Privacy policy

Basic information on data protection

This English version is a translation provided for information. In case of discrepancy, the Spanish version prevails.

- Controller: Tangram Consulting.

- Purpose:

• Provision of online services.

• Management of website users.

• Commercial communications related to our services.

- Legal basis: Express consent and legitimate interest.

- Recipients: Data is not disclosed to third parties, except where required by law.

- Rights: To access, rectify and erase the data, as well as other rights, as explained in the additional information.

At Tangram Consulting we work to offer you the best possible experience through our products and services. In some cases, we need to collect information to achieve this. We care about your privacy and we believe we should be transparent about it.

Therefore, and for the purposes of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (hereinafter, “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and of Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y de Comercio Electrónico (Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce; hereinafter, “LSSI”), Tangram Consulting informs the user that, as data controller, it will include the personal data provided by users in an automated file.

Our commitment begins by explaining the following:

• Your data is collected to improve the user experience, taking into account your interests and needs.

• We are transparent about the data we obtain about you and the reason why we do so.

• Our intention is to offer you the best possible experience. Therefore, whenever we use your personal information we will always do so in compliance with the regulations and, where necessary, we will ask for your consent.

• We understand that your data belongs to you. Therefore, if you decide not to authorise us to process it, you can ask us to stop processing it. Our priority is to guarantee your security and to process your data in accordance with European regulations.

If you would like more information about the processing of your data, see the different sections of the privacy policy below:

Who is the controller of your personal data?

Identity: Tangram Consulting - Experts in technological and digital consulting S.L.

Registered office: C/ Cardenal Benlloch 11

Tax ID (C.I.F.): B-40521676

Email: info@lcprivacidad.com

Tangram Consulting has appointed a Data Protection Officer or an internal contact person within its organisation. If you wish to make an enquiry about the processing of your personal data, you can contact them at info@lcprivacidad.com

What personal data do we collect?

The personal data the user may provide:

• Name, address and date of birth.

• Telephone number and email address.

• Location.

• Information on payments and returns.

• IP address, date and time you accessed our services, the internet browser you use and data about the operating system of your device.

• Any other information or data you decide to share with us.

In some cases, filling in the registration form is mandatory to access and enjoy certain services offered on the website; likewise, not providing the personal data requested or not accepting this data protection policy means that it will not be possible to subscribe, register or take part in any of the promotions in which personal data is requested.

Why and for what purpose do we process your data?

At Tangram Consulting we process the information provided by data subjects for the following purposes:

• To manage orders or the contracting of any of our services, whether online or in physical shops.

• To manage the sending of the information they request from us.

• To carry out commercial actions and to maintain and manage the relationship with the user, as well as to manage the services offered through the website and information tasks, which may include automated assessments, profiling and customer segmentation in order to personalise our dealings according to their characteristics and needs and to improve the online experience of the customer.

• To run and manage the competitions, prize draws or other promotional activities that may be organised.

• In some cases it will be necessary to provide information to the Authorities or to third-party companies for audit purposes, as well as to handle personal data from invoices, contracts and documents to respond to complaints from customers or from Public Administrations

We inform you that the personal data obtained as a result of your registration as a user will form part of the Record of Processing Activities (Registro de Actividades de Tratamiento, RAT), which will be updated periodically in accordance with the GDPR.

What is the legal basis for processing your data?

The processing of your data may be based on the following legal grounds:

• Consent of the data subject for contracting services and products, for contact forms, information requests or signing up to e-newsletters.

• Legitimate interest for processing the data of our customers in direct marketing actions, and express consent of the data subject for everything related to automated assessments and profiling.

• Compliance with legal obligations for fraud prevention, communication with public Authorities and third-party claims.

How long do we keep your data?

Data will be processed for the purposes described for as long as necessary to fulfil the purpose for which it was collected (for example, for as long as the business relationship lasts), as well as to comply with the legal obligations arising from the processing of the data.

To which recipients is your data disclosed?

In some cases, and only when necessary, Tangram Consulting will provide user data to third parties. However, data will never be sold to third parties. The external service providers (for example, payment providers or delivery companies) that Tangram Consulting works with may use the data to provide the corresponding services; however, they will not use that information for their own purposes or disclose it to third parties.

Tangram Consulting seeks to guarantee the security of personal data when it is sent outside the company and makes sure that third-party service providers respect confidentiality and have adequate measures to protect personal data. These third parties are obliged to guarantee that the information is processed in accordance with data privacy regulations.

In some cases, the law may require personal data to be disclosed to public bodies or other parties; only what is strictly necessary to comply with those legal obligations will be disclosed.

The personal data obtained may also be shared with other companies of the group.

Where is your data stored?

As a general rule, data is stored within the EU. For data sent to third parties outside the EU, we will make sure that they offer a sufficient level of protection, either because they have Binding Corporate Rules (BCR) or because they have joined the “Privacy Shield”.

What rights do you have and how can you exercise them?

You can send your communications and exercise your rights by making a request to the following email address: info@lcprivacidad.com. Under the GDPR you can request:

• Right of access: you can ask for information about the personal data we hold about you.

• Right to rectification: you can tell us about any change in your personal data.

• Right to erasure and to be forgotten: you can ask for the personal data to be deleted, after it has been blocked.

• Right to restriction of processing: this means restricting the processing of the personal data.

• Right to object: you can withdraw your consent to the processing of the data, objecting to it being processed any further.

• Right to data portability: in some cases, you can ask for a copy of the personal data in a structured, commonly used and machine-readable format to transmit it to another controller.

• Right not to be subject to individual decisions: you can ask that no decisions be taken based solely on automated processing, including profiling, that produce legal effects or significantly affect the data subject.

In some cases, the request may be refused if you ask for the deletion of data needed to comply with legal obligations. Likewise, if you have any complaint about the processing of the data, you can lodge a complaint with the data protection authority.

Who is responsible for the accuracy and truthfulness of the data provided?

The user is solely responsible for the truthfulness and correctness of the data included, releasing Tangram Consulting from any liability in this regard. Users guarantee and are in any case responsible for the accuracy, validity and authenticity of the personal data provided, and undertake to keep it duly up to date. The user agrees to provide complete and correct information in the registration or subscription form. Tangram Consulting reserves the right to terminate the contracted services entered into with users if the data they have provided is false, incomplete, inaccurate or out of date.

Tangram Consulting is not responsible for the truthfulness of information that it has not produced itself and for which another source is indicated, and therefore assumes no liability for any hypothetical damage that may arise from the use of that information.

Tangram Consulting reserves the right to update, modify or delete the information contained on its websites, and may even limit or block access to that information. Tangram Consulting is released from liability for any damage or loss that the user may suffer as a result of errors, defects or omissions in the information provided by Tangram Consulting, provided that it comes from sources outside it.

Likewise, the user certifies that they are over 14 years of age and that they have the legal capacity needed to give consent to the processing of their personal data.

How do we process the personal data of minors?

In principle, our services are not specifically aimed at minors. However, if any of them is aimed at children under fourteen, in accordance with article 8 of the GDPR and article 7 of Ley Orgánica 3/2018, de 5 de diciembre (LOPDGDD; Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights), Tangram Consulting will require the valid, free, unambiguous, specific and informed consent of their legal guardians to process the personal data of the minors. In this case, the DNI (Spanish national identity document) or another form of identification of the person giving consent will be required.

For those over fourteen, the data may be processed with the consent of the user, except in cases where the law requires the assistance of the holders of parental authority or guardianship.

What security measures do we apply to protect your personal data?

Tangram Consulting has adopted the legally required levels of security for the protection of Personal Data, and seeks to install any other additional technical means and measures within its reach to prevent the loss, misuse, alteration, unauthorised access and theft of the Personal Data provided to Tangram Consulting.

Tangram Consulting is not responsible for any hypothetical damage or loss that may arise from interference, omissions, interruptions, computer viruses, telephone faults or disconnections in the operation of this electronic system caused by reasons beyond the control of Tangram Consulting; from delays or blockages in the use of this electronic system caused by deficiencies or overloads of telephone lines or overloads in the Data Processing Centre, in the Internet system or in other electronic systems; or from damage that may be caused by third parties through unlawful interference beyond the control of Tangram Consulting. Notwithstanding the above, the user should be aware that security measures on the Internet are not impregnable.

Links to other websites

The website https://qrplus.es/ may contain links to other websites. When you click on one of these links and access an external website, your visit will be subject to the privacy policy of that website, and Tangram Consulting accepts no liability whatsoever for its privacy policy.

How do we use cookies?

The Tangram Consulting website uses cookies to optimise and personalise your browsing on it. Cookies are physical information files stored on the user’s own device; the information collected through cookies serves to make it easier for the user to browse the site and to optimise the browsing experience. The data collected through cookies may be shared with their creators, but in no case will the information obtained through them be associated with personal data or with data that could identify the user.

However, if the user does not want cookies to be installed on their hard drive, they can configure their browser to prevent these files from being installed. For more information, see our Cookie Policy.

Can the privacy policy be changed?

This privacy policy may be changed. We recommend that you review the privacy policy from time to time.

Purchases in the QR shops

When you buy in the shop of a QR, Tangram Consulting processes your name, email, phone number, shipping address and the order details to manage the purchase, the payment, security and later requests (withdrawal, warranty, claims), because it is necessary for the contract and required by law.

The seller shown on the product page («Sold by…») receives the data strictly needed to deliver the order and handle your requests, and processes it as controller for that purpose. Stripe processes the payment under its own terms; QRplus does not store the card details.

The data of each order is kept for as long as needed to handle it and, afterwards, during the legal periods for claims and for tax and accounting record-keeping (generally, 6 years).

Sellers also provide their identification details (name or company name, tax ID (NIF), address and contact) and those of their business, which QRplus uses to verify their identity, show them to buyers and comply with the reporting obligations to the Spanish Tax Agency (Agencia Tributaria) that apply to it as a platform.

Data from the QR pages

Data of whoever visits a page: we count visits and clicks without cookies or identifiers. We only store the type of device, the operating system, the browser, the language and the website the visitor comes from; we do not store the IP address.

Page chat: the name, the email (if requested) and the message of whoever writes, so that the person behind the QR can reply. Only those who tick the box are signed up to its updates.