1. 1. THB.ORIGINAL® PRIVACY POLICY

This Privacy Policy has been developed taking into account the provisions of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the movement of such data, hereinafter the GDPR, as well as the Organic Law 3/2018 of 5 December on Data Protection and Digital Rights (hereinafter LOPDGDD) and other applicable regulations.

The purpose of this Privacy Policy is to inform individuals who provide their personal data, and/or those of the person about whom information is being collected, of the specific aspects relating to the processing of their data, the purposes of the processing, the contact details for exercising their rights, the periods of conservation of the information and the security measures, among other things.

USER INFORMATION

Who is responsible for the processing of your data?

In terms of data protection Vanesa Caro González (hereinafter, “THB”) should be considered Data Controller in relation to the processing identified in this policy.

The following are the identification data of the owner of this website:

• • Data Controller: Vanesa Caro González

• • Postal address: c/ Ginesta 55. cp 08840 Viladecans Barcelona

• • Email: thb.thehappybag@gmail.com

The data subject may contact the Data Controller with any questions or needs he/she may have regarding data protection.

What categories of data are processed?

All information collected by THB will be treated in a fair, lawful and transparent manner.

Likewise, the data requested in each of the processing carried out will consist only of those strictly necessary to carry out the intended purpose and informed in each case. Thus, your data collected will be adequate, relevant and not excessive in relation to the purposes for which they are processed in each case. Therefore, your personal data will be collected for specific, explicit and legitimate purposes, and will not be further processed in a manner incompatible with those purposes. Furthermore, they will be updated whenever necessary.

As part of the various processing activities carried out by THB, the following types of data are collected:

• • Identifying data.

• • Commercial information.

• • Goods and services transactions.

• • Economic and financial data.

• • Social circumstances.

• • Personal characteristics.

• WHERE DOES THE PERSONAL DATA COME FROM?

As a general rule, personal data is always collected directly from the data subject, however, in certain exceptions, data may be collected through third parties, entities or services other than the data subject.

In this sense, this will be communicated to the interested party through the informative clauses contained in the different information collection channels and within a reasonable period of time or in the first communication made to the interested party.

• FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA?

In general terms, personal data are processed for the following purposes:

• • User registration management: The information you provide in the registration form will be processed for the management of users on our platforms. After registering, you will be able to view your order history, redeem gift cards or discount vouchers, update your personal details and/or shipping and billing addresses, and manage wish lists, reviews, or alerts.

• • Management, fulfillment, and execution of the purchase contract: Specifically, personal data will be used to formalize the purchase contract; to manage payment transactions; to contact you in case of any issues related to your order; to handle invoicing and the delivery of purchase receipts and invoices; to manage returns of purchased products; to inform you about the availability of requested products; and/or to manage coupons or gift cards redeemed on the website or in our stores.

• HOW IS PROFILING PERFORMED?

THB may elaborate a commercial profile based on the information provided by the interested party and his/her interactions with the contents offered in order to send him/her personalized information about our products or services, including by electronic means. The legitimate basis for profiling is THB’s legitimate interest in knowing the profile of the interested party in its communications and services in order to offer him/her personalized information and contents adapted to his/her interests and activity. No automated decisions will be made based on this profile. The user may at any time object to the profiling of their information through the channel provided for this purpose.

• • Subscription to our Newsletters: We will process your identifying and contact data to send you personalized information about our products, promotions, and offers, as well as products and offers from group companies. To achieve this purpose, we create a user profile that allows us to personalize the information we send you, tailored to the tastes and preferences we know based on your browsing habits, purchase history, or even information collected through the use of cookies and other similar technologies (for more information on the use of cookies, please visit our Cookies Policy).

• • Other marketing and advertising purposes: We will use your data to suggest products or offers based on the profile created from your purchase history, the products you view while browsing our platforms, or the products left in your cart when you do not complete the purchase process. These suggestions may reach you via push notifications, banners, or even email through the abandoned cart feature. Likewise, we will process your data to show you advertising on other websites, apps, or social networks you frequent. This advertising is usually based on a profile created according to your past purchases, purchase history, or preferences through the use of cookies and other similar technologies (for more information on the use of cookies, please visit our Cookies Policy).

• WHAT IS THE LEGAL BASIS FOR DATA PROCESSING?

As a general rule, prior to the processing of personal data, THB informs the legal basis on which it establishes the legitimacy of the processing in question. However, THB may process personal information for the following purposes:

• • Compliance with Legal and Regulatory Obligations: By way of example and not limitation, the following will apply: the General Law for the Protection of Consumers and Users, the General Tax Law, the Corporate Tax Law, the Audit Law, the Value Added Tax Law, the Civil Code, the Commercial Code, as well as the existence of any specific law or regulation that authorizes or requires the processing of the data of the data subject, which will be specified in the corresponding privacy clause.

• • Contract Execution: For the prior management of a contracted service or product, the execution of a contract, or subsequent operations arising from such transactions.

• • Consent: Some data processing is based on obtaining the explicit and unequivocal consent of the data subject, through the inclusion of informed consent clauses in the various information collection systems, with consent given by a declaration or a clear affirmative action, such as checking a box, clicking an “accept” button provided for this purpose, or signing the appropriate document. Additionally, we inform you that we will only use personal data under this Privacy Policy and, in general, we will request your consent for uses other than those for which it was originally granted.

• • Legitimate Interest: Data processing based on the legitimate interest of the Data Controller will be established primarily for sending communications or commercial events about products or services similar to those contracted. According to Article 21.2 of the Law on Information Society Services, this processing will only be valid when, as a customer, you have not expressly opted out at the time of data collection or in any of the communications we send.

• HOW LONG DO WE PROCESS PERSONAL DATA?

Personal data are processed for the time necessary to fulfill the purpose for which they were collected, as long as the service is provided or the employment or contractual relationship is maintained, there is a mutual interest and/or for the time provided for in the relevant regulations.

Once the established time criteria have been met, the data will be cancelled. Such cancellation will result in the blocking of the data being kept only at the disposal of the Public Administrations, Judges and Courts, to meet the possible liabilities arising from the treatment, during the period of limitation of these, after the aforementioned period will proceed to the destruction of the information.

• WITH WHOM DO WE SHARE PERSONAL DATA?

The data will not be communicated to third parties, unless legally obliged to do so.

However, if necessary, such data transfers or communications are informed to the interested party through the informative clauses contained in the different ways of collecting personal data.

• ARE INTERNATIONAL TRANSFERS CARRIED OUT?

We inform you that, in general, no international transfers are made outside the European Economic Area (EEA). In the event of a transfer of data outside the EEA, THB will have the appropriate guarantees to carry out such transfer, in accordance with the requirements of the GDPR.

• WHAT RIGHTS CAN YOU EXERCISE?

According to European regulations, your rights are as follows:

• HOW TO EXERCISE YOUR RIGHTS?

Interested parties may exercise the rights indicated. In this sense, you can exercise your rights through the following means:

• • Send a message to thb.thehappybag@gmail.com providing documentation that proves the identity of the requester (a copy of the front of your National Identity Document, or equivalent), and indicate in the subject line the right you wish to exercise.

At THB we make every effort to comply with data protection regulations. However, we inform you that in the event that the interested party understands that their rights have been undermined, they can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

THB will respond to your request as soon as possible and taking into account the deadlines set forth in the regulations on data protection.

• WHAT COULD BE THE CONSEQUENCES OF NOT PROVIDING THE INFORMATION?

The data requested in the fields marked with an asterisk (*) or those provided in the documents or media where the information is provided, are those strictly necessary in relation to the purpose for which they are collected, or for the provision of an optimal service to the data subject or through a legal obligation imposed on the data controller or a requirement necessary to enter into a contract, being voluntary the inclusion of data in the remaining fields.

If not all data is provided, there is no guarantee that the information and services provided will be completely tailored to your needs.

In the event that the required information is not provided or is provided incorrectly or incompletely, we will not be able to attend your request, making it impossible to provide you with the requested information or to carry out the contracting of the services.

In the same way, the user guarantees that the information transmitted in any of the forms is truthful, accurate and corresponds to his/her own data.

The services offered are not intended for children under 14 years of age, otherwise we warn that any liability that may arise as a result of the use of our platforms will be borne by the parents or guardians of the minor.

To avoid the use of our services by minors, we try to verify the age of our users when they register or purchase a product by requesting their date of birth.

• SECURITY MEASURES

The security measures adopted by e-commerce are those required, in accordance with the provisions of Article 32 of the RGPD.

In this regard, THB, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, has established the appropriate technical and organizational measures to ensure the level of security appropriate to the existing risk.

In any case, THB has implemented sufficient mechanisms to:

• • Ensure the ongoing confidentiality, integrity, availability, and resilience of the processing systems and services.

  • Restore the availability of and access to personal data quickly in the event of a physical or technical incident.

  • Regularly verify, assess, and evaluate the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.

• CHANGES TO THIS PRIVACY POLICY

From time to time, this Privacy Policy may be revised in order to update changes in current legislation, update the procedures for collecting and using personal information, the emergence of new services or the exclusion of others. These changes will be effective upon their publication on the web, so it is important that you regularly review this Privacy Policy in order to remain informed about the changes made.