Securing your Data

The communication between your browser and our website uses a secure encrypted connection wherever your personal data is involved.
We have put in place physical, electronic, and managerial security procedures in the storage and disclosure of your personal data to protect it against accidental loss, destruction or damage. Nevertheless, any data transmission over the internet or by any other means can never be fully secure, such is the character of the internet, and provision of personal data by you to us is at your own risk. We take all reasonable measures to protect your personal data by putting appropriate technical and operational security measures in place.
When we disclose your personal data to trusted third parties (for the purposes set out in this Privacy Notice), we require all third parties to have appropriate technical and operational security measures in place to protect your personal data, and we work with them to ensure that your data privacy rights are respected. Where your personal data is shared with a third party, it must only be used for the purposes for which it was supplied.
In the unfortunate event of a personal data breach, we will notify you and any applicable data protection authority when we are legally required to do so.

Retaining your Data

We will not keep your personal data for longer than is necessary and when we no longer need to keep it, we will securely destroy, delete or anonymise it in line with our Data Retention policy.
Having obtained your consent (or other legal basis) to contact you, we will retain your personal data for marketing and analysis purposes until you withdraw your consent or unsubscribe. If you choose to withdraw your consent or unsubscribe from marketing, we will delete your personal data from our systems, unless we have another legal basis to retain it, which may include performance of our contract with you or to maintain your contact details on an ‘unsubscribed list’ to ensure we do not send you further communications.
We may need to retain your personal data to satisfy our legal obligations, to deal with complaints and queries, in order to resolve, litigate or defend a dispute and to prevent fraud and abuse.

Data Transfers

For users from the European Economic Area (“EEA”), your personal data may be processed outside the EEA by staff who work for us or by one of our Data Sub-processors. When we transfer your information outside of the European Economic Area, we ensure it benefits from an adequate level of data protection by:

• Relying on an adequacy decisions by the European Commission made under Article 45 of the GDPR, finding that the third country to which the information is being transferred offers an adequate level of data protection; or
• If there is no adequacy decision, using standard contractual clauses approved or permitted under Article 46 of the GDPR.
  We will take all steps necessary to ensure that your data is treated securely and in accordance with this privacy notice. Please contact us if you want further information on the countries to which we may transfer personal data and the specific mechanism used by us when transferring your personal data outside the EEA – contact@naturaluz-es.com 

Your Rights & Our Commitment to You

You have rights under data privacy laws and Affirm Health is committed to you being able to freely exercise your Rights. Send us an email at contact@naturaluz-es.com to exercise your rights. You are not required to pay any charge for exercising your rights.

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) your rights include, with certain legal restrictions, the below:

Right of Access or Rectification: you have the right to ask us for copies of the personal data we hold about you. You are also entitled to have your personal data corrected or updated if it is inaccurate.

Right to Withdraw Consent: in cases where we are relying on your consent for the processing of your personal data, you have the right to withdraw your consent at any time. In respect of the e-marketing we conduct, an unsubscribe (withdraw consent) option is included with every e-marketing communication we send.

EEA and UK General Data Protection Regulation (EU GDPR and UK GDPR)
Users located in the UK or European Economic Area (EEA) have the above rights as well as the below under the EU GDPR and UK GDPR.

Right of erasure: you have the right of access to personal data erased if we do not have a legitimate reason for retaining your data. 

Right to data portability: you have the right to obtain a digital copy of your personal data, request the transfer of your personal data to another company or request to move your data from one IT system to another in a safe and secure way. This right only applies to personal data you provide to us, and we process it with your consent or in order to fulfil our contract with you by automated means. It also only applies to the extent that it does not affect the rights and freedoms of others.

Right to restriction of processing: you have the right to restrict the processing of your personal data where you are contesting the accuracy of that information, you have objected to processing (as described below), or where the processing is unlawful. Where processing is restricted, we may need to retain sufficient information about you to ensure that the restriction is respected in future.

Right to object to processing: you have the right to object to the processing of your personal information in certain circumstances such as where your personal data is being processed based on our legitimate interests or the legitimate interests of a third party.

To object to automated decision-making including profiling: you have the right not to be the subject of any automated decision-making or profiling by us.

To complain to the relevant supervisory authority: should you have any concerns or complaints regarding the way in which we process your data, you also have the right to make a complaint to the relevant European Supervisory Authority. We would, however, appreciate the chance to deal with your concerns before you approach a Supervisory Authority, so please do contact us in the first instance – contact@naturaluz-es.com. The contact details of European Supervisory Authorities can be found here: members_en

EEA and UK General Data Protection Regulation (EU GDPR and UK GDPR)
Your rights include, under certain circumstances, the right to:

Be informed: you have the right to be informed if and how your personal data is being processed.

Access, rectification, or erasure: you have the right of access to personal data we hold about you in our records. You are also entitled to have your personal data corrected if it is inaccurate, or to have it erased if we do not have a legitimate reason for retaining your data. 

To request data portability: you have the right to obtain a digital copy of your personal data, request the transfer of your personal data to another company or request to move your data from one IT system to another in a safe and secure way. This right only applies to personal data you provide to us, and we process it with your consent or in order to fulfil our contract with you by automated means. It also only applies to the extent that it does not affect the rights and freedoms of others.

To request restriction of processing: you have the right to restrict the processing of your personal data where you are contesting the accuracy of that information, you have objected to processing (as described below), or where the processing is unlawful. Where processing is restricted, we may need to retain sufficient information about you to ensure that the restriction is respected in future.

To object to processing: you have the right to object to the processing of your personal information in certain circumstances such as where your personal data is being processed based on our legitimate interests or the legitimate interests of a third party.

To object to automated decision-making including profiling: you have the right not to be the subject of any automated decision-making or profiling by us.

To withdraw consent: in cases where we are relying on your consent for the processing of your personal data, you have the right to withdraw your consent at any time. In respect of the e-marketing we conduct, an unsubscribe option is included with every e-marketing communication we send.

To complain to the relevant supervisory authority: should you have any concerns or complaints regarding the way in which we process your data, you also have the right to make a complaint to the relevant European Supervisory Authority. We would, however, appreciate the chance to deal with your concerns before you approach a Supervisory Authority, so please do contact us in the first instance – contact@naturaluz-es.com. The contact details of European Supervisory Authorities can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en 

The California Consumer Privacy Act (CCPA)
In this section we use the terms “personal information”, “sensitive personal information”, “sale” and “sharing” as defined in the California Consumer Privacy Act (“CCPA”).

“Personal information” is defined as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

“Sensitive Personal Information (SPI)” is personal information that reveals a consumer’s:

• Social Security, driver’s license, state identification card, or passport number
• Account login, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account
• Precise geolocation
• Racial or ethnic origin, religious or philosophical beliefs, or union membership
• Mail, email, and text message content, unless the Business is the intended recipient of the communication
• Genetic data.

“Sale” is defined broadly as the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by us to another business or a third party in exchange for monetary or other valuable consideration.

“Sharing” is defined as sharing, “renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating … a consumer’s personal information by the business to a third party for cross‐context behavioural advertising, whether or not for monetary or other valuable consideration”. This also includes “transactions between a business and a third party for cross-context behavioural advertising for the benefit of a business in which no money is exchanged.” Cross-context behavioural advertising (CCBA) is defined as targeting advertising at a consumer based on the personal information collected from their activity across businesses, websites, applications, or services with which the consumer did not intentionally interact.

The California Consumer Privacy Act (“CCPA”) provides consumers with specific rights regarding their personal data.

Right of access: You have the right to request that we disclose certain information to you about our collection and use of your personal data over the past 12 months. This information will include the categories and sources of the personal information that we collect about you, the purposes for which we use your information and with whom such information is shared. If your personal information has been sold or disclosed for business purposes over the past 12 months, you have the right to know the categories of personal information that were sold or disclosed and to which category of recipient they were sold or disclosed to. To exercise this right, you can contact us at contact@naturaluz-es.com.

Right to opt out of the sale or sharing of personal information: If we sell or share personal information, you have the right to opt out of the sale or sharing of your personal information. This means that whenever you request us to stop selling or sharing your data, we will abide by your request. Such requests can be made freely, at any time, by clicking the “Do not sell or share my data” link in cookie banner on our website.

Right to correct: you have the right to request that we correct any inaccurate personal information we have about you.

Right to limit the use and disclosure of Sensitive Personal Information (SPI): You have the right to limit the use of your sensitive personal information. You can request that we only use your SPI as necessary to provide the goods or services (as reasonably expected by an average consumer who requests such goods and services) and as authorised by further regulations.

Right to delete: You have the right to request the deletion of your personal information, subject to certain exceptions. Once we receive and confirm your request, we will delete (and direct our Service Providers to delete) your personal information from our records, unless an exception applies. To exercise this right, you can contact us at contact@naturaluz-es.com.

Right not to be discriminated against: A business cannot discriminate against you for exercising a CCPA right. if you choose to exercise your applicable CCPA rights, we will not charge you different prices or provide you a different quality of services.

If you would like to know more, or exercise any of your rights you can also contact us at contact@naturaluz-es.com.

Colorado Privacy Act (CPA)
Consumers residing in the state of Colorado, USA, have the below rights:

Right of access: Consumers have the right to confirm if a company processes their personal data and to access their personal data.

Right to correction: Consumers have the right to correct inaccuracies in their personal data.

Right to delete: Consumers have the right to delete their personal data.

Right to data portability. Consumers have the right to obtain their personal data in a portable and, to the extent technically feasible, readily usable format that allows them to easily transmit the data to another entity.

Right to opt out: Consumers have the right to opt out of the processing of their personal data for the purposes of:

• targeted advertising;
• the sale of personal data, or
• profiling where the profiling has a legal or similarly significant effect on the consumer.

If you have enabled a Universal Opt-Out Mechanism on your browser like Global Privacy Control (GPC) we will respect your choice. See more information about this here on the Attorney General’s website: https://coag.gov/uoom/.

Right to appeal: Consumers have the right to appeal a business’ denial to take action within a reasonable time period. Under the CPA, we must respond to your request within 45 days of receipt and may subsequently extend that deadline by an additional 45 days when reasonably necessary. When we elect to extend that deadline, we will notify you within the initial 45-day response period. If we fail to act on your request in the timelines outlined above, you can appeal by contacting us at contact@naturaluz-es.com. If an appeal is denied, you can contact the attorney general if you have concerns about the result of the appeal.

How to exercise my Rights:

You can exercise any of your rights above by contacting us at contact@naturaluz-es.com or as described above.

Changes to this privacy notice

We may change this policy from time to time, to reflect how we are processing your data. If we make significant changes, we will make that clear on our website or by some other means of contact such as email, so that you are able to review the changes before you continue to use our services.

How to contact us

We welcome feedback and are happy to answer any questions you may have about your data.

You can contact us at:
Email: contact@naturaluz-es.com