PRIVACY POLICY

So that you can know how we may process your personal data, as well as know your rights, we answer many of the questions that may arise regarding the processing of personal data provided by you so far, as well as those you may provide us in the future.

1. Who is the data controller?

Khatnani, S.L. ("esennia" and/or the "Company"), with registered office at Calle Los Dragos, nº 43, Polígono Industrial de Arinaga, Agüimes, C.P. 35.118, Las Palmas, Tax ID No. B-35.110.154, registered in the Commercial Registry of Las Palmas, Volume 494, Book 308, Section 3, Folio 16, Sheet GC 2759.

2. What is the Data Protection Officer ("DPO") and how can I contact?

esennia, as a good business practice and committed to protecting its customers/users data, has a DPO, responsible for ensuring the correct application of its data protection policy.

3. What personal data do we process?

On occasions, you provide them to us (i) by creating an online/app account to make your purchases; (ii) by subscribing to our newsletters; (iii) by being part of the Friendly Card loyalty program; (iv) by interacting with us on social networks and/or; (v) by filling in forms that we may make available to you. In other cases, we collect them directly, for example, by using cookies to understand how you use our website/app. View Cookie Policy.

Thus, according to the information provided, we collect data such as (i) ID card number; (ii) name and surname; (iii) postal address; (iv) date of birth; (v) email address; (vi) phone number; (vii) the connection with the members of your family unit as long as they have previously provided us with their data and request to belong to Friendly Card Family and/or; (viii) your workplace or profession when you are part of a group such as Friendly Card Empresa or MyPartnerCard. Occasionally, data about your personal characteristics or any other information you voluntarily send us is also collected, such as skin type in order to tailor our advertising offers to your convenience.

If you have decided to send us your Curriculum Vitae to be part of future recruitment processes, we may process it, as well as the relevant information you provide during the selection process.

4. What do we use your data for?

At esennia, we process your personal data with the utmost respect, transparency, and with adequate and relevant information for the following purposes:

1. Fulfill contractual obligations assumed with you:
   1. Management and delivery of your orders and answering questions about them.
   2. Contact you regarding any incident through Customer Service.
   3. Inform you of the availability of a product that has been requested and/or reserved.
   4. Track your order.
   5. Manage payment.
   6. Manage offers and promotions.
   7. Manage purchase incidents.
   8. Measure your satisfaction.
   9. Manage your participation in contests, games, and surveys.
   10. Show you the nearest store to your location.
   11. Manage vouchers generated by purchases made with esennia payment cards.
2. Comply with obligations provided in applicable legislation.
3. Carry out promotional, advertising, or service initiatives of esennia:
   1. Management and delivery of your orders and answering questions about them.
   2. Contact you regarding any incident through Customer Service.
   3. Inform you of the availability of a product that has been requested and/or reserved.
   4. Track your order.
   5. Manage payment.
   6. Manage offers and promotions.
   7. Manage purchase incidents.
   8. Measure your satisfaction.
   9. Manage your participation in contests, games, and surveys.
   10. Show you the nearest store to your location.
   11. Manage vouchers generated by purchases made with esennia payment cards.
4. If you do not formalize any contractual relationship directly, we will keep your data previously provided by you, for example, Newsletter subscriptions, to inform you of our commercial news and, where appropriate, manage future requests you may make.
5. Maintenance of updated suppression lists to avoid being contacted if you request it.
6. Behavioral advertising insertion:
   1. Show you online ads of products that may be of interest to you, based on your previous behavior.
   2. Show you ads and content on social media platforms.
   3. Send you recommendations, marketing, or content based on your profile and interests.
   4. Show you advertising based on segments automatically created when visiting our website, or making a purchase at esennia.
7. Carrying out statistics, which includes:
   1. Preparation of reports and statistics.
   2. Knowing users' reaction to our campaigns.
   3. Improving our offers.
   4. Knowing how you discovered our websites/app.
8. Recruitment process:
   1. Select personnel according to the training, skills, and attitude of candidates interested in joining our team.

5. Why can we use your data?

The legal basis for processing your data is the execution of the existing contractual relationship when subscribing to the Friendly Card loyalty program, when purchasing products online/app, when registering as an online user to purchase at that time or in the future, and managing your private online shopping area.

The sending of commercial communications is based not only on our legitimate interest consisting of the possibility of promoting our products or services provided by esennia among our customers of our store chains and online/app, but also on the requested consent, at the time of entering into the contractual relationship with us (adhesion to loyalty program, purchase relationship, etc.).

If you do not wish to receive our communications, you can object at any time through [email protected] or through the automatic unsubscribe procedure enabled in electronic communications.

When requesting subscription to our Newsletters, you consent to the processing of your data, having previously provided us with the necessary data for sending such newsletters. The analysis of your data and purchase habits is based on esennia's legitimate interest to be able to offer you the discounts and personalized offers that you may enjoy, as well as to personally facilitate those esennia services and products. If you do not wish this analysis to be carried out, you can object at any time.

We consider that, as a customer, you have a reasonable expectation of receiving this type of communications from esennia and that they are in line with your interests. However, you may exercise the right to object in relation to the indicated processing through [email protected].

The data that may be obtained at the time of your possible application to join our team, as well as in the subsequent selection process, will be processed by esennia to manage and maintain your possible candidacy for a job with us. By providing this information, you consent to the processing of your data, granting us the possibility of creating profiles to facilitate selection processes, based on our interest.

We also rely on our legitimate interest to carry out statistics that help us better understand your needs and expectations and thus improve our services, website/app. In addition, we are legitimately interested in the proper functioning of our website/app through technical and functional cookies, as well as in keeping our tools safe and secure, to ensure they work correctly and continuously improve.

6. How do we use social media?

We also collect data to improve your experience on some social networks.

If you have an account on social networks such as Facebook or Instagram, you may receive advertising from esennia if you have recently visited our website.

This marketing process is completely anonymous and automatic and is carried out thanks to social media cookies where we configure campaigns in which we establish that the recipients are visitors to our website. The configuration of these campaigns occurs anonymously and collectively, and the data and reports that Facebook may generate in this regard do not show individual information but collective information. Keep in mind that our profiles as social media users and the possible ads that appear to you on them will be governed by the privacy policy of the social media website we use. You can edit or delete the permissions you have granted to esennia in your social media accounts by using the privacy configuration option in the social media accounts you use.

7. How long will we keep your data?

We will keep your personal data for the time necessary for the stated purposes, in addition to five (5) years after the last interaction or expression of interest in esennia or our products.

If you have provided us with your Curriculum Vitae for recruitment processes, we will keep it active in our database for two (2) years from the time of receipt.

Once the contractual relationship has ended, we will keep your data blocked (only available to judges, courts, the Public Prosecutor's Office and/or competent Public Administrations) for the applicable legal statute of limitations periods.

After the indicated periods have elapsed, we will proceed to delete your data.

8. Who else may access your data?

We do not offer or sell your personal data.

Likewise, we inform you that, in order to manage the relationship we maintain with you for the processing and storage of data, as well as for sending communications, they may be transferred to, accessed from, and stored at a destination outside the European Economic Area ("EEA").

The Company only transfers personal data outside the EEA in a secure and legal manner, taking measures to ensure that third parties comply with the commitments established in this Policy. These steps may include reviewing third parties' privacy and security standards and/or entering into appropriate contracts (based on the standard data protection contractual clauses template adopted by the EU Commission).

Service providers located outside the EEA, such as Facebook, Inc or Google, LLC may access your personal data in an encoded manner. These service providers are subject to the "Privacy Shield" and, therefore, are required to protect your personal data in accordance with a series of protection rules and safeguards well defined by the European Union.

We inform you that we are currently not part of a group of companies nor do we have a business restructuring planned; if we were to become part of a corporate group in the future, we may transfer your personal information to the linked commercial entities. If this happens, we will inform you accordingly.

9. What rights do you have?

As a customer/user of the Company, you may exercise the following rights:

• Right of access to your personal data to know what data is being processed and the processing operations carried out with them.
• Right of rectification of any inaccurate personal data.
• Right of deletion of your personal data when they are no longer necessary for the purposes for which they were collected.
• Right to object, that is, to request that your personal data not be processed for reasons related to your personal situation.
• Right to withdraw your consent if it is the legal basis for the processing of your data.
• Right to request the restriction of the processing of your personal data:
  • While the accuracy of your data is being verified.
  • When processing is unlawful, which would determine the deletion of your data, but you oppose it.
  • When the Company does not need to process your data but you need them for the defense of claims.
  • When you have objected to the processing of your data for the fulfillment of a public interest mission or the satisfaction of a legitimate interest, while verifying whether the legitimate grounds for processing prevail over your personal situation.
• Right to data portability, that is, to receive the personal data you have provided to the Company, whenever possible, in a structured, commonly used, and machine-readable format, and to transmit them to another data controller. To exercise these rights, you may contact us at the following email address: [email protected], indicating in your request your full name and the right you are exercising, accompanied by a copy of your ID card or equivalent document proving your identity.
• Right to file a claim with the Spanish Data Protection Agency. Even so, do not hesitate to contact our DPO beforehand through [email protected] before filing a claim with the competent authority to clarify any incident that may have occurred. We seek to use organizational and technical measures to protect your personal information from any loss, misuse, unauthorized access or disclosure, alteration and/or destruction. Unfortunately, it is not possible to guarantee 100% security of any data transmission or storage system. If you suspect that your interaction with us is no longer secure, immediately notify our DPO through [email protected].

10. Does this policy affect third-party services?

We are not responsible for the privacy practices of third parties linked from our website/app. The inclusion of a third-party link on our website/app does not imply that we endorse their linked website or service.

11. What are cookies and what are their purposes?

Cookies also collect data, we tell you how.

We use analytics cookies on our website to obtain information about its use, such as the type of device, most viewed pages, or city of origin of the session. The information is processed with Google Analytics technology and allows us to obtain data and patterns about the behavior, in general, of all visitors. The use of these cookies does not allow us to track a specific user on an individual level.

We also use conversion cookies and pixels (small transparent Gifs) to obtain statistical information on which third-party advertisements such as Google Adwords or Facebook are effective on our website.

The information collected by cookies is always anonymous and we process it collectively and at a statistical level; we never collect personal individual data through cookies for visiting our website.