PRIVACY POLICY
1. Data controller
Controller: FÁBRICA DE COLCHONES O SANGAL, S.L.U. · Tax ID (NIF): B70321104 · Address: Polígono de O Sangal, Edificio B (Fábrica), s/n, Cerdedo-Cotobade, Pontevedra, Spain · Email for privacy matters: hola@kamaboo.com.
2. Data processed and purposes
Depending on the relationship with KAMABOO, the following data may be processed: identification and contact data, delivery and billing data, order information, payments, customer service communications, information needed for returns or guarantees, and technical data arising from use of the website.
The data will be processed in order to: handle enquiries and requests for information; manage purchases, payments, manufacturing or preparation, delivery, returns, withdrawals, guarantees and after-sales service; comply with accounting, tax, consumer protection and other legal obligations; prevent fraud, abuse and security incidents where there is a sufficient legal basis; and send commercial communications in the cases permitted by law.
3. Legal bases
The management of purchases, orders, deliveries, returns and guarantees is based on the performance of the contract or on pre-contractual measures requested by the data subject.
Compliance with tax, accounting, consumer protection, product safety or other regulatory obligations is based on compliance with legal obligations.
Electronic commercial communications will be sent where there is consent or, within the scope permitted by article 21 of Spanish Law 34/2002, where there is a prior contractual relationship, the data were obtained lawfully and the communication relates to KAMABOO's own products or services similar to those purchased, always offering a simple and free means of objecting.
Where processing is based on legitimate interest, KAMABOO will carry out the corresponding balancing test and will respect the right to object where applicable.
4. Recipients and service providers
Data may be disclosed or made available to third parties where necessary to provide the service or comply with legal obligations. These may include transport and logistics companies, payment providers, financial institutions, technology and hosting services, web support, advisers, communications providers, public authorities and other processors subject to the required contractual safeguards.
KAMABOO does not disclose personal data to third parties for their own purposes unless there is a specific legal basis and the data subject has been informed in advance.
5. International transfers
If any provider processes data outside the European Economic Area, the safeguards required by the General Data Protection Regulation will apply, such as an adequacy decision, standard contractual clauses or other valid mechanisms. The specific information will depend on the providers actually used and may be requested from KAMABOO.
6. Retention
Data will be kept for as long as necessary to manage the relationship with the user or customer and, thereafter, for the limitation and retention periods required to meet legal, tax, accounting or contractual obligations and liabilities.
Data used for commercial communications based on consent will be kept until consent is withdrawn. Where the communication is based on a prior contractual relationship, the data will be kept for as long as that basis remains applicable and the person does not object, without prejudice to the minimum data that must be kept to evidence the unsubscription or objection.
7. Rights
Data subjects may request access, rectification, erasure, objection, restriction of processing and, where applicable, portability, and may withdraw their consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to hola@kamaboo.com, with sufficient detail to identify the request. KAMABOO may request additional information only where necessary to verify the identity of the person making the request.
If you consider that the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).
8. Minors
The online shop is not specifically aimed at minors. Where processing is based on the consent of a person under fourteen years of age, the involvement of the holder of parental authority or guardianship will be required under the terms provided by law.
9. Automated decision-making
KAMABOO will not take decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect them, unless specific information is provided and there is a valid legal basis.
10. Security and updates
KAMABOO will apply technical and organisational measures appropriate to the risk to protect data against unauthorised access, loss, alteration or improper disclosure. This policy may be updated when the regulations, the processing operations or the services used change.
COOKIE POLICY
1. What cookies and similar technologies are
Cookies and similar technologies are files or identifiers that may be stored on or read from the user's device. Among other functions, they make it possible to maintain a session, keep the shopping basket, remember preferences, measure use of the site or, where consent has been given, personalise content or advertising. These rules also apply to equivalent technologies for storing, retrieving or identifying the device where they are subject to article 22.2 of Spanish Law 34/2002.
2. Categories used
Technical or necessary cookies: enable essential functions such as security, the shopping basket, session, checkout process and consent management. They do not require consent where they are strictly necessary to transmit a communication or provide a service expressly requested.
Preference cookies: remember the user's choices. They will require consent where they cannot be considered strictly necessary for a requested functionality.
Analytics or measurement cookies: provide statistics on use of the site. They will only be installed or used without consent where the requirements of a legal exception are actually met; in all other cases they will require prior consent.
Advertising or personalisation cookies: make it possible to measure campaigns, create profiles or tailor advertising, and will require prior consent where they are not strictly necessary.
3. Consent: accept, reject and configure
Before installing or using non-necessary cookies, the website will display a consent management system that allows cookies to be accepted, rejected or configured.
The option to reject cookies will be offered at the same time, at the same level and with the same visibility as the option to accept them. The design must not misleadingly or disproportionately encourage acceptance.
The panel will allow non-necessary cookies to be configured granularly, at least by purpose. The options will not be pre-ticked in favour of consent.
Mere inactivity, continuing to browse or closing the notice without a valid affirmative action will not be deemed consent for non-necessary cookies.
4. Withdrawal and renewal of consent
Users may subsequently change or withdraw their consent through a permanent “Cookie settings” link or equivalent function accessible from the website. Withdrawing consent will be as easy as giving it.
If the purposes or third parties using the cookies change, the information will be updated and a new decision will be requested where appropriate.
As good practice in line with the AEPD Guide, consent should not remain valid for more than 24 months, without prejudice to requesting a new decision earlier if relevant circumstances change.
5. Actual and up-to-date list of cookies
The website will keep an up-to-date list of the cookies and similar technologies it actually uses, indicating at least the name or identifier, provider or owner, purpose, duration and, where applicable, information on third parties or international transfers.
This list may be displayed within the “Cookie settings” panel, provided that it is directly and permanently accessible and forms part of the information in this Policy. It must match the site's actual technical configuration at all times.
The addition of new analytics, marketing, chat, video, map, social media or other third-party services must be reviewed before activation in order to determine which technologies they use and to update the information and consent where appropriate.
6. Third-party cookies
Where certain functions are provided by third parties, the identity of those providers and the cookies actually used must appear in the updated panel or list. Non-necessary third-party cookies will remain blocked until valid consent has been given, where such consent is required.
7. Management from the browser
In addition to the consent panel, users can delete or block cookies from their browser settings. Disabling strictly necessary cookies may affect the operation of functions such as the shopping basket, the session or the checkout process.
8. Updates
This Cookie Policy may be amended when the technologies used, the providers or the regulations change. The published information must be kept in line with the actual configuration of the site and of the consent manager.
APPLICABLE LEGISLATION AND GUIDANCE IN FORCE
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).
- Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights, consolidated text in force (latest update published in the Spanish Official State Gazette, BOE: 27/12/2025).
- Law 34/2002 of 11 July on information society services and electronic commerce, in particular articles 21 and 22, consolidated text in force.
- Guide on the use of cookies of the Spanish Data Protection Agency, version updated in May 2024.
KAMABOO · FÁBRICA DE COLCHONES O SANGAL, S.L.U. · Tax ID (NIF) B70321104