Privacy policy

This policy explains how we process the personal data you provide on kerasworld.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).

1. Data controller

Owner: GM STACK GREENS INVESTMENT GROUP S.L., tax ID B67374231, registered office at C/ Sicilia 275, Esc. A, 5º 4ª, 08025 Barcelona.

Data protection contact: careanddare@kerasworld.com.

2. What data we process and why

«Sign the Care & Dare» newsletter. We process your email address, browsing language and the date on which you gave consent, in order to send you news about Keras World and its products.

B2B contact form. We process your name, company, email address, contact type (retail, horeca, distribution, collabs, press or other) and your message, in order to handle your commercial enquiry.

Collaboration form. We process your name, company, email address, project type and message, in order to assess and reply to your proposal.

Proof of consent. In all three cases above we store, alongside your data, the date on which you accepted, the IP address and browser you submitted the form from, and the version of the legal text in force at the time. We do this to be able to demonstrate that consent was properly obtained, as required by the GDPR accountability principle (art. 5.2 and 7.1).

We do not carry out profiling or automated decision-making with legal effects on you.

3. Legal basis

Consent (art. 6.1.a GDPR) for the newsletter and for the data submitted through the forms: in both cases you must expressly tick the acceptance box, and we store the date on which you did so.

Legitimate interest (art. 6.1.f GDPR) in maintaining the commercial relationship, replying to the professional enquiries you send us, and keeping the site safe from automated submissions.

4. Retention periods

Newsletter data is kept until you withdraw your consent. If you unsubscribe we stop writing to you immediately and keep only your email address, indefinitely, on a suppression list: it is the only way to guarantee that you will not receive the newsletter again should that address come back to us through another route. The legal basis for keeping it is compliance with article 21.3 of the Spanish LSSI-CE and article 7.3 of the GDPR. If you would rather we deleted that record too, you can ask for it on the unsubscribe page itself or by writing to us. Data from the B2B forms is kept while your enquiry is being handled and thereafter for as long as needed to address any liabilities arising from the relationship (generally up to six years under the Spanish Commercial Code). After those periods the data is deleted.

5. Recipients and processors

We do not share your data with third parties except where legally required. We do rely on providers acting as processors, which access the data solely to provide their service:

Resend (resend.com), as email delivery provider, to send you the subscription confirmation and the form acknowledgements.

Hosting provider of the server where the website and the database reside.

On the Maps page we show our own map built with the Leaflet library and OpenStreetMap map data served by OpenFreeMap. It sets no cookies and stores nothing on your device: the only thing that happens is that, as the map loads, your browser communicates its IP address to the server delivering it, as in any web request. The map also does not load until you reach that section of the page, so if you never scroll down to it no request is sent. On older browsers that do not support the map rendering technology, the map data is requested directly from OpenStreetMap.

6. International transfers

Some of the providers named above may process data outside the European Economic Area. This is the case with Google, which may process data in the United States: that transfer relies on the EU-US Data Privacy Framework and, in the alternative, on the Standard Contractual Clauses approved by the European Commission. For the remaining providers, the transfer likewise relies on those clauses or on an adequacy decision. You may request a copy of the safeguards in place by writing to careanddare@kerasworld.com.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time (without affecting the lawfulness of processing carried out beforehand), by writing to careanddare@kerasworld.com stating the right you wish to exercise. Every newsletter email also includes an unsubscribe link, and you can unsubscribe or ask us to delete your data at any time at https://kerasworld.com/en/unsubscribe.

If you believe your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security and minors

We apply technical and organisational measures to protect your data, including HTTPS encryption. Our forms are not aimed at children under 14; if we detect a minor's data without guardian consent, we will delete it.

9. Changes to this policy

We may update this policy to reflect legislative developments or changes to the service. The version in force will always be published on this page.

For commercial matters, write to partners@kerasworld.com.