1. Purpose and scope of application

This Data Protection Policy aims to inform users of the website https://www.greenlife.es/ (hereinafter, the “Website”) about how GREENLIFE MARBELLA, S.L., with registered office at Carolina Park, 38, CP 29602, Marbella (Málaga), and tax identification number B-44.576.866, processes the personal data that may be collected through the Website, as well as the rights users are entitled to under current data protection regulations. This policy applies to all personal data processing carried out through the Website, including but not limited to contact forms, newsletter subscriptions, user registration, online purchases, and any other data collection mechanism available on the Website.

2. Data controller

The data controller for the personal data collected through the Website is GREENLIFE MARBELLA, S.L. For any matters related to data protection, users can contact the controller via email at office@greenlife.es, or by sending a written communication to the company’s registered office.

3. Purpose of data processing

The personal data provided by users through the Website will be processed for the following purposes:

• To manage requests for information, inquiries or complaints submitted via the Website forms.

• To manage user registration and access to private areas, where applicable.

• To process orders, purchases, or services requested via the Website.

• To send commercial, promotional, or informational communications, provided the user has given their express consent.

• To manage subscription to newsletters or similar informational bulletins.

• To comply with applicable legal and contractual obligations of the company.

• To improve the user experience and Website functionality, including browsing analysis and the use of cookies, in accordance with the specific cookies policy.

In all cases, the data will be processed lawfully, fairly, transparently, and for specified, explicit, and legitimate purposes. It will not be processed further in a way that is incompatible with those purposes.

4. Lawful basis for processing

The lawful bases for processing users' personal data are:

• The express consent given by the user by checking the corresponding box in the data collection forms and accepting this privacy policy.

• The execution of a contract to which the user is a party or the application of pre-contractual measures at the user's request.

• Compliance with legal obligations applicable to the company.

• The company’s legitimate interest, where applicable, in improving the Website and customer service, provided this does not override the user’s fundamental rights and freedoms.

Users may withdraw their consent at any time without affecting the lawfulness of the processing based on consent prior to withdrawal.

5. Data recipients and international transfers

Users’ personal data will not be shared with third parties, except when required by law, a court order, or when necessary to provide the services requested by the user, in which case the user will be duly informed.

If certain services require data processing by third-party service providers (e.g., technology providers, hosting, logistics, etc.), the company will enter into data processing agreements with these providers, ensuring they comply with data protection laws.

No international data transfers outside the European Economic Area (EEA) are planned unless expressly communicated to the user and adequate safeguards are implemented in accordance with applicable regulations.

6. Users’ rights

Users have the right to:

• Access their personal data and confirm whether or not it is being processed.

• Request rectification of inaccurate or incomplete data.

• Request the erasure of their data when, among other reasons, it is no longer needed for the purposes it was collected.

• Request restriction of processing under certain circumstances.

• Object to the processing of their data for reasons related to their particular situation.

• Request data portability where technically feasible.

• Not be subject to automated decision-making, including profiling, except as permitted by law.

To exercise these rights, users may contact the data controller via the contact methods provided in this policy. Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if they believe their rights have been infringed.

7. Data retention

Personal data will be retained for as long as necessary to fulfill the purpose for which it was collected and, where appropriate, for the periods required by applicable laws to handle potential liabilities arising from the processing. After these periods, the data will be securely deleted.

8. Security measures

The company has implemented appropriate technical and organizational measures to ensure the security and integrity of personal data and to prevent unauthorized access, alteration, loss, or processing, in accordance with the state of the art, the nature of the stored data, and the risks to which it may be exposed.

9. Confidentiality

All staff of the company, as well as any third parties who may access personal data in the course of providing services, are bound by a duty of confidentiality and professional secrecy. This obligation remains in effect even after the termination of any contractual relationship.

10. Use of cookies and similar technologies

The Website uses cookies and similar technologies to enhance user experience, analyze browsing activity, and deliver personalized content. Users can refer to the company’s Cookies Policy for detailed information on the types of cookies used, their purpose, and how to manage or disable them. The use of cookies requires the user's express consent, except for those strictly necessary for the operation of the Website.

11. Changes to the Data Protection Policy

The company reserves the right to modify this Data Protection Policy at any time in accordance with legislative or judicial developments, or industry practices. In case of substantial modifications, the updated policy will be published on the Website and, where necessary, user consent will be requested as required by applicable regulations.