Privacy Policy

The data controller responsible for processing your personal data is: hale (operated by Nicolas Tous Amatller) Palma de Mallorca, Illes Balears, Spain Email: help@halepeps.com For any questions about this Privacy Policy or how we process your data, you may contact us at help@halepeps.com.

We collect the following categories of personal data: WHEN YOU PLACE AN ORDER: - Name and surname - Shipping address (street, city, postal code, country) - Email address - Phone number (if provided) - Order details (products purchased, quantities, total amount) - Payment information (bank IBAN for SEPA or crypto wallet identifier for cryptocurrency payments; we do NOT store full credit card data) - IP address and browser metadata at time of order WHEN YOU CONTACT US: - Email address - Content of your message - Any additional information you choose to provide WHEN YOU SUBSCRIBE TO OUR NEWSLETTER (FUTURE): - Email address - Subscription preferences (opt-in) WE DO NOT COLLECT: - Special categories of personal data (health data, biometric data, political opinions, etc.) - Personal data of minors under 18 years of age - Data we do not need for the purposes set forth in this Policy

We process your personal data for the following purposes: A) ORDER FULFILLMENT Purpose: To process, ship, and deliver your orders. Legal basis: Performance of a contract (Art. 6(1)(b) GDPR). Data retention: 6 years from the date of last transaction, as required by Spanish commercial and tax law. B) CUSTOMER COMMUNICATION Purpose: To respond to inquiries, provide order updates, and offer customer support. Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) or legitimate interest (Art. 6(1)(f) GDPR). Data retention: 3 years from last communication. C) LEGAL COMPLIANCE Purpose: To comply with tax, accounting, and other legal obligations. Legal basis: Legal obligation (Art. 6(1)(c) GDPR). Data retention: 6 years (Spanish tax law). D) FRAUD PREVENTION AND SECURITY Purpose: To detect and prevent fraudulent transactions and protect the security of our website. Legal basis: Legitimate interest (Art. 6(1)(f) GDPR). Data retention: 2 years from order date. E) NEWSLETTER (FUTURE, OPT-IN ONLY) Purpose: To send marketing communications about our products and research-relevant content. Legal basis: Consent (Art. 6(1)(a) GDPR). Data retention: Until you withdraw consent or for 3 years from last interaction. We will never process your data for purposes not listed here without your explicit consent.

We share your personal data with the following processors, who process data on our behalf under written data processing agreements in accordance with Art. 28 GDPR: SUPABASE INC. Purpose: Database hosting (orders, customer data) Location: EU region (Frankfurt, Germany) Privacy Policy: https://supabase.com/privacy RESEND, INC. Purpose: Transactional emails (order confirmations, shipping updates) Location: USA (transfers under EU-US Data Privacy Framework) Privacy Policy: https://resend.com/legal/privacy-policy NOWPAYMENTS SP. Z O.O. Purpose: Cryptocurrency payment processing Location: European Economic Area (Estonia) Privacy Policy: https://nowpayments.io/privacy-policy LOVABLE / VERCEL / CLOUDFLARE Purpose: Website hosting and infrastructure Location: EU and global (transfers under SCCs and DPF where applicable) In addition, your data may be shared with: - SHIPPING CARRIERS (Correos, DHL, GLS, UPS) for order delivery - BANKING INSTITUTIONS for SEPA payment processing (your IBAN to CaixaBank and through SEPA network) - TAX AND ACCOUNTING AUTHORITIES (only if legally required) We do not sell, rent, or trade your personal data to any third party for marketing purposes.

Some of our processors are located outside the European Economic Area (EEA), specifically in the United States (Resend) and potentially in other countries via Cloudflare global infrastructure. When personal data is transferred outside the EEA, we ensure appropriate safeguards in accordance with GDPR: - EU-US Data Privacy Framework certifications where applicable - Standard Contractual Clauses (SCCs) approved by the European Commission - Other safeguards as required by Chapter V of the GDPR You may request more information about the safeguards applied by contacting us at help@halepeps.com.

Under the GDPR and Spanish data protection law, you have the following rights regarding your personal data: A) RIGHT OF ACCESS (Art. 15 GDPR) You may request a copy of the personal data we hold about you. B) RIGHT TO RECTIFICATION (Art. 16 GDPR) You may request correction of inaccurate or incomplete data. C) RIGHT TO ERASURE (Art. 17 GDPR) You may request deletion of your personal data, subject to legal retention obligations (e.g., we must retain order data for 6 years for tax purposes). D) RIGHT TO RESTRICT PROCESSING (Art. 18 GDPR) You may request restriction of processing in specific circumstances. E) RIGHT TO DATA PORTABILITY (Art. 20 GDPR) You may request your data in a structured, commonly used, machine-readable format. F) RIGHT TO OBJECT (Art. 21 GDPR) You may object to processing based on legitimate interest or for direct marketing purposes. G) RIGHT TO WITHDRAW CONSENT (Art. 7(3) GDPR) You may withdraw consent for newsletter subscription or any other consent-based processing at any time. H) RIGHT TO LODGE A COMPLAINT You have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): - Website: https://www.aepd.es - Address: C/ Jorge Juan, 6, 28001 Madrid, Spain TO EXERCISE YOUR RIGHTS: Send an email to help@halepeps.com with your request. We will respond within one month of receipt, in accordance with Art. 12(3) GDPR. We may require you to verify your identity before processing your request.

Our website uses cookies and similar technologies to function properly and improve user experience. ESSENTIAL COOKIES (always enabled): - Session cookies: maintain your session during browsing - Language preference cookie: remembers your selected language - Shopping cart cookie: maintains your cart contents - Authentication cookies (if applicable): for admin access ANALYTICS COOKIES (not currently used): We currently do not use any analytics cookies (Google Analytics, PostHog, or similar). If we add analytics in the future, we will update this Policy and request your consent. MARKETING COOKIES (not currently used): We currently do not use any marketing or advertising cookies. You can manage your cookie preferences at any time through the Cookie Preferences modal accessible from the footer.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including: - Encryption of data in transit (HTTPS/TLS) - Encryption of sensitive data at rest where applicable - Access controls limiting personnel access to personal data - Secure database hosting with Supabase (EU region) - Regular security reviews of our infrastructure and processors Despite our security measures, no method of transmission or storage is 100% secure. In the event of a personal data breach, we will notify affected users and the relevant supervisory authority in accordance with Art. 33 and 34 GDPR.

Our website and services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at help@halepeps.com and we will delete such data promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. The 'Last updated' date at the top of this Policy indicates when the latest revision was made. If we make material changes, we will notify you via email (if we have your email address) or through a notice on our website at least 30 days before the changes take effect. Your continued use of the website after the effective date of changes constitutes acceptance of the revised Privacy Policy.

For any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact: hale (operated by Nicolas Tous Amatller) Palma de Mallorca, Illes Balears, Spain Email: help@halepeps.com We will respond to all inquiries within 30 days.