PRIVACY POLICY AND COOKIES

Who is responsible for the processing of your personal data?

BIMBA & LOLA, S.L. (B-36.950.970) with registered office in Parque Tecnológico y Logístico de Vigo, nave D13 (36315 – Vigo – Spain) processes the Personal Data collected by BIMBA Y LOLA COLOMBIA SAS (Tax ID No. 901.103,940-1), with registered office at Calle 64 No. 9 a 14, Oficina 305, 110231, Bogotá D.C., Colombia (hereinafter, "Bimba & Lola").

What Personal Data do we collect and how do we do it?

BIMBA Y LOLA COLOMBIA SAS collects Personal Data as the data processor on behalf of BIMBA & LOLA, S.L., and the latter acts as the data controller.

In compliance with the provisions of Law 1581 of 2012 "By which general provisions are issued for the protection of personal data", as well as in any applicable national law, we inform you that at Bimba & Lola we request the data that results strictly necessary for the execution of the following purposes:
a) your name;
b) the number of your National ID card, driver's license or passport (or copies thereof);
c) contact information (including telephone number, postal and shipping address and email address);
d) date of birth;
e) network and device data (including your IP address and device or advertising identifiers);
f) shopping or browsing behaviors;
g) financial information (e.g. credit or debit card numbers or bank account details),
h) the voice obtained via our customer services, and
i) any other personally identifiable information you have provided us with in any form you have sent us, or in the course of any other form of interaction between you and us, including data which is true or not about you or any other individual that may be identified from: i) said data, or ii) said data and other information we have or may have access to (hereinafter, "Personal Data").

We collect your Personal Data in the following circumstances:
a) when you become a registered user and access and use the Website or the Services;
b) when you accept our cookies (see section 9 below) on the device you use to access the website;
c) when interacting with any of our employees, agents or representatives, for example, our customer service representatives;
d) when interacting with us on any social networks;
e) when you contact us via our customer services telephone number, and
f) when you voluntarily send us Personal Data for any reason.

If you provide us with Personal Data from a third party, you guarantee that you have the authority to process and provide us with such Personal Data so that it is used for the purposes established in this Privacy and Cookies Policy. You are also required to inform the third party of the processing of their Personal Data in accordance with this Privacy and Cookies Policy.

We usually rely on the Personal Data you provide us. Please keep us updated if changes occur to said Personal Data by informing our Data Protection Officer (as defined below) in writing or by email at the contact address provided below, so that we can ensure that the Personal Data we collect is current.

With which purpose do we process your Personal Data?

In compliance with the provisions of Spanish Law 1581 of 2012, which establishes the provisions for Personal Data protection, as well as any applicable national legislation, we inform you that at Bimba & Lola we process the Personal Data you provide us with for the following purposes:
a) to process your registration as a customer and manage the buying process ("Purpose 1");
b) to send commercial communications about Bimba & Lola's products (emails, phone calls, SMS, PUSH notifications, post, etc.) ("Purpose 2");
c) the preparation of commercial profiles based on information from internal and external sources, with the aim of sending you personalized advertising and analyzing your purchasing behavior ("Purpose 3");
d) abuse and fraud prevention (fraudulent activities, denial-of-service attacks, among others) ("Purpose 4");
e) disclosure of data to public bodies and authorities (administrative or judicial) or private entities in the terms included in chapter 5 of these policies, provided that this is required under the legal and statutory provisions ("Purpose 5"); and
f) management of our telephone customer service, in which the conversations may be recorded in order to attend to the queries and requests made, as well as guarantee their quality (“Purpose 6”).

What is the legitimation of the processing of your Personal Data?

The lawful bases for the processing of your Personal Data corresponding to each of the purposes (1) to (5) included in Section 2 above (“Purposes”) are as follows:
Purpose (1): The execution of a contract with Bimba & Lola in relation to the purchase.
Purpose (2): Consent expressly given to Bimba & Lola at the time your Personal Data are collected.
Purpose (3): Consent expressly given to Bimba & Lola at the time your Personal Data are collected in relation to the preparation of profiles based on external sources and the satisfaction of a legitimate interest pursued by Bimba & Lola in relation to the preparation of profiles based on internal sources.
Purposes (4) and (5): The legal and contractual discharge of responsibilities applicable to Bimba & Lola.
Purpose (6): (i) The execution of a contract between the customer and Bimba & Lola, when the enquiry or request is related to products acquired from Bimba & Lola (order status, returns, etc.) and (ii) the legitimate interest of Bimba & Lola in attending to and resolving queries or requests that are not intended for purchases made from Bimba & Lola.

To which recipients will your Personal Data be communicated?

Your personal data may be accessed by our suppliers when it is necessary for the correct provision of services and execution of the purposes for which the data was obtained. In this sense, your personal data may be accessed by:
(i) transport and logistics companies,
(ii) financial entities, fraud detection and prevention,
(iii) customer service providers,
(iv) technology and analytics service providers,
(v) advertising and digital marketing providers that, in certain cases, may act as co-controllers of the treatment.

In addition, your data may also be disclosed to public bodies and authorities (administrative or judicial) in those cases in which a legal regulation thus establishes it.

How will we protect and store Personal Data?

We will establish reasonable security measures to ensure that Personal Data is adequately protected and kept secure. This includes the establishment of reasonable measures to prevent access, collection, use, disclosure, copying, modification, filtration, damage or alteration of unauthorized processing of Personal Data. However, we will not be responsible for any unauthorized use of Personal Data by third parties that is attributable to factors that our beyond our reasonable control.

When Personal Data in our possession is no longer necessary for any reason related to the Purpose for which it was originally collected, or it is no longer necessary that we keep it for any other legal or commercial purpose, we will take measures to ensure that such Personal Data is destroyed or anonymized.

Please note that no method of online transmission or electronic storage is completely secure. While security cannot be fully guaranteed, we strive to protect the security of Personal Data and constantly review and improve our data security measures.

How long will we keep your data?

Your data will be kept as long as we have a contractual relationship, or until you request its cancellation, as well as for the time necessary to comply with our legal obligations.

What are your rights when you provide us with your Personal Data and how can you exercise them?

You have the right to the following:
a) Access your Personal Data, as well as request rectification of inaccurate data or,
b) Where applicable, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
c) Withdraw any consent you have given to the collection, use or disclosure of any of your Personal Data that is in our possession or under our control.
d) In certain circumstances, you will be able to request the limitation of the processing of your data, in which case we only will keep it for the exercise or defense of claims.
e) In certain circumstances and for reasons related to your particular situation, you will be able to oppose the processing of your data. Bimba & Lola will cease to process your data, except for imperative legal reasons, or for the exercise or defense of possible claims.
f) In the same way, you can exercise your right to data portability, as well as to withdraw the consent given at any time, without this affecting the legality of the processing based on the consent given prior to its withdrawal.

If you wish to exercise any of your rights, you can contact us in writing at our email address lopd@bimbaylola.com or our postal address BIMBA Y LOLA COLOMBIA SAS. Avenida Kr 7 # 60 A - 54 Oficina 102, Bogotá D.C., Colombia and/or Bimba & Lola Parque Tecnológico y Logístico de Vigo, nave D13 (36315 – Vigo – España).. In the existence of any reasonable doubts surrounding the identity of the person exercising their rights, we may request a copy of an official identifying document (DNI, driving license or passport) in order to verify the applicant's identity.

Any claim applicable to these policies will be subject to the following procedure:
All claims must be submitted by the holder or any person with the sufficient powers, and they must contain at least the following details: 1) identification of the Holder by means of a copy of their ID document; 2) description of the facts giving rise to the claim; 3) the holder's specific request; and 4) address and means of contact. The submitter may attach any other documents they consider appropriate. If, for any reason, Bimba & Lola receives a claim that should not be brought against it, the interested party will be informed thereof within five (5) days of receiving the claim.

If applicable and/or the claim does not include any of the requirements, the interested party will be required to remedy this within five (5) days of receipt. If the requesting party does not submit a reply within two (2) months of the date of request, it will be deemed that the claim has been withdrawn.

Once the claim has been received by the holder in due form, it will be resolved within thirty (30) business days from the day following the date of its receipt. If the claim cannot be resolved within this time frame, the interested party must be informed before the deadline about the reason for the delay and the date in which it will be resolved, which in no case will exceed eight (8) business days from the lapse of the first deadline.

This privacy policy is valid as of April 26, 2022. However, Bimba & Lola reserves the right to amend it within the terms of the applicable law.