Privacy policy

In compliance with current legislation, Karnelli (hereinafter referred to as the “Website”) is committed to adopting the technical and organizational measures necessary to ensure an appropriate level of security proportional to the risks associated with the personal data collected.

Laws Incorporated in This Privacy Policy

This privacy policy is adapted to current Spanish and European regulations on personal data protection online. Specifically, it complies with the following laws:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons regarding the processing of personal data and the free movement of such data (GDPR).
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).


• Royal Decree 1720/2007, of 21 December, which approves the Regulation for the implementation of Organic Law 15/1999, of 13 December, on the Protection of Personal Data (RDLOPD).


• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).

Data Controller Identity

The entity responsible for processing personal data collected on this website is Karnelli, with Tax ID (NIF): [XXXXXXXXXXXXXXX] (hereinafter referred to as the "Data Controller").

• Address: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX


• Contact Telephone: XXXXXXXXXXXXXXXXXXXXXX


• Email: karnellistore@gmail.com

Registration of Personal Data

In compliance with GDPR and LOPD-GDD, any personal data collected via forms on this website will be incorporated and processed in a file managed by Karnelli. This data will be used to facilitate, expedite, and fulfill commitments between the Website and the User or to respond to queries and requests.

As required by GDPR, a record of processing activities is maintained, specifying the purposes, categories of data, and other details related to the data processing.

Principles Governing Data Processing

The processing of personal data will be governed by the following principles established in Article 5 of GDPR and Articles 4 and following of Organic Law 3/2018:

• Lawfulness, fairness, and transparency: User consent will always be requested after clear and transparent information about the processing purposes is provided.


• Purpose limitation: Data will be collected for specified, legitimate purposes only.


• Data minimization: Only data strictly necessary for the intended purposes will be collected.


• Accuracy: Personal data must be accurate and up-to-date.


• Storage limitation: Data will only be retained for as long as necessary for the intended purposes.


• Integrity and confidentiality: Data will be processed securely and confidentially.


• Accountability: The Data Controller will ensure compliance with these principles.

Categories of Personal Data

The personal data processed on this website will only include identifying information. Special categories of personal data, as defined in Article 9 of GDPR, will not be processed.

Legal Basis for Data Processing

The legal basis for processing personal data is the explicit consent of the User. Karnelli commits to obtaining verifiable consent from Users before processing their data.

Users may withdraw their consent at any time, and this will not affect their use of the Website.

When data is requested via forms for inquiries or other purposes, Users will be informed if providing such information is mandatory for fulfilling the request.

Purposes of Data Processing

Personal data is collected to facilitate, expedite, and fulfill commitments between the Website and the User or to respond to inquiries or requests.

Additionally, data may be used for operational, statistical, and marketing purposes, including customizing user experiences and improving the Website’s content, functionality, and navigation.

At the time of data collection, Users will be informed of the specific purposes for which their data is being processed.

Retention Periods

Personal data will only be retained for the time necessary to fulfill the intended purposes. Typically, data will be retained for a maximum of 18 months or until the User requests its deletion.

Recipients of Personal Data

Personal data will not be shared with third parties. If this changes, Users will be informed at the time of data collection.

Data Processing for Minors

In compliance with GDPR and Organic Law 3/2018, only Users aged 14 or older may lawfully consent to the processing of their personal data. For Users under 14, consent from a parent or guardian will be required.

Security of Personal Data

Karnelli implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or destruction. This includes SSL (Secure Socket Layer) encryption for secure data transmission.

In case of a personal data breach that poses a significant risk to individuals' rights and freedoms, Users will be promptly notified as required by GDPR.

Personal data will be treated confidentially, and employees, collaborators, or any individuals who access the data will be legally or contractually obligated to maintain confidentiality.

User Rights

Users have the following rights concerning their personal data under GDPR and Organic Law 3/2018:

• Right of access: To confirm whether personal data is being processed and obtain information about the processing.


• Right to rectification: To correct inaccurate or incomplete data.


• Right to erasure: To request the deletion of data when it is no longer necessary or when consent is withdrawn.


• Right to restrict processing: To request limitations on data processing under certain circumstances.


• Right to data portability: To receive their data in a structured, commonly used, machine-readable format or have it transferred to another controller.


• Right to object: To object to data processing, including for marketing purposes.


• Right not to be subject to automated decision-making: To request human intervention for decisions based on automated processing, including profiling.

Requests to exercise these rights must include:

• User’s name, surname, and identification (e.g., copy of ID).


• Clear specification of the request or information sought.


• Address for notifications.


• Date and signature of the applicant.

Such requests can be sent to:

• Email: karnellistore@gmail.com

Third-Party Links

The Website may include links to third-party websites. Karnelli is not responsible for these websites' privacy policies or practices.

Complaints to the Supervisory Authority

Users may file complaints with the relevant supervisory authority if they believe their data protection rights have been violated. In Spain, the relevant authority is the Spanish Data Protection Agency (AEPD) (https://www.aepd.es/).