ONLINE PLATFORM PRIVACY POLICY

Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April ("General Data Protection Regulation" or "GDPR"), this Privacy Policy applies to the processing of personal data that TEENERSBRU, S.L., hereinafter BRIGHTY&CO, carries out as Data Controller, in relation to the data that users and/or customers (natural persons) provide as a result of the request for information on the services and/or products it provides and markets through its website, or collected in any of the sections of the website.

RESPONSIBLE FOR THE PROCESSING OF YOUR DATA.

- Company name: TEENERSBRU, S.L.

- Trade name: BRIGHTY&CO,

- CIF: B64455702

- Email: hola@brightyandco.com

PURPOSES OF PROCESSING.

Your personal data will be used for the generic purpose of management and control of the commercial relationship established and, specifically for:

▪ To manage the complete access and correct use of the services and/or products by the users thereof.

▪ To communicate with users in response to incidents, requests, comments and questions that you make to us through the services and/or products, as well as the contact forms on our website (including e-mails and/or telephone calls).

▪ To provide, update, maintain and protect the services and/or products and activities.

▪ To provide new services and/or products, special offers or updates.

▪ Where appropriate, to manage personnel selection processes in selective processes for workers and/or collaborators.

▪ Communications: We may send you emails, messages and other types of communication in reference to services and/or products, technical issues and changes thereto. These communications are considered part of the services and/or products and you may not opt out of them.

▪ Commercial Communications (Marketing): We may use your data to contact you, both electronically and non-electronically, to conduct surveys, to obtain your feedback on the service provided, and, occasionally, to notify you of changes, important developments to the services and/or products, offers and/or promotions of our services and/or products or of third party companies related to us. These commercial offers will, in any case, be expressly and separately authorised by the user, who may at any time revoke their consent to receive these notifications using the mechanism implemented for this purpose in the same, or from the preferences of the customer account.

We will not process your personal data for any other purpose beyond those described above unless it is imposed by law or there is a court order.

Retention period: The personal data provided will be kept and processed for as long as the service and/or product provision relationship is maintained, without prejudice to the possibility of exercising your right of deletion, in which case BRIGHTY&CO will block your data for as long as its legal obligations persist.

The personal data of the persons interested in receiving information about the services and/or products will be kept in the system indefinitely as long as the interested party does not request their deletion.

LEGITIMISATION OF THE PROCESSING.

The legal basis for the processing of data is the legitimation based on the consent of the data subject given for the purposes described above, which will be requested at the time of:

▪ before proceeding to process your data,

▪ proceeding with registration as a customer or,

▪ proceeding to the sending of communications about BRIGHTY&CO products.

Requests for information that you send us require the interested party to voluntarily provide us with the necessary data to be able to attend to you or provide you with services and/or products.

However, the interested party may freely refuse to provide us with this data or, subsequently, revoke the consent previously granted to process their data, although this refusal will imply the impossibility of us being able to deal with their request.

Likewise, we may process your data on the basis of BRIGHTY&CO's legitimate interest in maintaining the loyalty of its customers and/or users and better meet their expectations or interests previously expressed, e.g.: improve products, manage requests, queries or complaints, offer products similar to those contracted, inform about promotions, etc., without prejudice to BRIGHTY&CO's compliance with other obligations relating to the sending of commercial communications by electronic means.

BRIGHTY&CO understands that by providing us with this data, the interested party guarantees and accepts responsibility for the truthfulness, currency and accuracy of the same and that he/she accepts and expressly consents to their processing for the purposes described above.

RECIPIENTS OF ASSIGNMENTS OR TRANSFERS.

In general, BRIGHTY&CO will not transfer your personal data to third parties unless we are legally obliged to do so or you have expressly authorised us to do so when using our services and/or products.

By accepting the Terms and Conditions of the services and/or products, you expressly consent to these transfers. If you revoke your consent, we will no longer be able to provide you with the services.

RIGHTS OF THE PERSONS CONCERNED.

Any person has the right to obtain confirmation as to whether or not BRIGHTY&CO processes personal data concerning him/her. In particular, you may exercise the following rights vis-à-vis BRIGHTY&CO:

▪ Right of access: this allows the data subject to know and obtain information about his or her personal data undergoing processing.

▪ Right of rectification: to correct errors, modify data that proves to be inaccurate or incomplete and ensure the accuracy of the information subject to processing.

▪ Right of erasure: allows you to request the deletion of data processed when they are no longer necessary for the execution or provision of the service.

Right of opposition: the data subject's right not to have their personal data processed or to have it stopped, except for legitimate reasons or for the exercise or defence of possible claims, in which case we will keep it blocked for the corresponding period of time while the legal obligations persist.

Right to oppose the sending of advertising: Interested parties may oppose the sending of commercial communications by BRIGHTY&CO. In this case, they may revoke their consent to receive these notifications at any time using the mechanism implemented for this purpose in the same, or from the preferences of the customer account.

Limitation of processing: In certain circumstances, data subjects may request the limitation of the processing of their data, in which case it will only be kept for the exercise or defence of claims.

Data portability: data subjects may request to receive the data concerning them that they have provided to us or - where technically feasible - to have it sent to another data controller of their choice, in a structured, commonly used and machine-readable format.

Right not to be subject to automated individual decisions (including profiling): the right not to be subject to an automated processing decision which produces effects or significantly affects you.

Possibility of withdrawing consent: The data subject also has the right to withdraw the consent given at any time, without this affecting the lawfulness of the processing based on the consent given at the time of providing us with your data.

If you wish to exercise any of the aforementioned rights, please send us an e-mail with all your details, including your ID card number to: hola@brightyandco.com indicating the type of right you wish to exercise.

Possibility of claiming before the Control Authority: BRIGHTY&CO also informs you of your right to file a claim before the Spanish Data Protection Agency (www.agpd.es) if you consider that the processing of your data does not comply with the regulations in force.

ADDITIONAL INFORMATION.

Retention of certain data: BRIGHTY&CO informs that, in compliance with the provisions of Law 25/2007, of 18 October, on the conservation of data relating to electronic communications and public communications networks, it must proceed to retain and conserve certain traffic data generated during the development of communications with the aim of transferring them to the legitimate authorities, when the legal circumstances foreseen therein concur.

Registered data: As in the majority of products supplied by the Internet, our servers automatically collect information when the user uses the services of the websites. This log data may include IP address, identification of the device from which the products are accessed, operating system, device configuration.

Security measures: We adopt the necessary data protection measures to prevent loss of information, alteration of data, or access by unauthorised personnel.