Privacy policy

 

Data Controller

HANNUN, S.A., with NIF number A67120683 and registered office at Carrer de la Conca de Barberà, 18 (Polígono Pla de la Bruguera) 08211 - Castellar del Vallès, Barcelona; company registered in the Mercantile Register of Barcelona, volume 46189, page 171, sheet B-512434. E-mail: data@hannun.com; Telephone: +34 932 20 94 73

 

Data Protection Officer

Contact: data@hannun.com

Purposes of Processing

(i) Attending to doubts, queries and complaints; (ii) Purchase/sale of products; (iii) Management of the 'Hannun Rewards' programme; (iv) Sending commercial, advertising and marketing information; (iv) Sending surveys and market studies; (v) Business development; (vi) Compliance with legal obligations; (vii) Management of selection processes; (viii) Administration of profiles on social networks. (ix) Managing the relationship with our investors.

Legitimation

The legal basis for processing your personal data will depend on the purposes mentioned above and may be (i) your consent; (ii) the performance of a contractual relationship; (iii) compliance with our legal obligations; (iv) or, in some cases, our legitimate interest.

Addressees

Personal data may be shared with entities that provide services to us, such as banks and financial institutions, shredding companies, advertising and marketing companies, and consultancy/advisory firms. These service providers may have access to your personal data, but they will process it on our behalf and in accordance with our instructions. Personal data may also be disclosed to public authorities, law enforcement agencies, judges and courts in compliance with our legal obligations.

 

Rights

You may exercise your rights of access, rectification, erasure, restriction of processing, opposition, portability, or withdrawal of consent, free of charge, by sending a written request to our postal address or by sending an e-mail to data@hannun.com.

ADDITIONAL INFORMATION ABOUT DATA PROTECTION

Contents:

1. Data Controller
2. Data Protection Officer
3. Origin of the data we obtain
4. Type of data we process
5. Purposes of processing and grounds for legitimisation 
6. Recipients
7. Conservation of the data
8. Exercise of rights by the owner
9. Complaints to the Data Protection Authority
10. Modifications to the Privacy Policy

1. Data Controller

The entity responsible for the processing of your personal data is HANNUN, S.A., NIF A67120683, domiciled at Carrer de la Conca de Barberà, 18 (Polígono Pla de la Bruguera) 08211 - Castellar del Vallès, Barcelona Registered in the Mercantile Register of Barcelona, volume 46189, page 171, sheet B-512434 (hereinafter, "Hannun").

1. Data Protection Officer

Hannun has appointed a Data Protection Officer with the Agencia Española de Protección de Datos (Spanish Data Protection Agency). If you wish to contact him, you can send an email to the following email address: data@hannun.com

1. Origin of the data we obtain

We may collect your personal information because you have provided it to us directly when you purchase our products, invest in our company, register on our website, request information from us, participate in our contests or surveys, participate in any of our official social networks, or engage in any other transaction or interaction with us. We may also obtain your information from the banks, companies and broker-dealers in which our shareholders have their shares deposited. We may also use publicly available sources, such as telephone directories or public registries, such as the National Statistics Institute, the Commercial Registry, the Land Registry and the Land Registry.

The personal data you provide us with must be correct, complete, accurate and duly updated. If the user does not provide the data requested by Hannun during the purchase process, we may not be able to process the request and formalise the purchase of the product.

If you are interested in participating in our recruitment processes, we may also obtain your data from third parties who collaborate with us in the search for candidates (external portals or employment consultancies) and who provide us with the data so that we can assess your application and possibly consider you for employment.

We may also automatically collect technical or behavioural data through your browsing on this website or third party websites by installing cookies or other tracking technologies or devices, as detailed in the Cookie Policy.

1. Types of data we process

Depending on the purposes and processing activities, we may process the following data:

• Identifying and contact information: name and surname, postal address, telephone number, email address, identification document details.
• Purchase and/or payment information: credit card or other similar payment method details and billing address.
• Purchase history information.
• Academic and professional experience information.
• Inferred data that we infer and/or obtain from data you have previously provided to us (such as when we create business profiles).
• After-sales service and product warranty information.
• Hannun Rewards programme data.
• Economic, financial, insurance and other data (such as shareholder reference number, securities accounts or rating code, and details of any proxy)
• Data arising from your relationship with us as a shareholder (for exercising or delegating your rights to attend and vote at meetings, to facilitate communications, etc.)
• Voice

If you are acting for and on behalf of a legal entity, please note that we may lawfully (art. 6.1, f, GDPR) process your contact data and your function or position in the entity you represent, for the purpose of locating you professionally and exclusively for the purpose of maintaining business relations with the legal entity. The same applies to the processing of data relating to individual entrepreneurs.

We may also process any other personal data about you if you provide it to us in response to questionnaires we send out for market research purposes, when you enter our competitions, or if you otherwise interact with us.

Finally, in accordance with the provisions of our Cookies Policy, we may process data from the application and the user's device: Hannun stores data from the device that the user uses to access the services. This processing is based on your consent to the cookies stored/read on your terminal. These data are:

1. Internet IP address used by the user to connect to the Internet with their computer or mobile phone.
2. Information about your computer or mobile phone, such as your Internet connection, browser type, version and operating system, and device type.
3. The full clickstream of uniform resource locators (URLs), including date and time. 
4. Browsing history and user preferences.
5. Location-related data, including the real-time geographic location of the users' computer or mobile device.
6. 
   

Occasionally, in order to guarantee the purchase and delivery of our products, you may provide us with data of third parties with whom you have some kind of relationship. In this case, we will process this data because we understand that you have informed these third parties of this communication of data and that you have referred them to this Privacy Policy. Notwithstanding the foregoing, we will inform them of the content of the document as soon as we have the opportunity to do so.

1. Purposes of processing and basis of legitimacy

Your personal data will only be obtained by Hannun for processing if they are adequate, relevant and not excessive in relation to the explicit and legitimate scope and purposes for which they are collected.

We also inform you that, if we process your data on the basis of our legitimate interest, your privacy has been taken into consideration. If you do not agree with any of the processing carried out on the basis of Hannun's legitimate interest, you can object by following the steps described in the section "Exercise of rights by the data subject".

To this end, we will process your personal data for the following purposes:

(i) Addressing queries, doubts and complaints

We will attend to your queries and doubts, which you can send us through any of our contact channels. We understand that the processing of this data is also beneficial to you insofar as it allows us to attend to you properly and resolve your information query, provide our after-sales service or build customer loyalty. We may also record the telephone conversations we have with you for quality and security reasons. The basis of legitimacy, in these cases, will be our legitimate interest (art. 6.1, f, RGPD).

Likewise, in defence of legal claims of a judicial or extrajudicial nature that you bring against us or that we make, we will process your personal data in order to manage them. On the one hand, the basis of legitimacy for these processing operations is our legal obligation (art. 6.1, c, RGPD) to resolve consumer complaints in compliance with the provisions of Royal Legislative Decree 1/2007, of 16 November, which approves the revised text of the General Law for the Defence of Consumers and Users and other complementary laws; and Regulation (EU) No 524/2013 of the European Parliament and of the Council of 21 May 2013, on dispute resolution and in compliance with general consumer regulations. On the other hand, the basis of legitimacy is also our legitimate interest (art. 6.1, f, RGPD) in meeting administrative or judicial claims, dealing with them and exercising the legal actions that we deem appropriate. This processing is not opposable, as there are compelling reasons for this purpose.

(ii) Purchase/sale of our products

We will process your personal data to process the purchases you make on our website, including, among other purposes, obtaining certain mandatory information prior to purchase; sending electronic communications on the status of the order placed, as well as the communication of data to the shipping company; issuing invoices; verifying fraud during the purchase process; and managing online payment by communicating your data to the appropriate payment service provider. Payment or card details are not held or collected on our systems, but are sent directly via the payment gateway to the provider. Please note that in some situations they will also act as data controllers, so please read their privacy policies carefully to understand how they will handle your personal data.

Such processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures at the request of the data subject (art. 6.1, b, GDPR).

(ii) Management of the 'Hannun Rewards' Loyalty Programme

We may process the data of customers who wish to participate in our loyalty programme 'Hannun Rewards', which allows a percentage of the purchase to be recovered by accumulating points to be redeemed on future orders. To do this, a user account must be created on the website and to this end, certain personal data will be required to be provided. Once the account has been created, we may contact you to welcome you or to carry out any other type of management related to your membership, such as applying discounts or promotions to your purchases.  This processing is necessary for the performance of a contract to which the data subject is a party or for the implementation at the request of the data subject of pre-contractual measures (art. 6.1, b, GDPR).

(iii) Send commercial, advertising and marketing information about our products.

Sending commercial information about Hannun products via electronic media

With your express consent (art. 6.1, a, RGPD), we may send you communications for commercial, advertising and marketing purposes, so that you may receive by electronic means (email, instant messaging, SMS or browser push notifications, telephone call, or any other electronic or telematic means available at any time), information about our products, discounts or benefits that may be of interest to you.

We also inform you that, based on our legitimate interest (art. 6.1, f, GDPR), we may carry out these advertising activities by means of automated processing of personal data based on your needs, your purchased products, your behaviour, your preferences or your interests, which we may compile from our own internal analytical sources, as well as from third parties, such as browsing and/or Internet data. However, no automated decisions will be made on the basis of this profiling that have legal effects or significantly affect you.

Sending commercial information on products similar to those contracted.

Likewise, based on our legitimate interest (art. 6.1, f, RGPD), we may also send you communications for commercial purposes, about products similar to those you have already contracted with us.  These communications will be personalised with information that will be extracted from our internal sources and on the basis of which we will draw up profiles generated from your behaviour patterns.

We inform you that Hannun's primary interest in carrying out this data processing is to maintain our relationship with you by contracting new products. In addition, this enables Hannun to continue its economic activity and to grow within the furniture and furnishing industry. Hannun considers that the aforementioned personal data processing activities are not an impediment to the normal exercise of your rights and freedoms, being considered as normal practices within the commercial sphere, so we understand that the receipt of this type of communication will not disappoint your expectations. We also undertake to use the least harmful means to carry out such data processing activities.

At any time, you have the right to object to such processing, including profiling, and to withdraw your consent.

Sending information about products and services of interest to you through social networks:

If you are registered in any social network, we will process your personal data for the following purposes:

(i) display targeted advertisements to you specifically about Hannun products that are similar to those you have already purchased from us and that may be of interest to you.

In order to carry out these actions, we will use tools that the social networks have developed specifically for this purpose (such as Facebook or Instagram Custom Audiences). The social networks themselves will provide you with information in their privacy policies on how they process your data through these tools for which we are jointly responsible for the processing.

(ii) When using these tools, Hannun will also perform audience targeting according to users' interests and therefore, if you are a user of a social network and you are classified in the audience we select, you may receive advertising from Hannun. Please note that in these cases Hannun only performs audience targeting, but does not have access to the end users of the campaign, so to object to receiving these communications you should contact the social network that has impacted you.

The legitimate basis for this data processing is our legitimate interest (art. 6.1, f, RGPD), for sending commercial communications by different means about Hannun products.

Notwithstanding the foregoing, when, as a result of the use of the different tools that social networks have developed, an exhaustive profiling of your person is carried out, we will validate that the tool has requested prior and express consent from users to carry out the processing described herein and to send you information about products of interest to you.

(iv) Send out surveys and market research

Hannun will process the personal data associated with the purchase of our products to carry out customer satisfaction surveys via email, SMS, telephone or other communication channels, market studies or internal statistics and to prepare commercial reports to better understand the level of satisfaction and thus be able to internally assess the design, creation and improvement of new features or functionalities of our furniture and decorative elements that may be of interest to you. Where possible, we will anonymise your personal data to carry out our surveys and market research. The processing is carried out on the basis of our legitimate interest (art. 6.1, f, RGDP).

(v) Business development

We may process your data to maintain the security of the website and our technological infrastructure; prevent fraudulent activities, such as identity theft, duplicate payment cards or password theft; perform internal statistics, risk analysis, internal audits, market research or business development projects, as well as prepare business reports; improve the quality of our products and the user experience on our website; as well as evaluate the effectiveness of advertising campaigns. The basis of legitimacy for these processing operations is our legitimate interest (art. 6.1, f, GDPR) for the purposes of complying with internal quality standards for the identification, control and mitigation of legal or operational risks, and to improve the profitability of the business.

(vi) Compliance with our legal obligations

In order to conduct our business and/or manage our relationship with our stakeholders, we must comply with a number of legal, tax, auditing and accounting obligations; we must also respect the rights of consumers, with respect to legal warranty periods, the right of withdrawal and, where applicable, the return of products. These processing operations are necessary for the fulfilment of our legal obligations (art. 6.1, c, GDPR).

As will be indicated below, we may also be obliged to communicate your data to Judges and Courts, Public Administrations, and State Security Forces and Corps.

(vii) Management of recruitment processes

In the event that you send us your CV to participate in a personnel selection process, either directly or through external employment platforms or placement companies, Hannun will process your personal data in order to assess the suitability of your application for the vacant job and, where appropriate, to carry out the necessary procedures to join the company, if you are selected.

By sending us your CV, you undertake to provide up-to-date, accurate and truthful information and to report any inaccurate or incomplete information about your professional profile.

The legal basis for the processing of your data is the performance of an employment contract to which the candidate is a party or for the implementation of pre-contractual measures at his/her request (art. 6.1. (b) RGDP). Once the selection process has been completed, if the candidate is not hired, the personal data collected will be destroyed and blocked, unless the candidate has expressly consented to be included in the Hannun job bank.

(viii) Managing our official social media profiles

We are present on the following social networks: Facebook, Youtube, Instagram, Tik Tok and LinkedIn. By registering with your social network ID on some of our pages, you consent (art. 6.1, a, RGPD) to the access to your profile and the processing of your personal identification data, including also the content of your public messages, published posts, or "likes", all in accordance with this Privacy Policy. In the event that you ask us a question, but have not joined our page as a follower, we will be able to answer your query based on our legitimate interest (art. 6.1, f, RGPD). We also inform you that this processing of personal data will also be subject to the provisions of the privacy policy of the corresponding social network in which you have registered as a user, as well as its particular rules and conditions of use, which we recommend that you read beforehand.

For its part, it may publish comments, links, images or photographs, or any other type of content supported on the social networks, provided that it belongs to it or for which it has authorisation from third parties. Any publication on the social network, whether texts, graphics, photographs, videos, etc., that infringe or are likely to infringe morality, ethics, good taste or decorum, and/or that infringe, violate or violate intellectual or industrial property rights, the right to image or the Law, is expressly prohibited. In these cases, Hannun reserves the right to immediately remove the content, and may request the permanent blocking of the user. Please note that your publications on our official profile may be known by the rest of the users who interact in our social networks. However, from the profile of each social network, you can configure what information you want to make public in each case, view the permissions that have been granted, delete them or disable them, such as any third-party application that you no longer wish to use.

Once you join as a follower, we will process your data for the purposes of speeding up and optimising responses to your queries and communications through our profiles; analysing social interactions with users; making commercial and advertising publications, managing competitions or communicating other news of interest about us; as well as for any other similar purpose in accordance with the terms indicated from time to time. Likewise, based on our legitimate interest (art. 6.1, f, RGPD), we inform you that the analysis and elaboration of commercial profiles through your interactions on our social networks is foreseen.

(viii) Managing the relationship with our investors

Whether you are a shareholder (natural person), a representative of such shareholder, or a representative of a shareholder (legal person), at Hannun we process your personal data for the purpose of managing the development, compliance and control of the shareholder relationship (art. 6.1, b, RGPD) in relation to the convening, holding and dissemination of the General Meeting, including the exercise or delegation of your rights of attendance, information, voting, intervention, participation in the same; as well as for the compliance of any other legal obligations (art. 6.1, c, RGPD) deriving from the convening and holding of the General Shareholders' Meeting of Hannun, and from the maintenance of its status as shareholder, or for the internal control and management of compliance with the obligations regarding the Securities Market, Transparency and Access to Public Information and Good Governance, and the Unified Code of Good Governance of Listed Companies.

In the event that you attend the Hannun General Shareholders' Meeting and/or make a speech, we inform you that this may be recorded and that your image and voice will be processed for the purpose of managing the audiovisual recording of the company's General Shareholders' Meeting.

In the event that you delegate your rights as a shareholder (natural person) to a third party, you will be allowing the aforementioned representative to process your personal data in order to exercise your rights as a shareholder at the General Shareholders' Meeting of Hannun, including those of attendance (in person or online), voting, intervention and the right to information.

In the event that you act as a representative of a shareholder (natural person) or a representative of a shareholder (legal entity) on the occasion of your participation in the various processes available for the Hannun General Shareholders' Meeting, the company may process the following personal data: name, surname, first name, company name of the entity he/she represents (if applicable), identification document (ID card, passport or any other document that may be indicated in the process), as well as his/her image and voice (together with his/her name and surname) in the event that he/she attends and makes any intervention at the Hannun General Shareholders' Meeting.

1. Addressees 

When we communicate your data to other recipients, we undertake to ensure that they have appropriate technical and organisational measures in place to ensure the confidentiality and security of the data transferred.

Hannun will not transfer your data to third parties without your consent, except in the following cases:

1. In order to conduct our business and provide our services, we may share your personal data with third parties. For example, with our deferred payment service partners (if you choose that payment method), or the owners of our official social networks when we run targeted advertising campaigns.

1. Likewise, at Hannun we have the collaboration of third party service providers who may have access to your personal data, but who will process them in our name and on our behalf, following our instructions at all times, and always in order to provide us with the services that we may have contracted with them in each case. Specifically, at Hannun we contract services provided by third party providers who carry out their activity, by way of example and without limitation, in the following sectors: logistics and transport services, legal advice, multidisciplinary professional services companies, payment service providers, hosting companies, technology and IT service providers, physical security companies, or infrastructure management and maintenance companies.

In any case, at Hannun we follow strict criteria for the selection of third party service providers in order to comply with our data protection obligations, and we undertake to sign the corresponding data processing contract with them whereby we will impose the following obligations, among others: to apply appropriate technical and organisational measures, to process personal data for the agreed purposes and only in accordance with our documented instructions, to maintain confidentiality, and to delete or return the data to us once the provision of the services has been completed.

We may disclose your data to Courts and Tribunals, Law Enforcement Agencies, the Spanish Securities and Exchange Commission, Public Authorities and Administrations or authorised third parties, where we are required or permitted to do so by law or where reasonably necessary: (i) to comply with our legal obligations, (ii) to comply with a legally binding subpoena (such as a subpoena or court order) or respond to cases brought against Hannun, (iii) to comply with legally binding requests in connection with a criminal investigation relating to illegal, suspected or alleged activity, or to respond to or address any other activity that may expose us or any of our users to legal or regulatory liability.

1. Your data as a shareholder (natural person), representative of such shareholder and/or representative of a shareholder (legal person) may, if applicable, be communicated to the Notary Public in connection with notarial minutes or the notarisation of resolutions adopted by the General Meeting of Shareholders of Hannun, as well as their corresponding entry in the Commercial Register, and may be provided to third parties in the exercise of the right to information provided for by law, or be accessible to the general public insofar as they are contained in the documentation available on the website https://investors. hannun.com/ or are expressed at the General Meeting of Shareholders of Hannun, the holding of which may be the subject of an audiovisual recording.

In some situations, in the context of the activities of external service providers, your personal data may be shared with entities established outside your country or the European Economic Area (EEA), both by recipients declared by the European Commission to be of an adequate level of protection and by recipients where a level of protection equivalent to that in the EEA is not provided. In this case, any transfers we may carry out will be lawful and governed by European Commission standard contractual clauses for recipients outside the European Union and we will choose appropriate entities in accordance with the recommendations issued by the European Data Protection Board to ensure that your data is adequately protected.

1. Data retention

By virtue of the principle of limitation of the storage period, we will keep your personal data for the time strictly necessary for the purpose for which they were collected, and as long as you do not request their deletion or revoke, where appropriate, your consent, as well as the time necessary to comply with the legal obligations and possible liabilities that may arise, and which, in each case, correspond according to each category of data.

In the case of the processing of professional and academic data for participation in selection processes, they will be kept for the duration of the process, and will be destroyed at the end of the process. Exceptionally, once the selection process has concluded, the candidate's data may be kept for future selection processes, provided that they have given their express consent.

In cases where we automatically collect data through cookies, you can limit their use over time by deleting them from browsers or devices. You can find more information in the Cookie Policy.

Remember that we may keep your personal data even after you have requested your cancellation, for the attention of possible liabilities arising from the processing during the period of limitation of these, but we will keep them duly blocked, with restricted access, and they will only be available to the Public Administrations, Judges and Courts, and for the demand of possible liabilities arising from the processing and only for the period of limitation of these.

1. Exercise of rights by the holder

We inform you that you are entitled, free of charge and insofar as the legal requirements are met, to exercise the following rights:

Right of access: You have the right to obtain information about, and access to, the personal data concerning you that we are or are not processing. Upon request, we will provide you with a copy of the personal data we are processing.

Right of rectification: You have the right to rectify your personal data that is inaccurate or incomplete, or to have incomplete data completed.

Right of erasure: You may request the erasure of your data when, among other circumstances, they are no longer necessary for the purposes for which they were collected or otherwise processed.

Right to restriction of processing: You have the right to have the processing of your data restricted in certain circumstances provided for in data protection legislation.

Right to data portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another entity.

Right to object: In certain situations, you may object to certain processing on grounds relating to your particular situation, including profiling. You may object at any time to the processing of your personal data for direct marketing purposes.

Right to withdraw your consent: You may withdraw your consent to any processing at any time, but such withdrawal will not affect the lawfulness of the processing based on the consent previously given.

To exercise these rights, you may write to Carrer de la Conca de Barberà, 18 (Polígono Pla de la Bruguera) 08211 - Castellar del Vallès, Barcelona; or by e-mail to data@hannun.com.

By clicking on this link, you can also exercise your rights of rectification, portability, access and deletion quickly and easily.

1. Complaints to the Data Protection Authority

You are informed that you may address your claims arising from the processing of your personal data to the Spanish Data Protection Agency (www.aepd.es).

1. Modifications to the Privacy Policy

Hannun reserves the right to modify this Privacy Policy at any time in accordance with applicable law. When we do so, we will post the revised Privacy Policy and update the "Last Updated" date. In addition, if we make significant changes, we will notify you of the changes by email at least thirty (30) days before they become effective. You may cancel your account if you disagree with the revised Privacy Policy. If you do not cancel your account prior to the effective date of the revised Privacy Policy, your access to and use of the Hannun website will be subject to the revised Privacy Policy.

This data protection policy was amended on date 03/05/2023