Privacy Policy

SHOP AND ROLL Group (and/or its applicable affiliated companies) is committed to protecting and respecting your privacy while you visit this website (the “Website”).

This “Privacy Notice” or “Policy” (together with other documents referred to herein) describes what personal information we collect and how we collect, use and process it.

This Privacy and Cookie Policy applies to the websites of SHOP AND ROLL GROUP and other group companies and, in particular, to:
– SHOP AND ROLL GROUP, S.L. Spain, with address at C/ Montalbán Nº7, C.P. 28014, Madrid and provided with C.I.F. number B-87705323.
– GRUPO OM COMUNICACIÓN VISUAL, S.L., with registered office at Calle Mariano Benlliure, 2 (28521) – Rivas Vaciamadrid (MADRID) and with C.I.F. number B-85330421).
– SHOP AND ROLL ESPAÑA, S.L., with registered office at Pol. lnd. San Miguel C/ Río Martín nº6, C.P. 50830, Villanueva de Gállego, Zaragoza and is provided with C.I.F. number B70717160.
SHOP AND ROLL GROUP, S.L. is the owner of the websites grupo-om.com, shopandroll.com and tiendashopandroll.com.

This legal notice is also applicable to the other assets of SHOP AND ROLL GROUP, including all entities of the Group: i.e. mobile applications, websites, domains, subdomains and pages and profiles of any of them in social networks.
Please note that, in some of the above websites, particular or specific conditions derived from the specialty of the same may apply. Therefore, we recommend that you access and read them before browsing.

1. Data protection and cookies notice 

1.1. Identity of the data controller

This data protection policy regulates the processing of data carried out by the companies of the SHOP AND ROLL Group, identified above.

1.2. Purpose of the data processing

The data supplied by the user through different means (forms, contracts, etc.) are collected by the responsible company in accordance with current legislation on data protection.

In each of these means, we inform you of the purpose of the data processing, which is carried out solely and exclusively if you have authorised such processing.

Detailed below is the information relating to the different purposes for which we may collect your data. The details of the processing of your data, according to the purpose of collection are as follows:

No automated decisions are made on the basis of the data provided.

Only the data you have provided will be processed for the purpose for which you were informed and authorised. Your data will not be passed on to third parties unless you have expressly authorised this.

The legal basis for the processing of your data is the management and provision of the services and products you have requested and expressly authorised.

1.3. Processing of your data to third parties

The data may be communicated to the other companies in the Group if there is an effective legitimate interest on our part or if you request it and, where appropriate, to third parties (invoicing, satisfaction surveys, training, etc.) for the purposes of customer management, order tracking, invoicing, system security, etc.

This management of your data is performed solely and exclusively to guarantee the effectiveness of the services we offer you.

SHOP AND ROLL GROUP has rules and protocols that regulate the security of the processing of your data and guarantee that they will not be used for any other purpose or by third parties other than those you have authorised and been informed of.

1.4. International transfer of personal data

Your personal data will not be transferred outside the European Economic Area or to countries that do not have a level of compliance equivalent to that required by law or without your prior express authorisation.

1.5. Voluntary nature of the information provided and truthfulness of the data

You always provide us with your data voluntarily and therefore guarantee that the personal data provided are truthful; being responsible, in any case, for the veracity of the data provided, and we reserve the right to exclude any user who has provided false data from the services, without prejudice to any other actions that may be applicable by law.

1.6. Your rights when providing us your data

You may exercise the rights recognised by the applicable legislation at any time, including:

• Access to your data: request what data we hold about you and what use we make of it, and even request that we give it to you so that it can be transferred to another company.
• Rectification of your data: request the modification or rectification of inaccurate data.
• Deletion of your data: request that your data be deleted and not be processed, except for what we are required by law to keep.
• Opposition to processing: that we do not make a specific use of your data.

To do so, you can send a letter indicating which right you wish to exercise (Access, Rectification, Deletion, Opposition or Portability of the data), attaching a copy of an identification document to the postal address or registered office of the Data Protection Officer.

You can also request more information at privacy@shopandroll.com or contact our Data Protection Officer at dpd@shopandroll.com

Remember that, if you are not satisfied with the way we process your data, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

If you wish to stop receiving communications by e-mail, you can unsubscribe through the link that will be offered in each of the e-mails you receive from SHOP AND ROLL GROUP or any of its subsidiaries.

2. Information on cookies and other trackers used by SHOP AND ROLL GROUP

SHOP AND ROLL GROUP, through its applications and websites, uses cookies and other trackers for different purposes. Cookies are files that are generated on your terminal when you browse through one of SHOP AND ROLL GROUP’s applications or websites. These files can store information about the way you browse or simply remember that you are a registered user. SHOP AND ROLL GROUP or third parties may have access to the information contained in these files, so it is important that you decide whether or not you wish to accept this processing.

You can access the Cookies Policy at this link.

3. Register of Processing Activities.

We have prepared a document in which you can find out about the categories of processing carried out at the company.

4. Quality and information security policy of SHOP AND ROLL GROUP

SHOP AND ROLL GROUP has implemented a quality and information security management system to try to meet or exceed the expectations of its users, contacts, customers, employees and suppliers. The established processes are audited frequently and are reviewed every time the processes are improved, or a relevant event occurs for SHOP AND ROLL GROUP. The main objectives of these processes are:

• To mitigate risks by maintaining technical and organisational security measures.
• To guarantee the confidentiality, availability and integrity of both personal data and trade secrets.
• To be proactive in complying with the set of regulations applicable to the development of the activity.
• To only choose suppliers that meet better or similar standards in terms of quality and safety.
• To keep a secure record of assets and their changes.
• To achieve a high level of credibility and trust in third parties and suppliers.
• To raise awareness of physical and logical security among employees and collaborators through a continuous training process.

The processing of personal data is always carried out by SHOP AND ROLL GROUP after having implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Each of these measures aims to guarantee the permanent confidentiality, integrity, availability and resilience of the processing systems and services. It also regularly performs processes of verification, evaluation and assessment of the effectiveness of technical and organisational measures to guarantee the security of the processing. The minimum measures that SHOP AND ROLL GROUP has deployed are as follows:

a) Physical:

• ‘Clean desk’ policy.
• Minimal use of paper or similar media.
• Password-protected printer and output trays with no access by third parties.
• Document destruction service.
• Fireproof material for the conservation of data and information on paper.
• Classified and labelled documents.
• Workplaces protected by in-house and outsourced security measures, with systems that limit or mitigate access by unauthorised persons.

b) Logical:

• At SHOP AND ROLL GROUP we only and always use original, updated and officially licensed software.
• Dual-use terminals have an exclusive profile for professional purposes.
• Disc encryption and, additionally, individual file encryption.
• The ability to restore the availability and access to personal data quickly in the event of a physical or technical incident thanks to a dedicated service.
• Up-to-date firewall and endpoint protection systems on all terminals.
• For remote access, mobile tethering is used, except on trusted networks.
• Different passwords for each application, changed frequently.
• 2FA systems in applications and Internet sites.
• The SHOP AND ROLL GROUP websites are encrypted and have specific security systems. The status of security measures is regularly reviewed manually and using forensic solutions designed for these actions.
• Other common protection tools: session blocking when the device is no longer in use, privacy filters for screens when they are to be used on the move, screensavers with password locking, etc.

Security measures are reviewed frequently, both manually and using specific software.

c) Organisational, training

SHOP AND ROLL GROUP has protocols for secure data management, such as systems that separate access to data by department, an active privilege table, and continuous training for all employees on the protection of personal data and information security.

d) Mandatory resource management standards

E-mail and other data storage or communication devices, as well as fixed or mobile terminals, are exclusively work tools provided by SHOP AND ROLL GROUP for the performance of work or business duties, in accordance with the contract, and may not be used for personal or domestic purposes or for professional purposes other than those agreed. SHOP AND ROLL GROUP may make backup copies and access the content derived from the use of these media for the sole purpose of controlling the fulfilment of employment obligations, statutory obligations or obligations established through a commercial contract and to guarantee the integrity of these devices. In any case, accesses will be made in accordance with data protection regulations and ensuring the protection of the privacy and intimacy of those affected.

5. Applicable regulations and channels for conflict resolution

The original version of this legal, privacy and cookies notice is written in Spanish, will remain accessible via the Internet on this website and must be interpreted in accordance with the applicable regulations in Spain.

For further information, to report a fault or to ask any questions, you can contact SHOP AND ROLL GROUP at the addresses indicated at the beginning of this notice.

This Policy was revised on 26/09/2024.