1. USER INFORMATION

Who is responsible for processing your personal data?

Enchanty Park, S.L. is the CONTROLLER of the USER's personal data and informs you
that this data will be processed in accordance with the provisions of Regulation (EU)
2016/679, the General Data Protection Regulation (GDPR) of 27 April,
and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and
Guarantee of Digital Rights (LOPDGDD).

Why do we process your personal data?

To maintain a business relationship with the user.
The processing operations include:
• Order management and management of the business relationship with
the user, from the order request to delivery at the designated address,
invoicing, returns management, and after-sales service.

• Sending commercial and advertising communications via email, fax, SMS, MMS,
social media, or any other electronic or physical means,
present or future, that allows for commercial communications.

These communications will be sent by the CONTROLLER and will relate to its
products and services, or those of its partners or suppliers with whom
it has reached a promotional agreement.

In this case, third parties will never have access to personal data.
• Conducting market research and statistical analysis.

• Processing orders, requests, responding to inquiries, or any other type of request made
by the USER through any of the contact methods available on the CONTROLLER's website.

• Sending the online newsletter with news, offers, and promotions related to our business.

Data Categories

We collect the minimum identifying data necessary to manage our
relationship with the USER and according to its purpose.

Payment data is not collected directly; payments are made
through secure payment methods.

Why can we process your personal data?

Because the processing is legitimized by Article 6 of the GDPR as follows:

• For the execution of the contractual relationship with the USER
if they purchase products from the store.

• With the USER's consent: sending commercial communications and the newsletter.

• For the legitimate interest of the CONTROLLER: conducting market research, statistical
analysis, etc., and processing orders, requests, etc., at the USER's request.

• For compliance with the legal obligations to which the CONTROLLER
is subject due to its activity.

How long will we keep your personal data?

Your personal data will be kept for no longer than necessary to
fulfill the purpose of the processing or as required by law.

When it is no longer needed, it will be deleted using appropriate security measures
to ensure its anonymization or complete destruction.

Who do we share your personal data with?

We do not share your personal data with third parties except, if necessary
for the development and execution of the purposes of the processing,
with our service providers related to communications, transportation, and infrastructure.

The CONTROLLER has signed confidentiality and data processing agreements with
these providers, as required by current privacy regulations.

What are your rights?

The rights of the USER are:
• Right to withdraw consent at any time.

• Right to access, rectify, port, and erase your data, and to restrict or
object to its processing.

• Right to lodge a complaint with the supervisory authority (www.aepd.es)
if you believe that the processing does not comply with current regulations.

Contact details to exercise your rights:
Enchanty Park, S.L., C/ Sangenjo, 15, Madrid 28034.

Email: info@enchantypark.com.

2. MANDATORY OR OPTIONAL NATURE OF
THE INFORMATION PROVIDED BY THE USER

By checking the corresponding boxes and entering data in the fields marked with an
asterisk (*) on the contact form or download forms, USERS expressly and freely and
unequivocally accept that their data is necessary for the provider to process their request.

Providing data in the remaining fields is voluntary.
The USER guarantees that the personal data provided to the CONTROLLER
is accurate and is responsible for communicating any changes to it.

The CONTROLLER informs that all data requested through the website is mandatory, as it
is necessary for providing the USER with optimal service. If all the data is not provided, the
information and services provided cannot be guaranteed to be fully tailored to the USER's needs.

3. SECURITY MEASURES

In accordance with current regulations on personal data protection, the CONTROLLER
complies with all provisions of the GDPR and the Spanish Data Protection Act (LOPDGDD)
for the processing of personal data under its responsibility, and specifically with the
principles described in Article 5 of the GDPR, according to which data is processed lawfully,
fairly, and transparently in relation to the data subject, and is adequate, relevant, and
limited to what is necessary in relation to the purposes for which it is processed.

The CONTROLLER guarantees that it has implemented appropriate technical and
organizational policies to apply the security measures established by the GDPR and the
LOPDGDD in order to protect the rights and freedoms of USERS and has provided them
with the necessary information to exercise those rights.

For more information on privacy guarantees, you can contact the CONTROLLER through
Enchanty Park, S.L. C/ Sangenjo, 15, Madrid 28034.
E-mail: info@enchantypark.com.

Updated November 2025