Privacy statement of Zebrabox

This privacy statement explains how we process your personal data when you visit our website, use our services or contact us. It also provides information about the purposes and legal bases of the processing, the service providers involved and your data protection rights.

1. Controller and content of this privacy policy

We, Zebrabox Services SA (Eichenstrasse 4a, 8808 Pfäffikon SZ, registered in the commercial register under number CHE-114.055.433), are the operator of the website www.zebrabox.es (website) and, unless otherwise stated in this privacy policy, together with the operator of our local site, Spaze Opco 1 S.L.U. (Calle Laureà Miró 375, Nave 1, Sant Feliu de Llobregat, Spain), are joint controllers responsible for the data processing operations set out in this privacy statement. Where reference is made below to "we" or "us", unless otherwise stated, both controllers are referred to.

To ensure that you are aware of the personal data we collect from you and the purposes for which we use it, please read the information below. Our data protection practices are guided by the legal requirements of Spanish data protection law, in particular Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, as well as the GDPR and the Swiss Federal Data Protection Act (FADP).

Please note that the following information may be reviewed and modified from time to time. We therefore recommend consulting this data protection declaration regularly. Furthermore, other companies are responsible under data protection law for individual data processing operations listed below or are mutually responsible with us, so that in these cases the information of these providers is also authoritative.

Status: July 2026

2. Contact person for data protection

If you have any questions regarding data protection or would like to exercise your rights, please contact our data protection correspondent by sending an email to the following address: privacidad@zebrabox.es

You can contact our EU data protection representative at:

MLL EU-GDPR GmbH
Ganghoferstrasse 37
DE-80339 Munich
zebrabox@mll-gdpr.com

3. Data processing in connection with contacting us

If you contact us via our contact addresses and channels (e.g. by e-mail, telephone or contact form), your personal data will be processed. The data you have provided us with, such as your title, name, e-mail address, postal address and telephone number and your enquiry (esp. location concerned, category of enquiry, message) are processed. In addition, the time of receipt of the enquiry is documented. Mandatory information is marked with an asterisk (*) in contact forms. Depending on the enquiry, we will also ask you for further details if you have not already provided them to us yourself, such as:

Vehicle rental: esp. rental period, pick-up location, number of drivers, driver's licence copies, payment method and payment details;
Packaging material: desired product, quantity, pick-up location, payment method and payment information;
Moves: Date of move, previous and new address, details on planning the move and transport (e.g. furniture, living space, floor, etc.), method of payment and payment details;
Reception of goods: number of parcels, location concerned, deposit or collection, payment method and payment details;
File destruction: quantity of files, location concerned, desired time, payment method and payment details;
Archive systems: boltless shelving type and quantity, details for creating customised shelving systems, rent or purchase, payment method and payment details.

We process this data in order to comply with your request (e.g. to provide you with information about our products and services, to support you in the performance of your contract, to incorporate your feedback in the improvement of our products and services, etc.).

The legal basis for this data processing is our legitimate interest in terms of Art. 6 para. 1 lit. f GDPR in the fulfilment of your request or, if your request is directed towards the conclusion or execution of a contract, the necessity for the performance of the pre-contractual or contractual measures in terms of Art. 6 para. 1 lit. b GDPR.

4. Data processing for the reservation of a Zebrabox and the waiting list registration

On our website you have the possibility to rent a Zebrabox or to be put on a waiting list for the rental of a Zebrabox. For this purpose, we collect the following data, whereby mandatory data are marked with an asterisk (*) in the booking process:

Personal data:
- Salutation
- Surname and first name
- Postal address
- Date of birth
- Company in the case of corporate clients
- E-mail address
- Telephone number
Product data:
- Details of the desired Zebrabox (type, size, time period, reason for storage)
- Value of goods
- Stored goods

We use the personal details to verify your identity before concluding a contract. We need your e-mail address to confirm your booking and for future communication with you - which is necessary to process the contract. The telephone number is used - after successful verification by means of a delivered validation code - to deliver the access code in the form of a QR code. We save your data together with the peripheral data of the booking (e.g. time, booking number etc.), details of the product (e.g. size, exact location, identification number of the Zebrabox), the data on payment (e.g. selected payment method, confirmation of payment and time; see also section 6) as well as the information on the processing and fulfilment of the contract (e.g. rectification of problems, use of customer service etc.) in our CRM database (see also section 7) to ensure correct booking processing and fulfilment of the contract.

The legal basis for this data processing is the fulfilment of a contract with you according to Art. 6 para. 1 lit. b GDPR.

The provision of data (e.g. reason for storage, knowledge of Zebrabox) that is not marked as mandatory is voluntary. We process this data in order to customise our products and services to your personal needs as best as possible, to facilitate the processing of contracts, to contact you by alternative means of communication if necessary, regarding the fulfilment of the contract or for statistical collection and evaluation in order to optimise our products and services.

The legal foundation for this data processing is your consent in terms of Art. 6 para. 1 lit. a GDPR. You can revoke your consent by notifying us at any time.

You can add your access code to the wallet on your (iOS or Android) smartphone using the "PassKit" app, so that you can find the code more easily and have it to hand more quickly. In this case, with your consent, we will transmit the following data to PassKit, Inc (6/F Golden Sun Centre Sheung Wan Hong Kong): Customer number, first name, last name and location of the booked Zebrabox. The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by informing us. For any other processing of your data by PassKit, Inc., please see their data protection policy.

For the transmission of contract-relevant customer information by e-mail, we use the software application Mailchimp of Intuit Inc. (2700 Coast Avenue, Mountain View, CA 94043, USA). Therefore, at most, your data will be stored in a database of the Intuit Inc., which may allow Intuit Inc. to access your data if this is necessary for the provision of the software and for the assistance in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 9 of this data protection policy. The legal justification for the transfer of data is our legitimate interest in the use of third-party services within the meaning of Art. 6 para. 1 lit. f GDPR.

Intuit Inc. may wish to use some of this data for its own purposes (e.g. for statistical analyses for product optimisation). Intuit Inc. is the controller for these data processing operations and must ensure compliance with data protection laws in connection with these data processing operations. Information about data processing by Intuit Inc. can be found by following the link: https://www.intuit.com/privacy/statement/.

5. Data processing during identity verification

In order to prevent, detect and prosecute unlawful and abusive behaviour by customers, we require identification by means of an official identity document for the booking of a Zebrabox. In this respect, biometric data, i.e. data requiring special protection, may be processed.

You can either identify yourself online or visit one of our locations and have one of our employees carry out the verification. During the inspection at our location, we verify whether you are the person in the photo on the ID document and whether the data on the ID document matches the data entered in the booking process (see point 4). We subsequently save a copy of the ID document.

For the online identification we use the solution "PXL Ident" of the PXL Vision AG (Rautistrasse 33, 8047 Zürich, Switzerland (PXL)). In this context, we redirect you to the web or mobile app and PXL receives the information that you have made a booking for a Zebrabox as well as other technical data associated with the call-up of the website or app (see in particular section 8.1 regarding log file data). We receive information from PXL about whether the identification was successful or not, as well as a copy of the ID card used. The legal basis for the data processing performed by us as the data protection controller is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in protecting our property and the property of our customers as well as in protecting our legal claims and the legal claims of our customers.

For the further data processing within the scope of online identification, PXL is the data protection controller. PXL will only process your data for online identification with your express consent in accordance with Art. 6 para. 1 lit. a and Art. 9 para. 2 lit. a GDPR as the legal basis. You can revoke your consent at any time with effect for the future by notifying PXL. You can find detailed information here: https://www.pxl-vision.com/en/privacy-policy-daego.

6. Data processing during the payment process

When you submit bookings on our website, depending on the service and the desired payment method - in addition to the information mentioned in section 4 - you may be required to provide further data, such as your credit card information or the login to your payment service provider. This information, as well as the fact that you have made a booking with us for the amount and time concerned, will be forwarded to the respective payment service providers (e.g. payment solution providers, credit card issuers and credit card acquirers). Please also always observe the information of the respective company, especially the data protection policy and the general terms and conditions. The legal basis for our data processing is the fulfilment of a contract in accordance with Art. 6 para. 1 lit. b GDPR.

In order to avoid payment incidents, the necessary data, in particular your personal details, may also be transmitted to a credit agency for the automated assessment of your solvency. In this context, the credit agency may assign you a so-called score value. This is an estimate of the future risk of default, e.g. based on a percentage. The value is collected using mathematical-statistical procedures and including data of the credit agency from other sources. In this context, automated decision-making (and profiling with or without high risk) may also occur, which may result in the payment method "invoice" not being made available to you. If the legal requirement is met, you have the right to express your point of view and request a review of the decision by a natural person. The legal basis for this data processing is our legitimate interest according to Art. 6 para. 1 lit. f GDPR in avoiding payment defaults.

7. Central data storage and analysis in the CRM system

If a clear assignment to your person is possible, we will store and link the data described in this data protection policy, i.e. especially your personal details, your approaches, your contract data and your surfing behaviour on our websites in a central database. This serves the efficient administration of customer data, allows us to adequately process your requests and enables the efficient provision of the services requested by you and the processing of the related contracts. Legally, this data processing is based on our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the efficient management of user data.

We also analyse this data in order to further develop our products and services to meet your needs and to be able to display and suggest the most relevant information and offers to you. We also use methods that predict possible interests and future bookings based on your use of our website. Part of these analyses could be considered as profiling (with or without high risk). The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in carrying out marketing activities.

For central data storage and analysis in the CRM system, we use a software application provided by Uniserv B.V. (Korte Hogendijk 14, 1506 MA Zaandam, Netherlands). Therefore, at most, your data will be held in a database by Uniserv, which may allow Uniserv to access your data where necessary to provide the software and to assist you in using the software. Information on the processing of data by third parties and any transfer abroad can be found in section 9 of this data protection declaration. Further information about data processing in connection with Uniserv can be accessed here. Legally, the transfer of data is based on our legitimate interest in the use of third-party services in accordance with Art. 6 para. 1 lit. f GDPR.

Uniserv may wish to use some of this data for its own purposes (e.g. for statistical analyses for product optimisation). Uniserv is the controller for these data processing operations and must ensure compliance with data protection laws regarding these data processing operations. Information about data processing by Uniserv can be accessed here.

8. Background data processing on our website

This chapter covers the following data processing operations:

8.1 Data processing while visiting our website (log file Data)
8.2 Cookies
8.3 Tracking and web analysis tools
8.4 Online advertising and targeting
8.5 Social Media

8.1 Data processing while visiting our website (log file Data)

When visiting our website, the web servers temporarily store every access in a log file. The following data is collected without your intervention and stored until it is automatically deleted by us:

IP address of the requesting computer;
Date and time of access;
Name and URL of the file accessed;
Website from which the access was made, if necessary with the used search word;
Operating system of your computer and the browser you are using (including type, version and language settings);
Type of device in the instance of access by mobile phones;
City or region, from which the access was made; and
Name of your internet access provider.

The collection and processing of these data is made for the purpose of our website (connection establishment), to permanently guarantee system security and stability, to enable error and performance analysis and optimisation of our website (see section 8.3. regarding the last points). In case of an attack on the network infrastructure of the website or if there is any suspicion of other unauthorised or improper use of the website, the IP address as well as the other data will be evaluated for the purpose of investigation and prevention and, if necessary, used to identify the user concerned in proceedings for civil or criminal prosecution. The purposes described above are our legitimate interest as defined by Art. 6 para. 1 lit. f GDPR and thus the legal basis for data processing.

To operate our website, we use the services of our hosting provider iquer.net GmbH & Co. KG, Klingenderstraße 5, 33100 Paderborn, Germany. Therefore, your data will most likely be stored in a database of iquer, which may allow them to access your data if this is necessary for the purpose of providing the software and supporting you while using the software. Information on the processing of data by third parties and any transfer abroad can be found in section 9 of the privacy policy. Further information on data processing related to iquer can be found at https://www.iquer.net/datacenter/. The legal basis for the transfer of data is our justified interest as defined in Art. 6 para. 1 lit. f GDPR for the use of third-party services. It is possible that iquer would like to use some of this data for its own purposes (e.g. for statistical analysis for product optimisation). For these data processing activities, iquer is the responsible party and must ensure that the data protection laws are respected in connection with these data processing activities. Information about data processing by iquer can be found at https://www.iquer.net/datacenter/.

Eventually, when you visit our website, we use cookies as well as other applications and tools that are built on the use of cookies. Within this context, the data described here may also be processed. You will find more details regarding this in the other subsequent sections of this data protection declaration, specifically section 8.2 below.

8.2 Cookies

Cookies are information files that your web browser stores on your computer’s hard drive or memory when you visit our website. Cookies have assigned identification numbers that are used to identify your browser and to read the information contained in the cookie.

Among other things, cookies help to make visiting our website easier, more pleasant and more meaningful. We use cookies for various reasons that are required, that is “technically necessary”, for your desired use of the website. For example, we use cookies to provide the booking functions or to temporarily save your entries when filling out a form on the website so that you do not have to re-type them when calling up another sub-page. Furthermore, cookies also perform other technical functions required for the operation of the website, such as so-called load balancing, meaning the distribution of the performance load of the page to different web servers in order to relieve the server. Cookies are also used for security purposes, e.g. to prevent the unauthorised posting of content. Finally, we also use cookies as part of the design and programming of our website, e.g. to enable the uploading of scripts or codes.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in providing a user-friendly and up-to-date website.

Most internet browsers accept cookies automatically. However, when accessing our website, in accordance with Article 22.2 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce and Article 6 para. 1 lit. a GDPR, we ask for your consent to the cookies that we use which are not technically necessary, especially when using third-party cookies for marketing purposes. You can adjust your cookie preferences by using the corresponding buttons in the cookie banner or on our cookies page. Details regarding the services and data processing associated with each cookie can be found within the cookie banner, on our cookies page and in the following sections of this Privacy Policy.

You may also be able to configure your browser so that no cookies are stored on your computer or so that a message appears whenever you receive a new cookie. On the following pages you will find explanations of how you can configure the processing of cookies in selected browsers.

Disabling cookies may prevent you from using all the features of our website.

8.3 Tracking and web analysis tools

8.3.1 General information on tracking

In order to design our website according to requirements and to continuously optimise it, we use the web analysis services listed below. In this context, pseudonymised user profiles are created and cookies are used (see also section 8.2). The information generated by the cookie about your use of this website is usually transmitted together with the log file data mentioned in section 8.1 to a server of the service provider, where it is stored and processed. This may involve a transfer to servers abroad, e.g. the USA (see section 9, especially regarding the level of data protection and the safeguards provided).

By processing the data, we obtain, among other things, the following information:

Navigation path followed by a visitor on the website, including content viewed and products selected or purchased, or services booked;
Time spent on the website or a subpage;
Subpage on which the visitor leaves the website;
Country, region or city from which the website is accessed;
Terminal device, including type, version, colour depth, resolution and the width and height of the browser window; and
Whether the visitor is a returning or new visitor.

On our behalf, the provider will use this information to evaluate the use of the website, in particular to generate reports on website activity and to provide other services related to the use of the website and the internet for the purposes of market research and the demand-oriented design of our website. For these processing operations, we and the providers may, to a certain extent, be regarded as joint controllers under data protection law.

The legal basis for these data processing operations is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. Some of the data processing may also be considered profiling, to which your consent also extends. You can revoke your consent or refuse the processing at any time by rejecting or switching off the relevant cookies in your web browser settings (see section 8.2) or by using the service-specific options described below.

For the continued processing of the data by the respective provider as the sole controller under data protection law, including any possible disclosure of this information to third parties, such as authorities on the basis of national legal provisions, please refer to the respective provider’s privacy information.

8.3.2 Google Analytics

We use the web analysis service Google Analytics from Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google).

Deviating from the description in section 8.3.1, IP addresses are not logged or stored in Google Analytics (in the version “Google Analytics 4” applied here). In case of accesses originating from the EU, IP address data are only used to obtain location data and are then deleted immediately. When collecting measurement data in Google Analytics, all IP searches take place on EU-based servers before the traffic is passed on to Analytics servers for further processing. In Google Analytics regional data centres are used. If a connection is made in Google Analytics to the nearest available Google data centre, the measurement data is sent to Analytics via an encrypted HTTPS connection. At these centres the data is then further encrypted before being forwarded to Analytics’ processing servers and made available on the platform. Based on the IP-addresses, the most suitable local data centre is then determined. This may also result in data being transferred to servers abroad, e.g. the USA (see section 9.2, particularly on the lack of an adequate level of data protection and the provided guarantees).

For this purpose, we also use the technical extension “Google Signals”, which also enables cross-device tracking. This makes it possible to associate a single website visitor with different end devices. However, this only happens if the visitor has logged into a Google service when visiting the website and has also activated the “personalised advertising” option in their Google account settings. Even then, we do not have access to any personal data or user profiles; they remain anonymous to us. If you do not wish to use “Google Signals”, you can deactivate the “personalised advertising” option in your Google account settings.

Users can prevent the collection of the data generated by the cookie and related to the website usage by the user concerned (incl. the IP-address) by Google as well as the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. This will save an opt-out cookie on the user’s terminal device. If the users delete cookies (see section 8.2 on cookies), the link must be clicked again.

8.4 Online advertising and targeting

8.4.1 In General

We use services provided by various companies to present you with relevant online offers. In this process, your user behaviour on our website and on websites of other providers is analysed so that online advertising individually tailored to you can subsequently be displayed.

Most of the technologies used to track your user behaviour and display targeted advertising work with cookies (see also section 8.2) or similar technologies and use unique identifiers that can be recognised across different websites. Depending on the service provider, you may also be recognised online when using different devices, such as a laptop and a smartphone. This may be the case, for example, if you have registered for a service that you use on multiple devices.

For these purposes, the data generated when websites are accessed (log file data, see section 8.1) and when cookies are used (section 8.2) may be transmitted to and processed by companies involved in advertising networks. Data may also be transferred to countries throughout the world (see section 9, especially regarding the level of data protection and the safeguards provided). The following data may also be used to determine the advertising that is potentially most relevant to you:

Personal information that you provided when registering for or using an advertiser’s service, such as your gender or age range; and
User behaviour, such as search requests, interactions with advertisements, types of websites visited, products or services viewed or purchased and newsletters subscribed to.

We and our service providers use this data to determine whether you belong to the target group we address and take this into account when selecting advertisements. For example, after visiting our website, you may be shown advertisements for products or services that you viewed on our pages (retargeting). Depending on the extent of the data, a user profile may be created and evaluated automatically, i.e. through profiling. Advertisements are selected according to the information stored in the profile, such as membership of certain demographic segments or potential interests or behaviour. Such advertisements may be displayed to you through different channels. In addition to our website or app, this includes advertisements delivered through the online advertising networks we use, such as Google.

The data may also be analysed for billing purposes and to assess the effectiveness of advertising measures, improve our understanding of the needs of our users and customers and improve future campaigns. Such analysis may also include information indicating that an action, such as visiting certain sections of our website or submitting information, resulted from a particular advertisement. We also receive aggregated reports from service providers concerning advertising activity and information about how users interact with our website and advertisements.

The legal basis for these data processing operations is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. Some of the data processing may also be considered profiling, to which your consent also extends. You can revoke your consent or refuse the processing at any time by rejecting or switching off the relevant cookies in your web browser settings (see section 8.2). Further options for blocking advertising can be found in the information provided by the respective service provider.

8.4.2 Google Ads

This website uses the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google) for online advertising, as explained in section 8.4.1. Google uses cookies (cf. the list here) as well as similar technologies and unique identifiers (e.g. advertising ID), to enable your browser to be recognised when visiting other websites. The information generated thereby about your visit to these websites (including your IP address) will be transmitted to and stored by Google on servers in the United States (see section 9, especially regarding the lack of an adequate level of data protection and the provided guarantees). Google will process the data by name to display personalised advertising to you on Google services (e.g. the search engine). Further information on data protection at Google can be found here.

The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time by rejecting or switching off the relevant cookies in your web browser settings (see section 8.2). Further options for blocking advertising can be found here.

8.4.3 Microsoft Advertising / Bing Ads

The website uses services of Microsoft Corporation (One Microsoft Way, Redmond WA 98052-6399, USA (Microsoft)) for online advertising, as explained in section 8.4.1. In doing so, Microsoft uses cookies (cf. the list here) and unique identifiers (e.g. advertising ID or the UET tag) which enable your browser to be recognised when you visit other websites. The information thus generated about your visit to these websites (including your IP address) will be transmitted to and stored by Microsoft on servers in the United States (see section 9, especially regarding the lack of an adequate level of data protection and the provided guarantees). Microsoft will process the data by name in order to display personalised advertising to you on Microsoft services (e.g. the search engine). Further information on data protection at Microsoft can be found here.

8.4.4 Yieldlab

The website uses services of Virtual Minds GmbH (Ellen-Gottlieb-Str. 16, 79106 Freiburg i. Breisgau, Germany (Yieldlab)) for online advertising, as explained in section 8.4.1. In doing so, Yieldlab uses cookies and unique identifiers (e.g. Mobile Advertisement ID (MAID)), which allow your browser to be recognised when visiting other websites. The information thus generated about your visit to these websites (including your IP address) is transmitted to and stored on servers operated by Yieldlab in Germany, among other places, and may also be transmitted to other countries (cf. in this regard, especially the lack of an adequate level of data protection and the provided guarantees, section 9). Yieldlab will process the data by name in order to display personalised advertising to you on websites and services of affiliated companies, namely from the media industry. Further information on data protection at Yieldlab can be found here.

8.4.5 Meta Pixel and Custom Audience

The website uses the advertising services of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, (Meta)) for online advertising, as explained in section 8.4.1. Meta uses technologies such as cookies and the so-called meta pixel, which enable your browser to be recognised when visiting other websites. The information thus generated about your visit to these websites (including your IP address) is transmitted to Meta’s servers in the USA, among other places, and stored there (cf. section 9, especially on the lack of an adequate level of data protection and the provided guarantees). Meta will process the data by name in order to display personalised advertising to you on Meta services (e.g. Facebook or Instagram). In doing so, we use the targeting functions offered by Meta, namely Website Custom Audiences, which enables us to recognise you on Meta services after you have visited our website and to display targeted advertising to you. Further information on data protection at Meta can be found here and here.

8.5 Social Media

8.5.1 Social Media Profile

On our website, we have included links to our profiles in the social networks of the following providers:

Meta Platforms Ireland Limited (Facebook and Instagram), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, Privacy Notice;
LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland, Privacy Notice;
Google Ireland Limited (YouTube) Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, Privacy Notice.

By clicking on the icons of the social networks, you will automatically be redirected to our profile in the respective network. This establishes a direct connection between your browser and the server of the respective social network. As a result, the network receives data described in the section on log files (section 8.1), specifically the information that you have visited our website with your IP address and have clicked on the link. This may also result in data being transferred to servers abroad, e.g. in the USA (see section 9, especially on the lack of an adequate level of data protection and the provided guarantees).

If you click on a link to a network while you are logged into your user account with the network in question, the content of our website may be linked directly to your account. If you want to prevent this, you should log out before clicking on the relevant links. A connection between your access to our website and your user account takes place in any case if you log in to the respective network after clicking on the link. The respective provider is responsible under data protection law for the associated data processing. Therefore, please read the data protection information on the website of the network.

The legal basis for any data processing attributed to us is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the use and advertising of our social media profiles.

8.5.2 Social Media Plugins

On our website, you can use social media plugins from the provider listed below:

Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, Privacy Policy.

We use social media plugins to make it easier for you to share content from our website. The social media plugins help us to increase the visibility of our content on social networks and therefore contribute to improved marketing.

The plugins are deactivated by default on our website and therefore do not transmit any data to the social networks when you merely visit our website. To increase data protection, we have integrated the plugins in such a way that a connection is not automatically established with the networks’ servers. Only when you activate a plugin by clicking on it and thereby consent to the transmission and further processing of data by the social network provider will your browser establish a direct connection to the servers of the respective social network.

The content of the plugin is transmitted directly to your browser by the social network and integrated into the website by your browser. This informs the respective provider that your browser has accessed the corresponding page of our website, regardless of whether you have an account with the social network or are currently logged into it. This information, including your IP address and the other log file data described in section 8.1, is transmitted by your browser directly to a server of the provider, usually in the USA, and stored there (see section 9, especially regarding the level of data protection and the safeguards provided). We have no influence on the scope of the data collected by the provider through the plugin, although from a data protection perspective we may, to a certain extent, be considered joint controllers with the provider.

If you are logged into the social network, the provider can assign your visit to our website to your user account. If you interact with the plugins, the corresponding information is also transmitted directly to a server of the provider and stored there. Information such as the fact that you like one of our products or services may also be published on the social network and displayed to other users.

The social network provider may use this information to display advertising and tailor the respective content to users’ needs. For this purpose, usage, interest and relationship profiles may be created, for example, to automatically evaluate your use of our website in relation to the advertisements displayed to you on the social network, to inform other users about your activities on our website and to provide other services associated with the use of the social network. Information about the purpose and scope of the data collection, the further processing and use of the data by the social network provider, your rights and the settings available to protect your privacy can be found in Meta’s Privacy Policy.

If you do not want the social network provider to assign the data collected through our website to your user account, you must log out of the social network before activating the plugins. Your consent within the meaning of Art. 6 para. 1 lit. a GDPR forms the legal basis for the data processing described. Some of the data processing may also be considered profiling, to which your consent also extends. You can revoke your consent at any time in accordance with the information contained in Meta’s Privacy Policy.

9. Transfer and transmission abroad

9.1 Disclosure to and access by third parties

Without the support of other companies, we would not be able to provide our products and services in the intended format. In order for us to be able to use the services of these companies, it is also necessary to pass on your personal data to these companies to a certain extent. Sharing is done with selected third-party service providers and only to the extent necessary for the optimal provision of our services.

Several third-party service providers are already explicitly mentioned in this privacy policy. Your data will also be passed on if this is necessary to process the contractual relationship, such as to removal companies or providers of document shredding services. The legal basis for these disclosures is the necessity for the execution of a contract within the meaning of Art. 6 para. 1 lit. b GDPR. The third-party service providers are responsible for these data processing operations within the meaning of the Data Protection Act and not us. It is the responsibility for these third-party service providers to inform you about their own data processing activities – which go beyond the transfer of data for the provision of services – and to comply with data protection laws.

Moreover, we may transfer personal data to third party providers of shipping, printing, security, IT support, data management, data backup, cloud and storage services where this is necessary for the use of the third-party services. Our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in using third-party services provides the legal basis for this data processing.

In addition, your data may be passed on, especially to authorities, legal advisors or collection agencies, if we are legally obliged to do so or if this is necessary to protect our rights, specifically to enforce claims arising from our relationship with you. Data may also be disclosed if another company intends to acquire our company or parts thereof and such disclosure is necessary to carry out due diligence or to complete the transaction. Our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the protection of our rights and compliance with our obligations or the sale of our company or parts thereof provides the legal basis for this data processing.

9.2 Transfer of personal data abroad

We are also entitled to transfer your personal data to third parties abroad, if this is necessary to carry out the data processing mentioned in this data protection declaration. Individual data transfers have already been mentioned in the preceding sections (see in particular section 8). It goes without saying that the legal provisions on the disclosure of personal data to third parties are being observed. The countries to which data is transferred include those that have an adequate level of data protection according to a decision by the Federal Council and the EU Commission (such as the member states of the EEA or, from the EU’s perspective, Switzerland), but also countries (such as the USA) whose level of data protection is not considered adequate (see annex 1 of the Data Protection Ordinance (DPA) and the EU Commission's website). If the country in question does not have an adequate level of data protection, we ensure that your data is adequately protected at these companies by means of suitable guarantees, unless an exception is specified in the individual case for the data processing (cf. Art. 49 GDPR). Unless otherwise stated, these are the choice of companies certified under the EU-U.S. Data Privacy Framework or standard contractual clauses within the meaning of Art. 46 para. 2 lit. c GDPR, which can be accessed on the websites of the Federal Data Protection and Information Commissioner (FDPIC) and the EU Commission. If you have any questions about the measures taken, please contact our contact person for data protection (see point 2).

9.3 Information on data transfers to the USA

Some of the third-party service providers mentioned in this privacy policy are based in the USA. In the interests of integrity, we would like to point out for users who are resident or domiciled in Switzerland or the EU that there are surveillance measures taken by US authorities in the USA which generally enable the storage of all personal data of all persons whose data has been transferred from Switzerland or the EU to the USA. This is done without any differentiation, limitation or exception based on the objective pursued and without any objective criterion that would make it possible to limit the access of the US authorities to the data and their subsequent use to very specific, strictly limited purposes that are capable of justifying the intrusion associated with both the access to and the use of these data. Furthermore, we would like to point out that in the USA, data subjects from Switzerland or the EU do not have any legal remedies or effective legal protection against general access rights of US authorities that would allow them to obtain access to the data concerning them and to obtain their correction or deletion. We explicitly draw your attention to this legal and factual situation in order to enable you to make an appropriately informed decision to consent to or object to the use of your data.

For transfers from the European Union or Switzerland to organisations in the USA that are certified under the Data Privacy Framework, an adequate level of data protection is recognised. Where a recipient is not certified under the applicable Data Privacy Framework, we ensure that your data is adequately protected through contractual arrangements with these companies, as well as any additional appropriate safeguards that may be required.

10. Retention periods

We only store personal data for as long as is required to carry out the processing operations explained in this data protection declaration within the scope of our legitimate interest. For contractual data, storage is required by mandatory legal retention obligations. Requirements obliging us to retain data result from accounting regulations and tax law provisions. According to these regulations, business communication, concluded contracts and accounting vouchers must be stored for up to 10 years. As soon as we no longer need this data to provide services for you, that data will be blocked. This means that the data may then only be used if this is necessary to fulfil the retention obligations or to defend and enforce our legal interests. The data will be deleted as soon as there is no longer any obligation to retain the data and no longer any legitimate interest in retaining it.

11. Data security

We use appropriate technical and organizational security measures to protect your personal data stored with us against loss and unlawful processing, specifically unauthorized access by third parties. Our employees and the service companies commissioned by us are obliged by us to maintain confidentiality and data protection. Furthermore, these persons are only granted access to personal data to the extent necessary to fulfil their duties.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the Internet and electronic means of communication always involves certain security risks and we cannot therefore provide an absolute guarantee for the security of information transmitted by this means.

12. Your rights

As long as the legal requirements are fulfilled, you have the following rights as a person affected by data processing:

Right of access: You have the right to request access to your personal data stored by us at any time and free of charge whenever we process it. This gives you the opportunity to check exactly what personal data we are processing concerning you and whether we are processing it in accordance with the applicable data protection regulations.
Right to rectification: You have the right to request that inaccurate or incomplete personal data be rectified and to be informed of the rectification. In this case, we will also inform the recipients of the data concerned about the adjustments we have made, unless this is impossible or involves disproportionate effort.
Right to deletion: You have the right to have your personal data deleted under certain circumstances. In individual cases, particularly in the case of statutory retention obligations, the right to deletion may be excluded. In this case, the deletion may be replaced by blocking the data if the conditions are met.
Right to restriction of processing: You have the right to demand the restriction of the processing of your personal data.
Right to data transmission: You have the right to obtain without charge from us the personal data you have provided to us in a readable format.
Right to review: In the event of automated individual decisions, you have the right to express your point of view and request a review of the decision by a natural person.
Right to object: You can object to data processing at any time, especially in the case of data processing in connection with direct marketing (e.g. marketing e-mails).
Right of revocation: Generally, you have the right to revoke any consent you have given at any time. However, processing activities based on your consent in the past will not become unlawful as a result of your revocation.

To exercise these rights, please send us an e-mail to the following address: privacidad@zebrabox.es

Right of complaint: You have the right to lodge a complaint with a competent supervisory authority, e.g. about the way in which your personal data is processed.

Version: 1.0 | Hash: 532b4f94881845fbd0c1baae2b6191f577b2e767bd5a3b73cc502a94cfc293a9