Privacy Policy

1. Data controller

This Privacy Policy governs the processing of the personal data that the User provides to Asociación Junior Empresa KAN (hereinafter, "KAN" or "Let's Box It") through the website letsboxit.es, as well as through any other means of communication.

Identifying details of the Controller:

• Name: Asociación Junior Empresa KAN
• NIF: G56511942
• Registered office: Plaza San Martín 1, 28013 Madrid, Spain
• Registration: Register of Associations of the Community of Madrid, number 41345
• Email: hola@letsboxit.es / kan.labmadrid@gmail.com
• Telephone: +34 664 530 600

KAN undertakes to process the User's personal data with the utmost diligence and in accordance with the data protection legislation in force, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

2. Data we process and purposes

KAN processes the User's personal data for the following purposes and on the following legal bases:

2.1. Management of the contracted service

• Data processed: first name, surname, email address, telephone, collection and return address, number of boxes and packages, payment details.
• Purpose: to manage the booking, collection, storage and return of the customer's belongings; to issue invoices; to communicate with the customer during the service.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.2. Handling enquiries through the web form or WhatsApp

• Data processed: name, email address, telephone, content of the enquiry.
• Purpose: to respond to the User's enquiries.
• Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

2.3. Compliance with legal obligations

• Data processed: those necessary for compliance with tax, accounting and administrative obligations.
• Purpose: to comply with tax, accounting and consumer protection legislation.
• Legal basis: legal obligation (Art. 6(1)(c) GDPR).

2.4. Sending commercial communications (only if the User consents)

• Data processed: name, email address, telephone.
• Purpose: to send information about Let's Box It's services, offers and news.
• Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

The User may withdraw this consent at any time by sending an email to hola@letsboxit.es or through the unsubscribe link included in each communication.

2.5. Analysis and improvement of the Website

• Data processed: browsing data collected through cookies (see Cookie Policy).
• Purpose: to improve the user experience and the operation of the Website.
• Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

3. Retention period

KAN will retain the User's personal data for as long as necessary to fulfil the purpose for which it was collected:

• Contractual data: for the duration of the service and, thereafter, for the applicable legal periods (up to 6 years for tax and accounting obligations).
• Enquiry data: until the enquiry is resolved and a maximum of 1 additional year.
• Data for commercial communications: until the User withdraws their consent.
• Browsing data (cookies): as set out in the Cookie Policy.

4. Recipients and disclosures of data

KAN may disclose the User's personal data to the following recipients, where necessary for the provision of the service:

• Stripe Payments Europe Ltd. — payment services provider. Processing in accordance with its privacy policy: stripe.com/es/privacy
• Google Ireland Ltd. — web analytics tools (Google Analytics). Processing in accordance with: policies.google.com/privacy
• Physical storage providers contracted by KAN to safeguard the customer's belongings during the summer. These providers act as data processors under a signed contract in accordance with Article 28 GDPR.
• The competent Public Authorities, where there is a legal obligation to disclose the information.

KAN does not carry out international transfers of data outside the European Economic Area (EEA), except for those arising from the use of Google Analytics, which has the appropriate safeguards in accordance with the GDPR (standard contractual clauses approved by the European Commission).

5. User's rights

The User may exercise the following rights at any time:

• The right of access to their personal data.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure ("right to be forgotten") of their data where applicable.
• The right to object to processing based on legitimate interest.
• The right to restriction of processing in certain circumstances.
• The right to data portability in a structured format.
• The right not to be subject to automated decisions with legal effects.
• The right to withdraw the consent given at any time, without this affecting the lawfulness of the processing carried out beforehand.

To exercise these rights, the User may contact KAN by email at hola@letsboxit.es or by post to Plaza San Martín 1, 28013 Madrid, indicating the right they wish to exercise and enclosing a copy of their DNI or equivalent document.

KAN will respond to the request within a maximum period of one month from receipt, extendable by two additional months in cases of particular complexity.

Complaint to the supervisory authority: the User has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their personal data does not comply with the legislation. Contact details:

• Website: www.aepd.es
• Address: C/ Jorge Juan 6, 28001 Madrid
• Telephone: 901 100 099 / 91 266 35 17

6. Security measures

KAN has implemented the technical and organisational measures necessary to guarantee the security, integrity and confidentiality of the personal data processed, preventing its alteration, loss, unauthorised processing or access, in accordance with the provisions of the GDPR and the LOPDGDD.

KAN undertakes to comply with the duty of secrecy with respect to personal data and to keep it with the utmost diligence.

7. Minors

The Website is intended for persons over 18 years of age. KAN does not intentionally collect data from minors. If the User is under 18 years of age, they must have the prior consent of their parents or legal guardians in order to use the service.

If KAN becomes aware that it has collected data from a minor without such consent, it will proceed to delete it immediately.

8. Amendments to the Privacy Policy

KAN may amend this Privacy Policy in order to adapt it to legislative or case-law changes or changes to its service model. Any amendment will be notified to the User through the Website and, where legally required, by direct communication.

The User is advised to consult this Privacy Policy periodically in order to stay informed of any updates.