INTRODUCTION AND GENERAL INFORMATION

About us and our website.

BOJ Olañeta S.L.U. (hereinafter, BOJ) is the owner of this website.

• BOJ OLAÑETA, LLC
• 21 Matsaria Street, 20600 Eibar. Gipuzkoa. SPAIN.
• Tax identification number (CIF): B20016333

To contact us, please go to:

• Contact email: info@boj.es

Guiding principles

We take the protection of your information very seriously. That is why we take care when processing your personal data and comply with data protection regulations. In order to protect all our websites from threats to the processing of personal data, we have implemented all technical and organizational security measures. Third parties who collaborate with us in the management of this website comply with the same guidelines.

Collection of browsing data

You can access all areas of our website that do not require passwords without revealing your identity. We generally log all use of our website to prevent attacks, correct errors, and investigate any security incidents. You can find more information about the collection of browsing data in the section "How do we process your data?"

What authorizations do we have to process your data?

We respect your privacy. Therefore, we only process your personal data when we are authorized to do so. You will find a summary of the different cases in which we are authorized to process your personal data at the end of this Data Protection Policy. On the one hand, you can give us your consent to process your personal data when the processing requires it. In other cases, we process your data because we are legally authorized to do so. If, for example, you place an order on our website, we are authorized to process your data for the execution of that contract. The same applies when you use other services on our website that require your data in order to be performed. We are also authorized to process your data when our interest in doing so is legitimate. An example of this is the log entries we collect to ensure, for example, that our website operates without errors (including technical maintenance of the website). In any case, we will inform you about the processing of personal data that is carried out, and of course, your rights and interests will always be taken into account. If you have any questions about your personal data, you will find your data protection rights at the bottom of this page.

In the following section, we detail the circumstances that authorize us to process your personal data. You can find detailed information about the collection, processing, and use of your data in the same section of our website (e.g., type, scope, and purpose of data processing).

What else should I know?

Users under the age of 16 should only provide their data with the consent of their parents or legal guardians.

Our website may contain links to other websites that are not managed by us. BOJ is not responsible for the processing of your data on these third-party websites or for their compliance with data protection regulations. Please refer to the data protection information provided by these websites.

DATA PROCESSING ON THE WEBSITE

How do we process your data (website appearance, connections, cookies, tracking, etc.)?

1. Appearance of the website, browsing data

To display the website in your browser, we use various devices to ensure that all content (text, images, video, etc.) is always up to date. To ensure that your user experience, in particular the loading speed of the website, is constantly improved, we also use technical service providers that allow us to display the content necessary for the appearance of the website (hereinafter "Content Delivery Network" or "CDN"). These CDN technical service providers work on the instructions of BOJ and have signed the corresponding data processing agreement. The data collected for this purpose will only be used to display the contents of the website in your browser more quickly and will be deleted immediately after you have accessed the page.

For technical reasons, every time your browser accesses our website, information is automatically sent to our server (e.g., browsing data). Some of this information is stored in log files, such as:

• access date
• access time
• Page URL
• HTTP protocol version
• files accessed
• volume of data transferred
• type of internet browser and its version
• type of operating system
• IP address (anonymized)

Browsing data does not include personal data. We only analyze browsing data when necessary, especially to fix malfunctions in our website or to resolve security incidents. We store this data indefinitely.

On occasion, we may need to collect your device's IP address and browsing data in order to resolve faults or retain evidence related to security incidents. This data is deleted once the fault has been resolved or the security incident has been fully resolved, or if the initial purpose of the processing no longer exists for other reasons. In the event of a security failure, we will communicate the relevant connection data to the investigating authorities, whenever necessary and permitted by law.

We store browsing data separately from other data collected in connection with the use of our website.

2. Registration on our website

You can register on our website to use various services. As part of the registration process, we collect and process the following data:

Required information:

• Treatment
• First and last name
• Full address
• Phone number
• Email address
• Password

Optional data:

Consent to receive advertising and the possibility of revoking it

We store the data of registered users until the user deletes their account. Registered users can delete their account at any time via the "My Data" section within their user account. The user account also allows the user to modify or delete the information provided at the time of registration at any time.

3. Quick registration (Option to register via a social network)

To register on our website, you can also use quick registration (via a social network). This option is available for several social networks. To register, you will be redirected to the website of the corresponding social network, where you can register with your login details for that network. This page will link your social network profile to your user account on our website. When you link your accounts, we will automatically receive the data required for registration from your social network. If you want to know what data is communicated to us from the social network when you register, please review the terms and conditions and privacy policy of the corresponding social network. We only store and process your name and email address in order to provide you with our services.

By linking both accounts, you will no longer need to register separately on our website. To do this, a cookie will be installed on your browser and used on your next visit to the website.

The purpose of processing personal data in this context is to provide you with the services of our website, in particular the option of registering via a social network. We store data from registered users until the account is deleted. Registered users can delete their accounts at any time via the "My Data" page. The user account also gives you the option to change or delete some of the data entered during registration at any time.

4. Subscription to the BOJ blog

Our website offers the option to subscribe to a newsletter with the latest posts from our blog. If you subscribe to receive these newsletters and therefore consent to us sending them to you, your data will only be used for this purpose and you will not receive any additional communications. We are authorized to process your data in this context with your consent, which you can revoke at any time. A link to this effect is included in each copy of our newsletters, and we will note your unsubscription in our database.

5. Participation in promotions/sweepstakes

When you register for promotions/sweepstakes, we store and use the information you provide to conduct the promotion/sweepstakes and fulfill any subsequent phase. The data we collect for this purpose depends on the registration form on the sweepstakes or contest page in question.

Your personal data will be deleted when it is no longer necessary for the promotion/draw or for following up on it.

6. Our social media pages

The protection of your privacy when processing personal data is important to us. We process the personal data transmitted to us and collected during your visit to our respective social media pages (e.g., Facebook Fanpage, Instagram/Pinterest Page) confidentially and only in accordance with legal provisions.

The controller responsible for processing your data via our social media pages is the operator of the respective social media platform (see examples below), together with us. Insofar as the processing of this data takes place within our area of responsibility, we are available to you for all questions relating to data protection and the exercise of your rights in accordance with the content of this data protection information.

Data processed by the social media provider

The social media service processes your personal data when you access one of our pages. Your data is processed, for example, in the following cases:

• View a page, post, or video from a page
• Subscribe to or unsubscribe from a page
• Mark a page or message with "Like" or "Unlike" or similar functions
• Recommend a page in a post or comment
• Comment, share, or respond to a post on the page (including the type of response)
• Hide a post from a page or mark a report as spam
• Clicking on a link to the social network from another website
• Hover your mouse over the name or profile picture on a page to see a preview of the content.
• Use the social network provider's features, such as the website, phone number, "Plan Route" button, or any other button.
• Information about whether the login is made via a computer or a mobile device

The social network provider's data protection policy will tell you what personal data is collected by them, how it is processed, and what data protection rights you have vis-à-vis that provider. We have no responsibility for the processing of data by the social network provider.

Data processed by us

On the website provided by us via the social network, the provider of that network grants us access to the following categories of data:

Statistical analyses that provide information about the use of our social media page. The analyses visible to us do not allow us to analyze the usage behavior of individuals. We can only see aggregated data (such as the number of visits, likes, followers, region of origin, age group, gender, etc.) that inform us about our audience and the use of our page. The user data on which the analyses are based is not transmitted to us.

We can segment the target group we want to reach for the social media page or for individual posts. The settings are based on general parameters (e.g., age group, language, region, interests) that can be used to tailor our content to specific groups. It is not possible for us to target or identify individual persons based on the data provided to us by the social media provider.

If you contact us directly through the social network provider or interact with us in any other way and knowingly transmit personal data (for example, through a chat or direct message with us via the social network), we store and process this personal data for the purposes for which you transmitted it to us.

We process this data exclusively for the purpose of making the content of our social media page known to the target group, as well as to better understand and optimize its use.

Furthermore, we cannot decide on the purpose or processing of data carried out by the social network provider.

To find out what personal data is collected by the social network provider, how it is processed, and what data protection rights you have vis-à-vis that provider, please refer to the following data protection guidelines:

a) Facebook Inc. 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php. Facebook has submitted to the EU-US Privacy Shield.

b) Twitter, Inc. 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter has submitted to the EU-US Privacy Shield.

c) Instagram, provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; https://help.instagram.com/519522125107875

d) Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland; https://policy.pinterest.com/en/privacy-policy

e) Snapchat for countries in the European Union (EU), the European Economic Area (EEA), and Switzerland: SNAP GROUP LIMITED 7-11 Lexington Street, London, United Kingdom, W1F 9AF. For all other countries: SNAP Inc, 2772 Donald Douglas, Loop North Santa Monica, CA 90405 United States, USA. SNAP Inc. has certified to the EU-US Privacy Shield.

f) LinkedIn for countries in the European Union (EU), the European Economic Area (EEA), and Switzerland: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For all other countries: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. The LinkedIn Corporation has submitted to the EU-US Privacy Shield.

g) Xing SE, Dammtorstrasse 30, 20354 Hamburg, Germany; https://privacy.xing.com/en/privacy-policy

7. Below, we explain in detail which technologies and providers we use to analyze your user behavior:

Google Ad Server

We use the online marketing tool Google Ad Server (formerly DoubleClick) from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

Usage data will be deleted after 540 days from the time of collection. For more information about DoubleClick, visit https://www.google.com/doubleclick or Google's general privacy policy: https://policies.google.com/privacy

We use Google's online marketing tools on our own responsibility. To this end, we have agreed with Google in a data protection agreement that our customers' data may only be processed on the basis of our instructions, may not be passed on to third parties, and must be adequately protected technically.

Opt-out/cancellation: To permanently prevent the collection of usage data, Google offers a plug-in for various Internet browsers: http://www.google.com/settings/ads/plugin

To disable only interest-based ads, you can block the use of third-party cookies or cookies from the domain "www.googleadservices.com" or disable interest-based ads using this link at https://www.google.com/settings/ads.

Facebook pixels and custom audiences

We use the online marketing tools "Facebook Pixels and Custom Audiences" from Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, and Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, if you are a resident of the EU ("Facebook").

Facebook processes your data on its own responsibility as part of Facebook's data usage policy. You can find information about Facebook ads and Facebook pixels at the following links: https://www.facebook.com/policy and https://www.facebook.com/business/help/651294705016616

Non-acceptance/cancellation: To permanently prevent the collection of usage data, please visit Facebook's data protection policy. As a registered Facebook user, you can also set which types of ads are displayed within Facebook. To do so, click on the following link: https://www.facebook.com/settings/?tab=ads

Google Ads and Remarketing

This website uses the online marketing tools "Google Ads & Remarketing" from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google has submitted to the EU-US Privacy Shield: https://www.privacyshield.gov/EU-US-Framework

We use Google's online marketing tools at our own discretion.

The cookies used in this service generally expire after 30 days and cannot be used to identify you personally. Google only provides us with statistical evaluations and processes your information in accordance with Google's data usage policy. You can find more information at the following link: https://policies.google.com/privacy

Non-acceptance/cancellation: To permanently prevent the collection of usage data, Google offers a plug-in for various Internet browsers: http://www.google.com/settings/ads/plugin To deactivate interest-based ads, you can block the use of third-party cookies or cookies from the domain "www.googleadservices.com" or deactivate interest-based ads via this link at https://www.google.com/settings/ads

Interest-based ads can also be deactivated via the link http://www.aboutads.info/choices if the provider has joined the "About Ads" self-regulation campaign.

8. Social networks and similar networks and services

The content of our website can be shared on social media using the Share button. All buttons that allow content to be shared are integrated using simple links instead of social plugins developed by social media providers. This ensures that your data is not automatically transmitted to social media servers when you access our website. Furthermore, when you share content from our website, we only transmit the information necessary to share the corresponding content (e.g., the link to the content you want to share) to the social media platform. We do not transfer any personal data in this context.

In turn, simple links to our web pages can be found on social networks. If you access a link to our website from a social network, or if you log into your social network to share content from our website, your data will be processed by the provider of the social network in question.

If you are registered and logged in to other networks or services that require registration while using our website or individual features (e.g., Vimeo, YouTube), the respective network/service may collect information about your usage or adopt settings, such as the playback status of videos. However, this data is collected solely by the respective network/service under its own data protection responsibility and processed by the corresponding provider.

For more information on the purpose and scope of data collection, its subsequent processing and use by the social network provider, as well as on the associated rights and settings options to protect your privacy, please refer to the Data Protection Information published on the website of the respective provider.

9. Changes to the Data Protection Policy

This Data Protection Policy has been drafted taking into account the current data processing on our website. Should changes occur in data processing, this data protection information will be updated accordingly. We always provide the latest version of this data protection information on our website so that you can find out about the scope of data processing on our website.

USER RIGHTS

Additional information pursuant to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR)

Your rights

Below is a description of your rights:

Unsubscribing from promotional communications: If you wish to revoke your consent to receive commercial communications by electronic means, you can use the unsubscribe link at the bottom of the relevant email or send an email to Data-Protection-ES@BOJg.com with the subject line "Unsubscribe from commercial communications by electronic means," indicating your first name, last name, and email address. Exercising your data protection rights: Please use the following channels: info@boj.es

Right of access to information about your data: Upon request, we will provide you with information about the data we hold about you.

Right to rectify your data: When you notify us, we will correct any inaccurate personal data concerning you. If you request it, we will complete any incomplete personal data, provided that it is necessary for the purpose for which your data is processed.

Right to erasure of your data: Upon your request, we will erase the data we hold about you. However, some data will only be erased after a certain retention period, for example, when it must be retained to comply with a legal obligation, or because we need the data to fulfill contractual obligations to you.

Right to block your data: In cases where the law allows for the restriction of the processing of your data, it will be blocked.

Right to withdraw consent: You may withdraw your consent to the processing of your data at any time, with effect from that moment onwards. This will not affect the lawfulness of the processing carried out up to that point.

Right to object to the processing of your data: You have the right to object at any time to your personal data being processed on the basis of Article 6(1)(e) and (f) of Regulation (EU) 2016/679. If you object, we will stop processing your personal data, provided that there are no compelling legitimate grounds for continuing the processing. For us, the processing of your data for direct marketing purposes will never constitute a compelling legitimate ground.

Right to portability: Upon request, we will provide you with your personal data in a structured, commonly used, and machine-readable format.

Right to lodge a complaint with a supervisory authority: You may lodge a complaint regarding data protection with the competent supervisory authority. To do so, please contact the data protection authority responsible for your place of residence or the data protection authority in our jurisdiction (listed below).

Spanish Data Protection Agency (AEPD); www.agpd.es

Transfer to recipients outside the EEA

We also transfer personal data to recipients located outside the European Economic Area (EEA), in so-called third countries. In this case, we ensure – before sharing any data – that the recipient maintains an adequate level of data protection (e.g., on the basis of an adequacy decision by the EU Commission for the respective country or by signing an agreement with the EU standard contractual clauses between the European Union and the recipient) or that you have consented to such disclosure.

Upon request, we will provide you with a list of recipients in third countries and a copy of the specific provisions agreed upon to ensure an adequate level of data protection. To request this, please use the contact information provided in the "Contact information for any questions related to data protection" section of this Data Protection Policy.