Privacy Policy

At Xtampa we are committed to protecting the privacy and personal data of our clients, suppliers and users. This Privacy Policy governs the processing of personal data collected through the Xtampa ecosystem of websites (hereinafter, "the Website"), including www.xtampa.es, www.xtampa.com, ofertas.xtampa.com, legal.xtampa.com and any other subdomains or microsites operated by Xtampa.

This policy is governed by:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (General Data Protection Regulation, GDPR).
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
• Other applicable Spanish and European regulations on data protection and electronic commerce.

We recommend that you read this policy carefully to understand how we process your personal data and what rights you have.

• Controller: Xtampa (owner: Ángel López Romero)
• Tax ID (NIF): ES48430998J
• Address: C/ Cerámica Galindo, 2, 30820 Alcantarilla, Murcia (Spain)
• Email: [email protected]
• Phone: 868 103 781
• Mobile/WhatsApp: 688 908 082
• Activity: Textile personalisation, merchandising and promotional gifts (screen printing, DTG digital printing, embroidery, vinyl, transfers, labels, banners and graphic design).

Xtampa has not appointed a Data Protection Officer, since this is not mandatory for the processing activities carried out under Article 37 of the GDPR and Article 34 of the LOPDGDD. You can contact the controller directly at [email protected] for any privacy-related questions.

We collect only the data strictly necessary to manage your requests, orders and the commercial relationship within the Xtampa ecosystem of websites, applying the data minimisation principle (art. 5.1.c GDPR):

We process your personal data for the following purposes and legal bases:

Your personal data will not be sold, rented or transferred to third parties for their own commercial purposes. However, the following recipients may have access to your data:

As a general rule, your personal data is processed on servers located in the European Union or the European Economic Area (EU/EEA).

However, some of our service providers (such as web analytics services, cloud email or management tools) may be located outside the EU/EEA, including the United States. In such cases, we ensure that international transfers are carried out with the appropriate safeguards provided for in the GDPR:

• Adequacy decisions: transfer to countries with an adequate level of protection recognised by the European Commission (e.g. the EU-US Data Privacy Framework).
• Standard Contractual Clauses (SCCs): contracts approved by the European Commission that guarantee an equivalent level of protection.
• Binding Corporate Rules (BCRs): when the provider has them in place.

You can request additional information about the safeguards applied to international transfers by writing to [email protected].

We apply the storage limitation principle (art. 5.1.e GDPR). Personal data will be kept for the time strictly necessary for the purposes of the processing and, subsequently, for the legal limitation periods for liabilities:

• Order and billing data: 6 years (accounting and tax obligations, art. 30 of the Commercial Code and tax regulations).
• Quote data not converted into orders: 1 year from the last communication.
• Enquiry and customer service data: 1 year from the resolution of the enquiry.
• Commercial communications data (newsletter): until you withdraw your consent or exercise your right to object.
• Design and personalisation files: during the commercial relationship and up to 2 years after the last order, unless you request earlier deletion.
• Browsing data (cookies): as indicated in our Cookie Policy.

After these periods, data will be deleted or, where applicable, blocked (restricted access) during the limitation periods for legal actions. If you request deletion, we will keep the data blocked exclusively for the establishment, exercise or defence of legal claims.

In accordance with Articles 15 to 22 of the GDPR and Articles 13 to 18 of the LOPDGDD, you can exercise the following rights:

• Right of access (art. 15 GDPR): obtain confirmation of whether we process your personal data and, if so, access it.
• Right to rectification (art. 16 GDPR): request the correction of inaccurate or incomplete data.
• Right to erasure (art. 17 GDPR): request the deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected ("right to be forgotten").
• Right to restriction of processing (art. 18 GDPR): request the restriction of processing of your data in certain circumstances.
• Right to object (art. 21 GDPR): object to the processing of your data for reasons related to your particular situation, including processing for direct marketing purposes.
• Right to data portability (art. 20 GDPR): receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Right to withdraw consent (art. 7.3 GDPR): withdraw the consent given at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.
• Right not to be subject to automated decisions (art. 22 GDPR): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you.

Xtampa does not make automated individual decisions or create profiles that produce legal effects or significantly affect users (art. 22 GDPR). Decisions relating to quotes, orders and services are always made with human intervention.

We may carry out aggregated and anonymous statistical analyses on Website usage to improve our services, but these analyses do not generate individualised decisions about users.

Xtampa has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Articles 24 and 32 of the GDPR, aimed at preserving the confidentiality, integrity, availability and resilience of processing systems and services. These include:

• Encryption in transit: all communications between your browser and our servers are carried out using SSL/TLS protocol (HTTPS).
• Access control: restricted access to personal data only to authorised personnel who need it to perform their duties.
• Regular backups: regular backups to ensure data recovery in case of an incident.
• Staff training: all personnel with access to personal data has been trained and is aware of their data protection obligations.
• Confidentiality clauses: inclusion of confidentiality and data protection clauses in contracts with suppliers and data processors.
• Periodic review: security measures are reviewed and updated periodically to ensure their adequacy and effectiveness.

Xtampa's services are aimed at persons over 18 years of age and, in particular, at companies, organisations, sports clubs, educational institutions and professionals in the textile and merchandising sector.

We do not knowingly collect personal data from children under 14. If a child under 14 wishes to use our services, the consent of their parents or legal guardians will be required (art. 7 LOPDGDD). If we detect that we have collected data from a minor without parental consent, we will proceed to delete it immediately.

By sending us design files (logos, images, vectors, texts or other materials) for product personalisation, you declare and warrant that:

• You are the owner of the intellectual and industrial property rights over such materials, or you have the necessary authorisation for their use and reproduction.
• The materials do not infringe third-party rights (trademarks, copyright, image rights, etc.).
• You hold Xtampa harmless from any liability arising from the reproduction of designs whose ownership or authorisation you cannot prove.

Xtampa uses design files exclusively for the production of the requested order and the generation of approval mockups. We will not use them for other purposes or transfer them to third parties, except as necessary for order production.

In accordance with Article 21 of Law 34/2002 (LSSI-CE), we will not send advertising or promotional communications by email or other equivalent electronic means that have not been previously requested or expressly authorised by the recipients.

Exceptionally, if a prior contractual relationship exists, we may send you commercial communications regarding Xtampa products or services similar to those initially contracted, informing you of the possibility of objecting to their receipt.

In any case, you can object to receiving commercial communications at any time by:

• The "unsubscribe" link included in each electronic communication.
• An email to [email protected] indicating "Unsubscribe commercial communications".

If you interact with Xtampa through social media (Instagram, Facebook, LinkedIn, etc.) or messaging applications (WhatsApp), the processing of your data will be governed by this policy and by the conditions of the corresponding platform. We recommend consulting the privacy policies of said platforms.

Xtampa may process the data you provide through these channels (name, profile, messages, images) for the purpose of attending to your enquiries, managing requests and, where applicable, publishing content with your prior consent.

As a user, you guarantee that the personal data provided is truthful, accurate and up to date, and you undertake to communicate any changes thereto. You shall be responsible for the truthfulness of the data provided and for any damages that you may cause to Xtampa or third parties due to the communication of false, inaccurate or incomplete data.

If you provide us with data of third parties (for example, contact details of people in your organisation), you guarantee that you have previously informed them about the processing of their data in accordance with Articles 13 and 14 of the GDPR.

The Website may contain links to third-party websites (suppliers, partners, social media, payment gateways). Xtampa is not responsible for the privacy practices or content of such sites. We recommend consulting the privacy policies of each site you visit.

Xtampa reserves the right to modify this Privacy Policy to adapt it to legislative developments, case law, AEPD criteria or improvements in our services and internal procedures.

Any modification will be published on this same page with the date of the last update. We recommend reviewing it periodically. In case of substantial changes affecting the processing of your data, we will notify you through the usual means (email or notice on the Website) with sufficient advance notice.

The date of the last update is indicated in the header of this page.

This Privacy Policy is governed by Spanish and European legislation on personal data protection and electronic commerce, in particular:

• Regulation (EU) 2016/679 (GDPR).
• Organic Law 3/2018, of 5 December (LOPDGDD).
• Law 34/2002, of 11 July (LSSI-CE).
• Royal Legislative Decree 1/2007 (General Law for the Defence of Consumers and Users).