Personal Data Protection according to the GDPR

TALLYTATE, SL, in application of current regulations on the protection of personal data, hereby informs that the personal data collected through the forms on the Website: https://playandstore.com, are included in the specific automated files of users of TALLYTATE, SL's services.

The automated collection and processing of personal data is intended to maintain the commercial relationship and carry out information, training, counseling, and other activities specific to TALLYTATE, SL.

These data will only be transferred to those entities that are strictly necessary for the sole purpose of fulfilling the aforementioned objective.

TALLYTATE, SL adopts the necessary measures to guarantee the security, integrity, and confidentiality of the data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing the old LOPD, the new Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

The user may at any time exercise the rights of access, objection, rectification, erasure (cancellation), restriction, and portability recognized in the aforementioned Regulation (EU). The user can exercise these rights by sending an email to: info@playandstore.com or to the address: C/ Astintze, 6 C1, Nave, 19, C.P. 48160 - Derio (Vizcaya). For this purpose, we may request documentation that proves your identity if necessary. You may also file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

The user states that all data provided by them are true and correct, and undertakes to keep them updated, communicating any changes to TALLYTATE, SL.

Purpose of Personal Data Processing

For what purpose will we process your personal data?

At TALLYTATE, SL, we will process your personal data collected through the Website: https://playandstore.com, for the following purposes:

1. Customer Account Management. When you register on our website or log into the "My Account" area, we process your data to:Create and manage your user account.Maintain order history and facilitate future purchases.Manage saved shipping and billing addresses.Allow you to track the status of your orders.Lawful basis: Performance of a contract and consent provided upon registration.
2. Order Management and Distance Sales Contract. When you make a purchase in our online store, we process your data to:Process and confirm the order.Manage payment through the payment gateway providers integrated into Shopify.Coordinate shipping with the corresponding transport companies.Issue the invoice and comply with accounting and tax obligations.Manage returns, exchanges, and order incidents.Lawful basis: Performance of the sales contract and compliance with legal obligations.
3. Club de Playa (Beach Club) – Subscription to commercial communications. If you subscribe to the "Club de Playa" or agree to receive commercial communications, we will use your email address to:Send you news, promotions, product launches, and brand-related content.Inform you about seasonal collections, exclusive discounts, and special campaigns.Lawful basis: Free, specific, informed, and unambiguous consent, which you can withdraw at any time by sending an email to info@playandstore.com or by clicking the unsubscribe link included in every communication.Note: If you are already a customer, we may send you communications about products similar to those previously purchased under the legitimate interest recognized by the LSSI, without prejudice to your right to object.
4. Management of Contact Requests. When you contact us through the contact form, email, or other enabled channels, we process your data to address and respond to your inquiry or request.Lawful basis: Legitimate interest of TALLYTATE, SL in responding to inquiries received.
5. Wholesale (B2B – Faire). If you make wholesale purchases through the Faire platform (faire.com), the data of the company and the representative/contact will be processed to:Manage registration as a wholesale client.Process wholesale orders and issue the corresponding invoicing.Maintain the B2B commercial relationship.In this case, Faire acts as an intermediary platform and has its own privacy policy, which you can access at https://www.faire.com/privacy.Lawful basis: Performance of a commercial contract and compliance with legal obligations.
6. Product Customization ("Crea tu propio set" / Create your own set). If you use the order customization feature, we process the data provided (product preferences, selected options, and contact details) to manage the custom order request and contact you if confirmation or clarification is needed.Lawful basis: Performance of a contract and consent.
7. Compliance with Legal Obligations. We process your data when necessary to comply with legal, tax, accounting, or administrative obligations applicable to TALLYTATE, SL, including the conservation of invoicing data during legally required periods.Lawful basis: Compliance with a legal obligation.
8. Security and Fraud Prevention. We may process data in order to detect, prevent, and investigate potential fraud, unauthorized access, or other illegal activities on the platform. Shopify and Cloudflare apply their own security and anti-fraud systems as part of the provision of their services.Lawful basis: Legitimate interest of TALLYTATE, SL and users in ensuring a safe environment.

How long is the collected personal data kept?

Personal data will be kept for the following periods:

• Customer account data: As long as the account remains active or until you request its cancellation.
• Order and invoicing data: 5 years from the issuance of the invoice, in accordance with Spanish tax and accounting regulations.
• Club de Playa / Subscription data: Until you withdraw consent or unsubscribe.
• Contact data: Until the inquiry has been resolved, plus the necessary period to handle potential claims.
• B2B data (Faire): For the duration of the commercial relationship and during the statute of limitations for legal liabilities.

Once the periods are met, the data will be blocked and subsequently erased in accordance with applicable regulations.

Origin of Data and Method of Collection

The personal data we process has been provided directly by you. In the event that you provide data belonging to other people, you guarantee that you have their express consent and that you have communicated the content of this Policy to them. Furthermore, you release us from any liability arising from the failure to comply with this obligation.

Accuracy of Personal Data

If you do not provide us with your data, or if you do so incorrectly or incompletely, we will not be able to address your request, making it completely impossible to provide the requested information or carry out the contracting of services.

The data subject guarantees that the data provided are true, accurate, complete, and updated. You will inform us of any modification to the data provided through the channels indicated in the header of this policy.

Recipients

To provide its services, TALLYTATE, SL uses the following providers acting as data processors:

• Shopify, Inc. – E-commerce platform (management of the store, orders, payments, and customer account). Privacy policy: https://www.shopify.com/legal/privacy
• Cloudflare, Inc. – Web infrastructure and security services. Privacy policy: https://www.cloudflare.com/privacypolicy/
• Transport Providers – For order delivery, the name, address, and contact telephone number are transferred to the corresponding carrier.
• Payment Gateways – Payment data is managed directly by the payment providers integrated into Shopify and is not stored by TALLYTATE, SL.
• Faire Wholesale, Inc. – B2B wholesale platform. Privacy policy: https://www.faire.com/privacy

International Data Transfers

As a consequence of using Shopify and Cloudflare, international transfers of data outside the European Economic Area (EEA) may occur. Such transfers are carried out with appropriate safeguards, through Data Processing Agreements (DPA) signed with these providers, which incorporate the Standard Contractual Clauses approved by the European Commission and, where applicable, adherence to the EU-U.S. Data Privacy Framework.

The data will not be communicated to any other third party outside of TALLYTATE, SL, except under legal obligation or with the express consent of the user.

Minors

Our products are geared towards family use and, in many cases, aimed at children. However, the contracting of services through this website is reserved for individuals over 18 years of age or minors duly authorized by their legal representatives.

TALLYTATE, SL does not knowingly collect data from children under 14 years of age without the express and verifiable consent of their parents or legal guardians, in accordance with Article 8 of the GDPR and Article 7 of the LOPDGDD.

If we detect that we have collected data from a child under 14 without such consent, we will proceed to its immediate erasure.

Cookies and Tracking Technologies

This website uses first-party and third-party cookies for different purposes (technical, analytical, and marketing). Upon accessing the website, a cookie banner is displayed allowing you to accept, reject, or configure the use of non-essential cookies.

For more information on what cookies we use, for what purpose, and how you can manage them, please consult our Cookies Policy, available in the footer of the website.

Data Collected by Users of the Services

In cases where the user includes files with personal data on shared hosting servers, TALLYTATE, SL is not responsible for the user's non-compliance with the GDPR.

Intellectual Property Rights of https://playandstore.com

TALLYTATE, SL is the owner of all copyrights, intellectual and industrial property, "know-how", and any other rights related to the contents of the website https://playandstore.com and the services offered therein, as well as the programs necessary for their implementation and related information.

The reproduction, publication, and/or non-strictly private use of the contents, total or partial, of the website https://playandstore.com is not permitted without prior written consent.

Software Intellectual Property

The user must respect third-party programs made available to them by TALLYTATE, SL, even if they are free and/or publicly available.

TALLYTATE, SL holds the necessary exploitation and intellectual property rights for the software.

The user does not acquire any right or license for the contracted service over the software necessary for the provision of the service, nor over the technical tracking information of the service, with the exception of the rights and licenses necessary for the fulfillment of the contracted services and solely for the duration thereof.

For any action that exceeds the performance of the contract, the user will require written authorization from TALLYTATE, SL. The user is prohibited from accessing, modifying, or viewing the configuration, structure, and files of the servers owned by TALLYTATE, SL, assuming civil and criminal liability arising from any incident that could occur in the servers and security systems as a direct consequence of negligent or malicious action on their part.

Intellectual Property of Hosted Content

The use of the services provided by TALLYTATE, SL contrary to intellectual property legislation is prohibited, particularly:

• Use that is contrary to Spanish laws or that infringes the rights of third parties.
• The publication or transmission of any content that, in the opinion of TALLYTATE, SL, is violent, obscene, abusive, illegal, racial, xenophobic, or defamatory.
• Cracks, software serial numbers, or any other content that violates the intellectual property rights of third parties.
• The collection and/or use of personal data of other users without their express consent or contravening the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
• The use of the domain's mail server and email addresses for sending unsolicited bulk email (spam).

The user is fully responsible for the content of their website, the information transmitted and stored, hypertext links, third-party claims, and legal actions regarding intellectual property, third-party rights, and protection of minors.

The user is responsible regarding the laws and regulations in force and the rules that have to do with the operation of the online service, e-commerce, copyright, maintenance of public order, as well as universal principles of Internet use.

The user will indemnify TALLYTATE, SL for the expenses generated by the implication of TALLYTATE, SL in any cause whose responsibility is attributable to the user, including legal defense fees and expenses, even in the case of a non-final judicial decision.

Protection of Hosted Information

TALLYTATE, SL makes backup copies of the content hosted on its servers; however, it is not responsible for the loss or accidental deletion of data by users. Similarly, it does not guarantee the total replacement of data deleted by users, since said data could have been deleted and/or modified during the period of time elapsed since the last backup copy.

The services offered, except for specific backup services, do not include the replacement of the contents preserved in the backup copies made by TALLYTATE, SL, when this loss is attributable to the user; in this case, a fee will be determined according to the complexity and volume of the recovery, always subject to prior acceptance by the user.

The replacement of deleted data is only included in the price of the service when the loss of content is due to causes attributable to TALLYTATE, SL.

Commercial Communications

In application of the LSSI, TALLYTATE, SL will not send advertising or promotional communications by email or other equivalent electronic communication means that have not been previously requested or expressly authorized by the recipients thereof.

In the case of users with whom there is a prior contractual relationship, TALLYTATE, SL is authorized to send commercial communications regarding products or services of TALLYTATE, SL that are similar to those that were initially object of contracting with the customer.

In any case, the user, after proving their identity, may request that no more commercial information be sent to them through the Customer Service channels.