Regulation: Regulation (EU) 2016/679 GDPR.

Responsible for thetreatment : IRISANA, S.A..

CIF: A36637213.

Address: Avenida Alcalde Lavadores 80 Interior Nave B, 36214 Vigo (Pontevedra).

Phone:986225218

Email: info@irisana.com

Purpose of processing and legitimation:

1.Compliance with the subject matter of the contract.

The legal basis for the processing of your data is the conclusion of a contract

The communication of the data is a necessary prerequisite to sign the contract and, if it is not, it will not be concluded. The data subject is not obliged to provide the requested information

2.Administrative management.

The legal basis for the processing of your data is the conclusion of a contract.

3.Accounting management.

The legal basis for the processing of your data is compliance with a legal obligation established in the Trade Code.

4.Fiscal management.

The legal basis for the processing of your data is the fulfillment of a legal obligation established in Law 58/2003, of December 17, General Tax.

5.Send to the customer, offers, products or similar services that may be of interest. The legal basis for the processing of the data is the satisfaction of the legitimate interest of the controller consisting in the development of the company's business.

6.Perform commercial communications. The legal basis for the processing of your data is consent.

For the purposes whose legitimacy is based on consent we inform you that it can be withdrawn at any time, by writing to the address of the Data Controller.

If you withdraw consent, the processing that was previously performed will remain valid.

Data retention: your data will be stored for six years from the end of the contractual relationship less for the shipment tothe customer, offers, similar products or services and commercial communications that will be stored in as long as its deletion is not requested by the interested party. Recipients of data : The tax administrations will be informed of the personal data of the client that are necessary, in order to comply with the legal obligations with said Administration.

Transferring data to third countries :No international data transfers will be made.

Rights of the data subject:

- Access: right to obtain confirmation as to whether or not we are processing your personal data, namely what they are, for which they are used, how long they will be stored, the origin of them and whether they have been communicated or will be communicated to a third party.

- Rectification: right to request the rectification of inaccurate data and to have incomplete personal data completed.

- Deletion: right to request the deletion of personal data when they are inadequate, excessive or no longer necessary for the purposes for which they were collected, including the right to be forgotten.

- Opposition: right to object, in certain circumstances, to the processing of your personal data or to request that the processing be ceased.

- Limitation of Processing: right to request, in the circumstances established by law, that your data not be treated beyond the mere retention thereof.

- Portability: right to receive personal data in a structured, commonly used and mechanically readable format, and to be able to transmit it to another controller, whenever technically possible.

Exercise of rights :The exercise of rights must be carried out in writing by attaching a photocopy of your identification document, and address it to the aforementioned address. We also offer models for your exercise, which can be collected in our facilities or obtained at the following address https://irisana.com/content/3-terms-and-conditions-of-use.

For more information: www.agpd.es

Right of complaint to the Supervisory Authority: In the event that your rights have not been respected you can file a complaint by writing to the Spanish Data Protection Agency locatedat Jorge Juan Street, 6-28001-Madrid or use the electronic headquarters: https://sedeagpd.gob.es

In both cases, you must accompany the relevant documentation.