Privacy Policy

We process only the data you provide to us directly and voluntarily, or that is generated during your relationship with us:

• Identification and contact data: first and last name, email, phone number, postal address.
• Order and billing data: products purchased, amounts, shipping and billing address, tax data, purchase and return history.
• Payment data: managed directly by the corresponding payment gateway. Pino & Jacaranda does not store full credit card numbers.
• Account data: login credentials or login identifier via Google or Facebook.
• Browsing data: IP address, device and browser type, pages visited and interaction with the site, collected through cookies and similar technologies in accordance with our Cookie Policy.
• Communications: inquiries, form messages, emails, WhatsApp, and customer service calls.

We do not request or process special categories of data (health, ideology, religion, ethnic origin, sexual orientation, or similar). We ask that you do not provide us with this type of information.

At Pino & Jacaranda S.L., we process your personal data for the following purposes:

• Manage your orders, shipments, returns, warranties, and billing.
• Address inquiries, information requests, and messages sent to our team.
• Manage your user account and access to the online store.
• Manage our relationship with you as a contact person for an entity, company, or interior design studio.
• Comply with our legal, accounting, and tax obligations.
• Maintain site security and prevent fraud or misuse of promotions.
• Send you commercial communications about products, news, or services, if you have given your consent.
• Show you personalized advertising on third-party platforms, under the terms of section 09 and provided you have given your consent.

The applicable legal basis depends on the specific purpose:

• Performance of a contract (Art. 6.1.b GDPR): management of orders, payments, shipments, returns, and warranties.
• Compliance with a legal obligation (Art. 6.1.c GDPR): tax, accounting, and consumer obligations.
• Legitimate interest (Art. 6.1.f GDPR): relationship with professional contacts, site security, fraud prevention, and service improvement.
• Consent (Art. 6.1.a GDPR): commercial communications, non-essential cookies, and personalized advertising, including audience creation described in section 09.

Where consent is the basis, you can withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

Pino & Jacaranda does not make decisions that produce legal effects concerning you based solely on automated processing of your data.

The advertising segmentation described in section 09 is limited to showing more relevant ads and does not have legal effects or significantly affect you in a similar way. You can object to it at any time.

If you request financing, the solvency assessment is carried out by the corresponding financial institution as an independent controller, in accordance with section 07.

Financed payment with Aplázame: if you choose this payment method, your data will be transferred to Aplázame for risk assessment, solvency, and formalization of the loan.

Financed payment with Pepper Finance: if you choose this option, your data will be transmitted to Pepper Finance to review your application and manage the financing.

Both entities process data as independent controllers, in accordance with their own privacy policies. Pino & Jacaranda is not involved in the credit approval or management of its conditions.

Currency conversion: we use external services that process your IP address to display prices in your local currency. A session cookie is stored that is automatically deleted when you close your browser.

We do not sell your personal data. We disclose it only when there is a legal obligation, when it is necessary to provide you with the service, or when you choose an external service yourself.

To operate the store, we rely on providers who act as data processors on behalf of Pino & Jacaranda, subject to a contract in accordance with Article 28 of the GDPR and to confidentiality and security obligations. These include:

• E-commerce platform and hosting: Shopify.
• Payment gateways: Shopify Payments, PayPal, Bizum, Apple Pay, and Google Pay.
• Shipping and logistics agencies, for order delivery and collection.
• Email marketing and customer service providers.
• Analytics and advertising providers, under the terms of section 09.
• Tax and accounting advisors, and Public Administrations when required by law.

At Pino & Jacaranda, we use the information that customers provide directly to us (such as name, email, phone, postal address, and purchase data) to provide services related to their order and improve their experience.

Additionally, we may share customer data with third parties who provide services on our behalf, including advertising providers, for the purpose of showing personalized ads, measuring their effectiveness, and creating customer-based audiences. We currently work with:

• Google Ireland Ltd. / Google LLC — Google Ads (Customer Match functionality), Google Analytics and Google Merchant Center, across Search, Shopping, Display, YouTube, Gmail, Demand Gen, and Performance Max.
• Meta Platforms Ireland Ltd. — Facebook and Instagram (Custom Audiences and Lookalike Audiences).

Origin and processing of data

Data used for this purpose comes exclusively from information voluntarily provided by customers through our website, our applications, our forms, or our physical stores. We do not acquire or use third-party data lists to create these audiences.

Before being sent to these platforms, identifiers (email, phone, and address) undergo a one-way hashing process using the SHA-256 algorithm in the user's browser or the originating server. The platforms compare these encrypted values with those of their own user accounts and, once matched, delete any data that does not produce a match. This process does not allow Pino & Jacaranda to identify specific users within the advertising platform.

Audiences are used to show ads to existing customers, exclude specific groups from a campaign, or find profiles with similar interests. We never use or infer sensitive categories (health, ideology, religion, ethnic origin, sexual orientation, personal financial situation, or similar) for advertising segmentation.

Legal basis and consent

This processing is always carried out in accordance with applicable law, including the General Data Protection Regulation (GDPR), Organic Law 3/2018 (LOPDGDD), Law 34/2002 (LSSI-CE), and the Google EU User Consent Policy.

Where required by law, we obtain the user's explicit prior consent to share their data with advertising platforms and to show them personalized ads. This consent is collected via the cookie banner and specific checkboxes in our registration, purchase, and subscription forms, and is recorded as proof. We transmit the consent signal to Google and Meta using the technical mechanisms provided for this purpose (Consent Mode and equivalents).

We do not include data of minors under 14 years of age or users who have withdrawn their consent or exercised their right to object in these audiences.

How to object or withdraw your consent

You can at any time request access, rectification, or deletion of your data, as well as object to the use of your information for advertising purposes, by writing to info@pinoyjacaranda.com. We will address your request and exclude you from active audiences within the legally established timeframe.

Additionally, you can manage ad personalization directly on each platform:

• Google: My Ad Center and Google Privacy Policy.
• Meta: Ad Preferences and Meta Privacy Policy.
• Cookies on this site: "Configure cookies" panel, available in the footer.

Some of our providers have their headquarters or part of their infrastructure outside the European Economic Area, mainly in the United States. This is the case for Shopify, Google, and Meta.

These transfers are covered by the mechanisms provided for in Chapter V of the GDPR: adequacy decisions by the European Commission, such as the EU-US Data Privacy Framework, or standard contractual clauses along with any necessary supplementary measures.

You can request additional information about the safeguards applied by writing to info@pinoyjacaranda.com.

We implement appropriate technical and organizational measures to protect your data from unauthorized access, loss, alteration, or disclosure: encryption of communications using TLS, access control, hosting with certified providers, and confidentiality agreements with our staff and suppliers.

No system is infallible. If a security breach occurs that could pose a high risk to your rights, we will inform you and notify the Spanish Data Protection Agency within the legally established deadlines.

Everyone has the right to obtain confirmation as to whether we are processing their personal data. Specifically, you can exercise the following rights:

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure or right to be forgotten.
• Restriction of processing.
• Opposition to processing, including personalized advertising.
• Data portability.
• Withdrawal of consent at any time.
• Not to be subject to decisions based solely on automated processing.

You can exercise them, free of charge, by writing to:

Indicate the right you wish to exercise and attach a document proving your identity. We will respond within a maximum period of one month, extendable in the cases provided for by the GDPR.

If you believe that we have not handled your request correctly, you can lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.

You can register and access your account by:

• Own username and password.
• Access via Google, with secure authentication.
• Access via Facebook, with encrypted authentication.

For access via Google or Facebook, we only receive your first name, last name, and email to create or link your account. We do not have access to passwords or private data from these platforms.

The user undertakes to diligently safeguard their credentials. Pino & Jacaranda will not be liable for damages arising from the improper use of keys due to their loss, theft, or disclosure to third parties.

You can revoke access at any time from your account settings in Google or Facebook (OAuth 2.0).

Our products and services are aimed at people over 18 years of age. We do not knowingly collect data from children under 14 without the consent of their parents or guardians.

If we detect that we have processed data of a minor without the necessary authorization, we will delete it. If you believe this has happened, please write to us at info@pinoyjacaranda.com.

Personal data provided through this site is treated as confidential information and is incorporated into the processing systems owned by Pino & Jacaranda S.L.

We may modify this policy to adapt it to legislative changes, criteria of the supervisory authority, or changes in our processes. Any update will be published on this page, indicating the date of the last revision in the header.

This policy is complemented by our Legal Notice, our Cookie Policy, and our Terms and Conditions of Purchase.