Privacy Policy

Last updated: January 2025

1. Introduction

Welcome to the Privacy Policy of Viveros La Morera. We are committed to protecting your personal data and respecting your privacy in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, commonly known as the General Data Protection Regulation (GDPR), as well as Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website at viveroslamorera.es, contact us, or make use of any of our nursery services, including tree consultations, plant orders, and delivery arrangements.

We encourage you to read this document carefully. By using our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller Information

The entity responsible for processing your personal data is:

• Business Name: Viveros La Morera
• Website: viveroslamorera.es
• Email Address: [email protected]
• Postal Address: Elx 1, Spain

If you have any questions or concerns about how we handle your personal data, you may contact us directly at the email address provided above.

3. Types of Personal Data We Collect

Depending on how you interact with Viveros La Morera, we may collect and process the following categories of personal data:

3.1 Identification and Contact Data

• Full name
• Email address
• Telephone number
• Postal address, including delivery address for tree and plant orders
• Company name, where applicable

3.2 Transaction and Order Data

• Details of trees, plants, and nursery products ordered or enquired about
• Delivery preferences and scheduling information
• Billing information and payment references
• Order history and correspondence related to purchases

3.3 Consultation and Communication Data

• Information shared during horticultural or arboricultural consultations
• Details regarding your garden, land, or planting project that you voluntarily provide
• Records of email exchanges, phone enquiries, or contact form submissions

3.4 Technical and Browsing Data

• IP address
• Browser type and version
• Pages visited and time spent on the website
• Referring URLs
• Device information
• Cookie identifiers (see our Cookie Policy section below)

4. Purposes and Legal Basis for Processing

We process your personal data for specific, explicit, and legitimate purposes. The following table outlines the purposes of processing and the corresponding legal basis under the GDPR:

4.1 Processing and Fulfilling Orders

When you place an order for trees, shrubs, Mediterranean plants, or other nursery products, we use your personal data to process the order, coordinate delivery logistics, manage invoicing, and communicate updates about your purchase. The legal basis for this processing is the performance of a contract to which you are a party (Article 6(1)(b) GDPR).

4.2 Delivery Coordination

Nursery deliveries often involve scheduling, route planning, and coordination with third-party logistics providers. We may share your delivery address and contact details with trusted transport partners solely for the purpose of completing your delivery. The legal basis is the performance of a contract (Article 6(1)(b) GDPR).

4.3 Horticultural Consultations and Customer Support

We process personal and project-related information you share during planting consultations, tree care advice sessions, or general customer enquiries in order to provide you with accurate and tailored guidance. The legal basis is our legitimate interest in providing high-quality customer service (Article 6(1)(f) GDPR), or the performance of a contract where consultation services are formally engaged.

4.4 Marketing and Newsletter Communications

With your prior and explicit consent, we may send you newsletters, seasonal nursery promotions, information about new Mediterranean tree varieties, planting guides, and other commercial communications. The legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at [email protected].

4.5 Legal Compliance

We may process your data to comply with applicable legal obligations, including tax and accounting regulations, consumer protection laws, and phytosanitary regulations governing the sale and transport of plant material within Spain and the European Union. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).

4.6 Website Improvement and Analytics

We use technical and browsing data collected through cookies and similar technologies to analyse website traffic, understand user behaviour, and improve the functionality and content of our website. The legal basis is our legitimate interest in maintaining and improving our digital presence (Article 6(1)(f) GDPR), subject to applicable cookie consent requirements.

5. Data Retention Periods

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, in accordance with applicable legal requirements. Specific retention periods are as follows:

• Order and transaction data: Retained for a minimum of five years following the completion of a transaction, as required by Spanish tax and commercial law.
• Customer consultation records: Retained for the duration of the business relationship and for three years thereafter, unless a longer retention period is required by law.
• Marketing data: Retained until you withdraw your consent or request erasure.
• Technical and browsing data: Retained for a maximum of thirteen months from the date of collection, unless required for longer periods for security or legal purposes.
• Contact form enquiries: Retained for two years from the date of the last correspondence, unless the enquiry results in a formal order or ongoing relationship.

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised.

6. Sharing and Disclosure of Personal Data

Viveros La Morera does not sell, rent, or trade your personal data to third parties. We may, however, share your data with trusted third parties in the following limited circumstances:

6.1 Logistics and Delivery Partners

To fulfil nursery product deliveries, we may share your name, delivery address, and contact telephone number with transport and logistics companies. These partners are contractually bound to process your data solely for delivery purposes and in compliance with GDPR requirements.

6.2 Payment Service Providers

Payment processing is carried out through secure, third-party payment platforms. We do not store your full payment card details. Payment providers operate under their own privacy policies and security standards.

6.3 IT and Hosting Service Providers

We use third-party providers for website hosting, email infrastructure, and data storage. These providers act as data processors under binding data processing agreements and may only process your data on our documented instructions.

6.4 Professional and Legal Advisors

We may disclose data to legal, accounting, or compliance professionals where necessary to obtain professional advice or to comply with legal proceedings.

6.5 Regulatory and Public Authorities

We may disclose personal data to competent regulatory, administrative, or judicial authorities when required to do so by law, court order, or to protect the rights, property, or safety of Viveros La Morera, our customers, or others.

7. International Data Transfers

Viveros La Morera primarily processes and stores your personal data within the European Economic Area (EEA). In the event that any of our service providers transfer data outside the EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data to a standard equivalent to that required within the EEA.

8. Cookies and Similar Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse website usage, and, where applicable, deliver relevant content and advertising.

Cookies are small text files placed on your device when you visit a website. We use the following types of cookies:

• Strictly necessary cookies: These are essential for the website to function properly and cannot be disabled. They include session cookies required for navigation and security purposes.
• Analytical cookies: These help us understand how visitors interact with our website, enabling us to improve performance and content. We use anonymised data for this purpose.
• Functional cookies: These allow the website to remember your preferences and settings to provide a more personalised experience.
• Marketing cookies: Where you have provided your consent, these cookies are used to deliver relevant promotional content related to our nursery products and services.

You may manage or withdraw your cookie consent at any time through your browser settings or the cookie management tool available on our website. Please note that disabling certain cookies may affect the functionality of the website.

For detailed information about the specific cookies we use and their duration, please refer to our Cookie Policy, which is available on our website.

9. Your Rights Under the GDPR

As a data subject under the GDPR, you are entitled to exercise the following rights with respect to your personal data processed by Viveros La Morera:

• Right of Access (Article 15 GDPR): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to receive a copy of that data along with relevant information about how it is used.
• Right to Rectification (Article 16 GDPR): You have the right to request the correction of inaccurate or incomplete personal data that we hold about you.
• Right to Erasure (Article 17 GDPR): Also known as the right to be forgotten, you may request the deletion of your personal data where there is no longer a legitimate reason for us to retain it, where you withdraw consent, or where the data has been unlawfully processed.
• Right to Restriction of Processing (Article 18 GDPR): You may request that we restrict the processing of your personal data in certain circumstances, such as while the accuracy of the data is contested or while an objection is pending.
• Right to Data Portability (Article 20 GDPR): Where processing is based on your consent or the performance of a contract, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to Object (Article 21 GDPR): You have the right to object to the processing of your personal data where it is based on our legitimate interests or where it is used for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Rights Related to Automated Decision-Making (Article 22 GDPR): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, unless such processing is necessary for the performance of a contract or you have provided explicit consent.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us in writing at [email protected]. We will respond to your request without undue delay and within one month of receipt, in accordance with Article 12 GDPR. This period may be extended by a further two months where the request is complex or we receive a high volume of requests, in which case we will inform you accordingly.

We may require you to verify your identity before processing your request in order to protect your data and prevent unauthorised access.

10. Right to Lodge a Complaint

If you believe that your data protection rights have been violated or that we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with the competent supervisory authority in Spain:

• Agencia Espanola de Proteccion de Datos (AEPD)
• Website: www.aepd.es
• Address: C/ Jorge Juan, 6, 28001 Madrid, Spain

We encourage you to contact us directly in the first instance so that we can address your concerns promptly and informally before you escalate a complaint to the supervisory authority.

11. Data Security

Viveros La Morera implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• Encryption of data in transit using Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocols
• Access controls and authentication procedures to limit access to personal data to authorised personnel only
• Regular security assessments and reviews of our data processing systems
• Staff training on data protection obligations and best practices
• Contractual obligations imposed on third-party processors to maintain equivalent security standards

Despite our best efforts, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of data transmitted to our website, and any transmission is at your own risk.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR, and will communicate the breach to you without undue delay where required under Article 34 GDPR.

12. Children's Privacy

Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data without appropriate parental or guardian consent, please contact us at [email protected] and we will take prompt steps to delete such data.

13. Third-Party Websites and Links

Our website may contain links to third-party websites, including suppliers, horticultural organisations, or other resources relevant to the nursery and plant industry. This Privacy Policy applies solely to our website and services. We are not responsible for the privacy practices of third-party websites and encourage you to review their respective privacy policies before providing any personal data.

14. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time in order to reflect changes in our data processing practices, legal requirements, or technological developments. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website or services following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please do not hesitate to contact us:

• Viveros La Morera
• Email: [email protected]
• Website: viveroslamorera.es
• Postal Address: Elx 1, Spain

We aim to respond to all enquiries within a reasonable timeframe and are committed to resolving any concerns you may have regarding the protection of your personal data.