Privacy policy

1. Data controller

• •Data controller: CEMENT DESIGN
• •CIF/NIF: [CIF]
• •Address: Paseo de la Castellana 91
• •Email for exercising your rights and for privacy enquiries: hola@cementdesign.shop
• •Phone: +34 911 407 965 / +34 911 407 966

2. Personal data we process

We process the following categories of data, depending on the relationship you have with us:

• •Identification and contact data: name and surname, company or professional activity, tax ID, postal address, email and telephone.
• •Data relating to the business relationship: quotations requested, products and services of interest, orders, delivery address, purchase history, incidents and communications.
• •Billing and payment data: amounts, description, tax details and payment reference. We do not store your full card details; they are managed entirely by the payment gateway.
• •Account and professional area data: login credentials, professional profile, customer type, assigned discounts, prescription codes, referred customers and commissions.
• •Academy data: courses, learning progress, assessments and certificates issued.
• •Technical browsing data: IP address, device and browser type, language and country, and access logs for security purposes.
• •Images you voluntarily upload to the visualisation tools (for example, "Virtual Spaces").

3. Purposes, legal bases and retention periods

• •Handling requests for information, contact and quotations (website, telephone or email). Legal basis: your consent and the application of pre-contractual measures. Retention: 1 year from the last interaction, unless it becomes a contractual relationship.
• •Managing the purchase, payment, shipping and after-sales service of online shop orders. Legal basis: performance of the contract. Retention: during the contractual relationship and, afterwards, until legal liabilities are time-barred.
• •Issuing invoices and complying with tax and accounting obligations. Legal basis: legal obligation (tax, accounting and invoicing rules). Retention: 6 years for commercial obligations and 4 years for tax obligations.
• •Managing registration, access to and operation of the private professional area, including discounts, codes, prescriptions and commissions. Legal basis: performance of the contract and your consent. Retention: while you keep the account and, after closure, for the applicable legal periods.
• •Managing courses, assessments and the issuing of diplomas. Legal basis: performance of the contract and consent. Retention: for the duration of the training and the legal retention periods for academic and accreditation purposes.
• •Sending commercial communications, news and newsletters. Legal basis: your consent (or the legitimate interest in communicating with existing professional customers about similar services). Retention: until you withdraw your consent or object.
• •Generating visualisations with artificial intelligence tools from the images you upload. Legal basis: your consent. Retention: for the time needed to generate the result.
• •Preventing fraud, ensuring the security of the site and of transactions, and responding to requests from authorities. Legal basis: legitimate interest and legal obligation. Retention: the legal limitation periods.
• •Analysing how the website is used in order to improve its content and usability. Legal basis: your consent, given through the cookie settings panel.

4. Origin of the data

The data come from the data subject (website forms, email, telephone, user registration or the purchase process). In the professional context, they may come from the person or company you work for, or from publicly accessible sources and professional directories (for example, contact details of practices, studios or installers).

We do not process special category data (health, ideology, ethnic origin or other data under Article 9 of the GDPR) or data relating to convictions or offences.

5. Recipients and data processors

We do not transfer your data to third parties for their own purposes, except where legally required. In order to provide the service, the following processors and categories of recipients access the data:

• •Technology platform and web hosting provider where the site and the database are hosted.
• •Payment gateway (Stripe Payments Europe, Ltd.) to process order payments, which processes payment data as an independent controller.
• •Email service and transactional communication providers.
• •Artificial intelligence services to generate the visualisations you request or for automated technical advice.
• •Tax, accounting and legal advisers, and banking institutions.
• •Transport and logistics companies, with the data strictly necessary to deliver the order.
• •Public authorities, courts and tribunals where there is a legal obligation.

6. International data transfers

Some of the above providers may be located outside the European Economic Area, mainly in the United States. In such cases, the transfers are covered by a European Commission adequacy decision (for example, the EU-US Data Privacy Framework) or by appropriate safeguards such as standard contractual clauses, together with supplementary measures where necessary. You can request further information by writing to hola@cementdesign.shop.

7. Rights of data subjects

You may exercise the following rights by writing to hola@cementdesign.shop, proving your identity:

• •Access: to know what data we process and how we obtain it.
• •Rectification: to correct inaccurate or incomplete data.
• •Erasure: to request the deletion of data when it is no longer necessary.
• •Objection: to object to processing based on legitimate interest and to direct marketing.
• •Restriction of processing: to request that we suspend processing in the cases provided for by law.
• •Portability: to receive your data in a structured, commonly used format or to have it transmitted to another controller.
• •To withdraw your consent at any time, without affecting the lawfulness of prior processing.
• •Not to be subject to automated individual decisions with significant legal effects.

8. Minors

The site and the services offered are professional in nature and are not aimed at children under 14. Data of children under that age are only accepted with the consent of their parents or guardians.

9. Mandatory or optional nature of the data

The data marked as mandatory in the forms are necessary to handle the request or formalise the contract; if they are not provided, the service cannot be supplied. The remaining data are optional and their absence does not affect the basic operation of the service.

10. Security measures

We apply technical and organisational measures appropriate to the risk (encryption of communications via HTTPS, role-based access control, activity logging, backups and data minimisation) to guarantee the confidentiality, integrity and availability of the information.

11. Updates to this policy

We may update this policy to reflect legislative changes or changes in our processing activities. The version in force is the one published on the website, stating the date of the last update.