSPA will process any personal data that may be collected through the different forms that can be found on the IBERSPA Website.Your personal data will be treated confidentially and only for those purposes that you have consented to, as explained below in this General Privacy Policy and in each of the Privacy Policies of the different forms.

2. Commitment to privacy

IBERSPA is fully committed to complying with the regulations and General Data Protection Regulations of the European Union and regulations regarding the protection of personal data in force at any given time, this being a priority objective for IBERSPA.

Therefore, IBERSPA has taken the decision to implement the following principles, privacy being the basis on which all processes are organised.

• Transparency in the processing of data is one of our priorities, so whenever we collect personal data about you, we will inform you accordingly of the purposes of said treatment in the corresponding privacy policy.
• We will always process only the data that is strictly necessary to carry out said processing.
• We will never force you to provide personal data, unless it is really necessary to provide the service that you request.
• Whenever possible, we will supply you with simple means of controlling your personal data.
• We will not share data with any third party, except those providers that present us with a service, or with those who, previously, we have informed you of, and to which you have given your consent.

Purposes of the processing.

IBERSPA collects your personal data in order to manage your requests and offer you the services and products that you may be interested in.Specifically, we process your personal data for the following purposes:

1. To be able to attend your queries, questions or requests made through customer service, communication or press channels identified on each website and get in touch with you to resolve them.
2. To improve our websites, services and products, and offer a better service and content.
3. To offer you access to the restricted spaces of our website (registration may require acceptance of a specific privacy policy).
4. To provide you with information in the event that you are a distributor
5. To be able to inform you about any vacancies in our Group through the Employment Portal.

In some cases it may be necessary to process your personal data to comply with legal obligations, or in relation to any contractual relationship we may have with you.

In all other cases, and whenever appropriate, we will ask for your consent to process your personal data.

3. Sending of commercial messages.

IBERSPA, within the framework of its promotional activity, may provide resources for registration or subscription to news or general or commercial information of the company.These resources will only be sent with your consent.

If you have given us permission, IBERSPA will send you information about your products, activities and services personalised for you according to your tastes and preferences.

You may revoke your consent to receiving commercial messages at any time, through the link or button provided for that purpose in each message, or by communicating your wish to revoke consent through the following channels:

(i).E-mail addressed to iberspa@iberspa.com

(ii).Postal letter addressed toAvda. Pla d’Urgell 2-8, 2500 Cervera (Spain)

(iii).Webform at www.iberspa.com

4. Automated Decisions and Profiling

For some services, we can process your personal data using automated means.This means that certain decisions are made automatically without human intervention.For example, if you have selected products, messages informing you that the product is still available.

Other processes we may carry out include creating a profile in order to predict your behaviour on the web, showing you, on the main page, products that may be of interest, based on your preferences shown by your browsing history, or information obtained through cookies.Contact us at iberspa@iberspa.com

5. Duration of the processing and retention period

At IBERSPA, we are committed to only processing personal data as long as it is really useful to us and its use allows us to offer a quality service.Therefore, we will do everything necessary and reasonable to minimise the period of processing and retention of personal data.

In this respect, in each data collection form we will inform you of the expected period of processing and / or retention of your personal data.

In any event, and even if you ask us to delete your data, we may retain it, subject to any block, for the time necessary to comply with our legal obligations and to supply it to the Authorities having jurisdiction over the different matters in question.

6. Exercise of rights and claims before the AEPD

As a result of the processing of your personal data by IBERSPA, current legislation grants you a series of rights.Below is a short explanation of each right, to make it easier to assert them:

1. Right of access:You will have the right to know the personal data that we process about you and the purposes for which we are processing it.
2. Right of rectification:Your data will always be yours, and as such, you may ask us to rectify it at any time if the data contained in our records is wrong.
3. Right of deletion:You may request, at any time, that your personal data be deleted from our records.However, and as indicated in the section on data retention above, bear in mind that, in certain circumstances, compliance with current legislation may prevent the effective exercise of this right.
4. Right of opposition:You may object to the processing of your data in relation to any of the purposes for which we process your data, in accordance with the privacy policies applicable in each case.
5. Right of limitation of processing:You may request the limitation of processing in the following cases:

• If you believe that the data we hold on you is not correct or accurate;
• If that you consider we are not processing your data legitimately, but you prefer us to limit the processing thereof to its deletion;
• If the data that we hold is no longer necessary for us according to the purpose for which we collected it, but you need to keep them to file lawsuits;
• If, having exercised the right to oppose any processing, you are awaiting a response on our part.

6. Right to the portability of your data:You will have the right to, whenever it is technically possible and reasonable, request that the personal data you have provided us directly be passed on to another data controller.If possible, we will forward your data directly to other data controller, but if not, we will provide it to you in a standard format.

Whenever we process your data based on consent, you may revoke it at any time, without any consequences for you beyond, depending on the right exercised, not being able to provide certain services.

The exercise of the rights you hold by contacting IBERSPA through one of the following means, along with a copy of your ID or equivalent identification document:

(i).E-mail addressed to iberspa@iberspa.com

(ii).Postal letter addressed toAvda. Pla d’Urgell 2-8, 2500 Cervera (Spain)

In addition, if you consider it necessary, you may contact our Data Protection Officer at the e-mail address iberspa@iberspa.com

If you do not want to exercise a specific right, but need to make a query or suggestion in relation to the processing of your personal data you may also contact the addresses provided for the exercise of rights.

Please note that always, in any case, you can file a claim with the Competent Authority regarding data protection if you believe that we have not processed your data in a lawful manner or that we have not responded to your requests or rights.In Spain, said Competent Authority is the Spanish Data Protection Agency.

7. Confidentiality and Security in data processing matters

Your personal data is very important to us, and we are committed to treating it with the utmost confidentiality and discretion, as well as implementing all security measures that we consider appropriate and reasonable.

In this respect, IBERSPA declares and guarantees that it has established all the technical means at its disposal to prevent the loss, misuse, alteration, unauthorised access and theft of the data provided by users.

8. Social Networks

Social Networks are part of the daily lives of many Internet users, and for them we have created different IBERSPA profiles.

All users have the chance to join the pages or groups that IBERSPA has created in different social networks.

However, you must bear in mind that, unless we request your information directly (for example, through marketing actions, contests, promotions, or any other valid form), your data will belong to the corresponding Social Network, so we recommend you that you carefully read their conditions of use and privacy policies, and make sure you configure your preferences regarding data processing.