Legal

Privacy policy

This policy explains which personal data we process when you use www.pekata.ch, for what purpose, for how long and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

1. Data controller

  • Company name: Reloting, S.L. (trading name: Pekata)
  • NIF: B19932771
  • Registered office: C/ Casanova 270, Ático 1ª, 08021 Barcelona (Spain)
  • E-mail: [email protected]
  • Domain name: www.pekata.ch

Reloting, S.L. is not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any question relating to this policy you can write to the e-mail address given above.

2. What data we process and why

a) Quote request

  • Data collected: first name and surname, company, e-mail address, telephone (optional), delivery country and postcode, intra-Community VAT number (optional, for European Union companies outside Spain), desired delivery date, comments and the products, quantities and branding you have chosen.
  • Purpose: to prepare and send you the quote, answer your questions about it and manage the order if you accept it.
  • Legal basis: the application of pre-contractual measures at your request (Art. 6(1)(b) GDPR). The subsequent commercial follow-up of your request is based on our legitimate interest in attending to those who have asked us for a quote (Art. 6(1)(f) GDPR); you can object to it at any time.
  • Origin of your visit: with your request, and also when you ask for samples or make a purchase from the site or contact us via WhatsApp or email buttons, we record where you arrived from: the page through which you entered, the referring website, and, if you come from an advert, the click identifier and the campaign. This helps us understand which advertising brings us customers, based on our legitimate interest (Art. 6.1.f GDPR). We do not share this with Google or anyone else if you have not accepted analytics and advertising cookies; if you have accepted them, when you send us your request, and again if it results in an order, we communicate this to Google Ads (with the click identifier or, if there is none, with your pseudonymised email address) and to Google Analytics, to measure the effectiveness of our campaigns. In that case, we also communicate it to Meta (Meta Platforms Ireland Limited), with your pseudonymised email address, to measure the effectiveness of our campaigns on Facebook and Instagram. In that case, we also communicate it to Microsoft (Microsoft Ireland Operations Limited), with the click identifier if you arrived from one of its adverts and your pseudonymised email address, to measure the effectiveness of our campaigns on Bing. In that case, we also communicate it to OpenAI (OpenAI Ireland Limited), with the click identifier if you arrived from one of its adverts in ChatGPT, the browser reference kept by its pixel (__obref) and your pseudonymised email address, to measure the effectiveness of our campaigns in ChatGPT.

b) Logo

  • Data processed: the file containing your logo, if you decide to send it to us after requesting the quote.
  • Purpose: to prepare the branding mock-up and, if you accept the quote, to produce the order.
  • Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR).

c) VAT number verification

If you provide us with an intra-Community VAT number, we check it in the European Commission's VIES system in order to apply the correct tax treatment to your quote. The check is an automated query to the European Union's public service and is based on compliance with our tax obligations (Art. 6(1)(c) GDPR).

d) Browsing the site

The servers record technical data for each request (IP address, date and time, page requested and browser) for the sole purpose of ensuring the security of the service and detecting abuse, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

In addition, if you accept them in the cookie notice, we use Google analytics and advertising cookies (Google Analytics 4 and Google Ads, loaded through Google Tag Manager) to measure the use of the site and the effectiveness of our campaigns. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time; if you do not give it, they are not installed. You will find details of these cookies and of the rest of the storage your browser uses in the Cookie policy.

Apart from those cookies, we count the steps of a visit in aggregate and without cookies: when a page loads, the product list is seen, a product page is opened or a quote request is sent, your browser makes a request to our own server, which is kept in its access logs together with the technical data of any request (IP address, page and date). We store nothing on your device and do not use it to identify you: it tells us at which point visitors leave the site so that we can improve it, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

In product listings we also count, in the same way, which products are shown, in which position and which ones are clicked or added to a quote request. The counts are added up per product and day, without linking them to any visit or storing anything on your device, and we use them to order the catalogue by what is actually of interest, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

If you have not accepted analytics and advertising cookies and you arrive at the site from an advert, from another website (a search engine, for example), or from a link with a campaign reference, the page through which you enter notifies our server. This stores where you arrived from (the click identifier and the campaign if you come from an advert, the campaign reference of the link, the landing page, and the referring website) associated with a pseudonymised fingerprint (an irreversible hash) of your IP address and your browser, for 30 days if you come from an advert and 14 in other cases. This allows us to attribute the request you send us later, even if you have visited other pages. We store nothing on your device and do not share it with Google or anyone else; the basis is our legitimate interest (Art. 6.1.f GDPR) in knowing which advertising and channels bring us customers.

If you contact us via WhatsApp or email from the site's buttons, the message includes a short reference to your visit (for example, "ref. K7Q2PM") that you can see and delete before sending it. Under this reference, we store for 30 days where you arrived at the site from, as described in the previous paragraph, to attribute the quote we prepare from your message. The click identifier of an advert is only associated with your request if you have accepted analytics and advertising cookies. The basis is the same: our legitimate interest (Art. 6.1.f GDPR).

e) Ordering and paying for samples and purchases by card

  • Data collected: first name and surname, e-mail address, telephone (optional), company, VAT number, billing and delivery addresses, the samples or products you order and the outcome of the payment. Card details are processed directly by Stripe: we neither see nor store them, only the card brand and its last four digits.
  • Purpose: to handle your sample request or your purchase, charge for it, prepare it and ship it through our suppliers, issue the invoice and link it to your quote. Before payment we check, with Cloudflare Turnstile, that the person paying is a human.
  • Legal basis: the performance of the contract for the purchase of the samples or products (Art. 6.1.b GDPR), compliance with our tax and accounting obligations (Art. 6.1.c GDPR) and our legitimate interest in preventing payment fraud (Art. 6.1.f GDPR).
  • Retention: for the duration of the business relationship and, afterwards, for the periods required by commercial and tax legislation.

3. Retention periods

We keep the data from your request while the quote is being handled and, if it becomes an order, for the duration of the commercial relationship and the periods required by commercial and tax legislation. A quote that does not become an order is kept for a maximum of two years from the last contact. The servers' technical logs are kept for a maximum of twelve months. Once these periods have elapsed, or your request for erasure has been dealt with, the data will be blocked — available exclusively to judges, courts and public authorities — for the limitation periods of any potential liabilities (Art. 32 LOPDGDD) and destroyed thereafter.

4. Recipients and data processors

We do not disclose your data to third parties, except where legally required. To provide the service we rely on data processors with whom we have signed the contracts required by Article 28 GDPR:

  • Hetzner Online GmbH (Germany): hosting of the site and of our platform, within the European Economic Area.
  • ActiveCampaign, LLC (Postmark) (United States): sending of transactional e-mails, such as the confirmation of your quote request.
  • Google Ireland Limited (Ireland): web analytics and advertising tags (Google Analytics 4 and Google Ads, through Google Tag Manager), subject to your acceptance of cookies.
  • Stripe Payments Europe, Limited (Ireland): card payment for samples and purchases and fraud prevention. For part of that processing, such as fraud prevention, Stripe acts as an independent controller.
  • Cloudflare, Inc. (United States): the Turnstile security check before samples and purchases are paid for.

If the quote becomes an order, we will pass on to the manufacturers and suppliers who produce and brand the products, all of them established in the European Union, the data strictly necessary to manufacture and deliver it: the logo, the contact details and the delivery address.

If you order samples, the supplier that prepares and ships them receives the data strictly necessary to deliver them: the name of the recipient, the delivery address and, if they carry your logo, the design.

5. International transfers

If you pay by card for samples or a purchase, Stripe and Cloudflare may process data in the United States (Stripe, Inc. and Cloudflare, Inc.), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which both are certified, and, in the alternative, by the standard contractual clauses.

If advertising cookies are accepted, we also use the Meta pixel (Meta Platforms Ireland Limited, Ireland) to measure the effectiveness of our campaigns on Facebook and Instagram. This may involve transfers of data to Meta Platforms, Inc. (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Meta is certified. The details are in the Cookie Policy.

If advertising cookies are accepted, we also use the Microsoft Advertising Universal Event Tracking tag (Microsoft Ireland Operations Limited, Ireland) to measure the effectiveness of our campaigns on Bing. This may involve transfers of data to Microsoft Corporation (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Microsoft is certified. The details are in the Cookie Policy.

If advertising cookies are accepted, we also use the OpenAI Ads measurement pixel (OpenAI Ireland Limited, Ireland) to measure the effectiveness of our campaigns in ChatGPT. This may involve transfers of data to OpenAI OpCo, LLC (United States), covered by the safeguards provided for in the GDPR, such as the standard contractual clauses approved by the European Commission. The details are in the Cookie Policy.

Sending transactional e-mails through Postmark may involve a transfer of data to the United States. This transfer is covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified, and, in the alternative, by the standard contractual clauses approved by the European Commission. If you accept the analytics and advertising cookies, Google's services may also involve transfers to Google LLC (United States), covered by the same adequacy decision, under which Google is certified. No other transfers outside the European Economic Area are envisaged.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time. Simply write to [email protected] stating the right you wish to exercise; we may ask you for additional information to confirm your identity.

If you consider that we have not handled your rights properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

7. Security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, protecting the data against unauthorised access, loss, destruction or accidental damage.

8. Shipments outside the European Union

For orders delivered to Switzerland, Liechtenstein, Norway, Iceland or the United Kingdom, we also process the importing company's tax identifier, which is included on the invoice and export documents, and we communicate the shipment details (company, contact person, address, phone number, tax identifier and contents) to the carrier and customs for clearance. This is based on contract execution and compliance with customs and tax obligations.

9. If you are in Switzerland

The Swiss Federal Data Protection Act (nLPD), dated 25 September 2020, also applies. Spain is among the countries recognised by Switzerland as having an adequate level of data protection. In addition to the Agencia Española de Protección de Datos (Spanish Data Protection Agency), you can lodge a complaint with the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).