PRIVACY POLICY

Last updated: July 7, 2026

1. INTRODUCTION AND DATA CONTROLLER​‌​‍

Welcome to the Privacy Policy of Gilles Smart Home Playa. This document outlines how we collect, use, and protect your personal data when you visit our website, gilles-smarthomeplaya.com. We are committed to safeguarding your privacy and ensuring that your personal data is protected in compliance with the General Data Protection Regulation (GDPR) and other applicable laws.

Data Controller: The data controller responsible for processing your personal data is Gilles Smart Home Playa, a business established in Spain. Our contact details are as follows:

• Company Name: Gilles Smart Home Playa
• Address: Calle 26 entre 10 y 20 Lote 1. 102 Kaan, Col. Centro, (MX) 77710 Playa del Carmen
• Email: contact@gilles-smarthomeplaya.com
• Phone: +52 984 138 6009

The data controller is responsible for determining the purposes and means of processing personal data collected through our website.

This Privacy Policy was last updated on July 7, 2026, and is designed to provide you with clear and comprehensive information about how we handle your personal data. We adhere to the principles of transparency, fairness, and accountability as outlined in the GDPR.

We collect various types of personal data, including personal identifiers, contact information, payment details, and navigation data. The processing of this data is necessary for us to provide our services effectively and to enhance your experience on our website.

For any inquiries or concerns regarding your personal data or this Privacy Policy, please contact our Data Protection Officer at contact@gilles-smarthomeplaya.com.

By using our website, you consent to the collection and use of your personal data as described in this Privacy Policy. We encourage you to read this document carefully to understand your rights and our obligations under the GDPR and other relevant regulations.

2. DEFINITIONS​‌​‍

In this Privacy Policy, the following terms shall have the meanings set forth below:

2.1 Personal Data

Personal Data refers to any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

2.2 Processing

Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.3 Data Controller

Data Controller refers to the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. For the purposes of this Privacy Policy, Gilles Smart Home Playa is the Data Controller.

2.4 Data Processor

Data Processor means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller.

2.5 Consent

Consent of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her.

2.6 Cookies

Cookies are small text files that are placed on your device by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

2.7 GDPR

GDPR refers to the General Data Protection Regulation (EU) 2016/679, which is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. It also addresses the transfer of Personal Data outside the EU and EEA areas.

2.8 Third Party

Third Party means a natural or legal person, public authority, agency, or body other than the data subject, Data Controller, Data Processor, and persons who, under the direct authority of the Data Controller or Data Processor, are authorized to process Personal Data.

2.9 Supervisory Authority

Supervisory Authority refers to an independent public authority which is established by a Member State pursuant to Article 51 of the GDPR.

These definitions are intended to provide clarity and understanding of the terms used within this Privacy Policy. For further information or clarification, please contact us at contact@gilles-smarthomeplaya.com.

3. DATA COLLECTED​‌​‍

At Gilles Smart Home Playa, we are committed to protecting the privacy of our users. This section outlines the types of data we collect, ensuring compliance with the General Data Protection Regulation (GDPR) and other applicable laws.

3.1 Types of Data Collected

We collect various types of personal data to provide and improve our services. The categories of data collected include:

• Personal Identifiers: This includes information such as your name, date of birth, and other identifiers that can uniquely identify you.
• Contact Information: We collect your email address, phone number, and physical address to communicate with you and deliver our services.
• Payment Information: For processing transactions, we collect payment details, which may include credit card numbers or other financial data.
• Navigation Data: We gather information about your interactions with our website, such as IP addresses, browser type, and pages visited, to enhance user experience and for analytical purposes.

3.2 Methods of Data Collection

Data is collected through various methods, including:

• Direct Collection: Information you provide directly to us when you register, make a purchase, or contact us.
• Automated Technologies: Data collected automatically through cookies, pixels, and analytics tools when you interact with our website.

3.3 Legal Basis for Data Collection

The collection and processing of personal data are based on the following legal grounds as per Article 6 of the GDPR:

• Consent: When you have given explicit consent for specific purposes.
• Contractual Necessity: To fulfill our contractual obligations to you.
• Legal Obligation: To comply with legal requirements.
• Legitimate Interests: For purposes such as improving our services, provided these interests are not overridden by your rights.

3.4 Data Collection from Third Parties

In some cases, we may collect data from third-party sources, such as social media platforms or partners, in accordance with Article 14 of the GDPR. This data is used to enhance our services and ensure a personalized experience.

3.5 Data Minimization and Accuracy

We adhere to the principles of data minimization and accuracy, ensuring that the data collected is relevant, limited to what is necessary, and kept up-to-date.

By understanding the types of data we collect and the methods used, you can make informed decisions about your interactions with Gilles Smart Home Playa. For further details on how we use your data, please refer to the subsequent sections of this Privacy Policy.

4. PURPOSES OF COLLECTION​‌​‍

At Gilles Smart Home Playa, we collect and process personal data for specific purposes, ensuring compliance with the General Data Protection Regulation (GDPR) and other applicable laws. This section outlines the purposes for which we collect your data, providing transparency and clarity in accordance with Article 13 of the GDPR.

4.1 Service Provision

We collect personal data to provide and manage our services effectively. This includes processing orders, managing customer accounts, and delivering products or services as requested by our users. The data collected for these purposes is essential for fulfilling contractual obligations and ensuring customer satisfaction.

4.2 Communication

Your contact information, such as email addresses and phone numbers, is used to communicate with you regarding your inquiries, support requests, and updates about our services. This communication is crucial for maintaining a good customer relationship and ensuring you are informed about any changes or improvements to our services.

4.3 Payment Processing

We process payment information to facilitate transactions and ensure the secure handling of financial data. This includes verifying payment details, processing payments, and managing billing information. Our payment processing activities are conducted in compliance with relevant financial regulations to protect your financial data.

4.4 Website Improvement and Analytics

We use data collected through cookies and similar technologies to analyze user behavior on our website. This analysis helps us understand how users interact with our site, allowing us to improve user experience and optimize our services. We utilize tools like Google Analytics for this purpose, ensuring that data is anonymized where possible to protect user privacy.

4.5 Marketing and Advertising

With your consent, we use personal data for marketing purposes, including sending promotional materials and personalized offers. We employ technologies such as Meta Pixel to track ad performance and retarget users with relevant advertisements. You have the right to withdraw your consent for marketing communications at any time.

4.6 Legal Compliance

We may process personal data to comply with legal obligations, such as tax regulations, and to respond to lawful requests from public authorities. This ensures that our operations are in line with applicable laws and regulations, safeguarding both our interests and those of our users.

4.7 Security and Fraud Prevention

To protect our users and our business, we process data to detect, prevent, and respond to fraud, security breaches, and other harmful activities. This includes monitoring activities on our website and implementing security measures to safeguard personal data.

Each of these purposes is aligned with a specific legal basis for processing under Article 6 of the GDPR, ensuring that all data collection activities are lawful, fair, and transparent. For more detailed information on the legal bases applicable to each purpose, please refer to Section 5 of this Privacy Policy.

5. LEGAL BASIS FOR PROCESSING​‌​‍

In accordance with Article 6 of the General Data Protection Regulation (GDPR), Gilles Smart Home Playa processes personal data based on several legal grounds. Each processing activity is justified by one or more of the following legal bases:

5.1 Consent

For certain processing activities, we rely on the explicit consent of the data subject. This includes the use of cookies for analytics and marketing purposes, where consent is obtained through a cookie banner upon visiting our website. Data subjects have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

5.2 Performance of a Contract

Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. This applies to the provision of services requested by our clients through our website.

5.3 Legal Obligation

We process personal data to comply with legal obligations to which Gilles Smart Home Playa is subject. This includes obligations under tax laws and other regulatory requirements applicable in Spain and the European Union.

5.4 Legitimate Interests

Processing is necessary for the purposes of the legitimate interests pursued by Gilles Smart Home Playa, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Our legitimate interests include improving our services, ensuring the security of our website, and conducting marketing activities.

5.5 Protection of Vital Interests

In rare cases, we may process personal data to protect the vital interests of the data subject or another natural person. This legal basis is typically applicable in emergency situations where the data subject is unable to give consent.

5.6 Public Interest or Official Authority

Processing may also be carried out when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Gilles Smart Home Playa, although this is not commonly applicable to our operations.

Each processing activity is carefully assessed to ensure compliance with the GDPR, and we maintain records of processing activities as required by Article 30 of the GDPR.

6. RECIPIENTS OF THE DATA​‌​‍

In accordance with Article 13 of the GDPR, Gilles Smart Home Playa is committed to ensuring that your personal data is only shared with third parties under strict conditions and for legitimate purposes. Below, we outline the categories of recipients with whom we may share your data:

6.1 Service Providers

We may share your personal data with third-party service providers who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep

7. RETENTION PERIOD​‌​‍

At Gilles Smart Home Playa, we are committed to retaining your personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Privacy Policy, and to comply with applicable legal, regulatory, or contractual obligations.

7.1 General Retention Period

The personal data we collect, including personal identifiers, contact information, payment details, and navigation data, will be retained for a period of three years from the date of your last interaction with our services. This retention period allows us to manage our business operations effectively, address any potential disputes, and comply with legal obligations.

7.2 Specific Retention Periods

• Personal Identifiers and Contact Information: Retained for three years to facilitate customer service and communication.
• Payment Information: Retained for the duration necessary to complete the transaction and for a period of three years thereafter for accounting and tax purposes.
• Navigation Data: Retained for three years to improve user experience and website functionality.

7.3 Legal and Regulatory Compliance

In certain circumstances, we may be required to retain your data for longer periods to comply with legal obligations, resolve disputes, or enforce our agreements. This includes compliance with tax, accounting, or other regulatory requirements.

7.4 Data Deletion

Upon the expiration of the retention period, or upon your request, we will securely delete or anonymize your personal data, ensuring that it cannot be reconstructed or read. If deletion is not possible (for example, because your personal data has been stored in backup archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

7.5 Data Subject Rights

As per Articles 15 to 22 of the GDPR, you have the right to request the erasure of your personal data under certain conditions. For more information on your rights, please refer to the "Data Subject Rights" section of this Privacy Policy.

By adhering to these retention practices, we ensure compliance with Article 30 of the GDPR regarding records of processing activities, and we maintain transparency with our users about how long their data is retained.

8. DATA SUBJECT RIGHTS​‌​‍

Under the General Data Protection Regulation (GDPR), individuals have specific rights regarding their personal data. Gilles Smart Home Playa is committed to ensuring that these rights are respected and that individuals can exercise them effectively. Below, we outline the rights you have as a data subject under the GDPR, specifically Articles 15 to 22.

8.1 Right of Access

You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and the following information, as per Article 15 of the GDPR:

• The purposes of the processing.
• The categories of personal data concerned.
• The recipients or categories of recipient to whom the personal data have been or will be disclosed.
• Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
• The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing.
• The right to lodge a complaint with a supervisory authority.
• Where the personal data are not collected from the data subject, any available information as to their source.
• The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

8.2 Right to Rectification

Under Article 16 of the GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

8.3 Right to Erasure ("Right to be Forgotten")

As per Article 17 of the GDPR, you have the right to obtain from us the erasure of personal data concerning you without undue delay, and we have the obligation to erase personal data without undue delay where one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• You withdraw consent on which the processing is based, and where there is no other legal ground for the processing.
• You object to the processing pursuant to Article 21(1), and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2).
• The personal data have been unlawfully processed.
• The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

8.4 Right to Restriction of Processing

Under Article 18 of the GDPR, you have the right to obtain from us restriction of processing where one of the following applies:

• You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead.
• We no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims.
• You have objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override yours.

8.5 Right to Data Portability

As per Article 20 of the GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where:

• The processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b).
• The processing is carried out by automated means.

8.6 Right to Object

Under Article 21 of the GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or 6(1)(f), including profiling based on those provisions. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.

8.7 Right Not to Be Subject to Automated Decision-Making

As per Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision:

• Is necessary for entering into, or performance of, a contract between you and us.
• Is authorized by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests.
• Is based on your explicit consent.

8.8 Exercising Your Rights

To exercise any of your rights, please contact us at contact@gilles-smarthomeplaya.com. We will respond to your request within one month of receipt. If necessary, this period may be extended by two further months, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request

9. DATA SECURITY​‌​‍

At Gilles Smart Home Playa, we are committed to ensuring the security of your personal data. We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal data on our website, gilles-smarthomeplaya.com.

9.1 Technical and Organizational Measures

We employ both technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption: We use encryption protocols such as SSL/TLS to protect data transmitted over the internet.
• Access Controls: Access to personal data is restricted to authorized personnel only, and is controlled through secure authentication mechanisms.
• Data Minimization: We ensure that only the necessary data is collected and processed, in accordance with the principles of data minimization.
• Regular Audits: We conduct regular security audits and assessments to identify and mitigate potential vulnerabilities.

9.2 Data Breach Notification

In the event of a data breach, we are committed to complying with our obligations under Articles 33 and 34 of the GDPR. We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If the breach is likely to result in a high risk, we will also inform the affected data subjects without undue delay.

9.3 Continuous Improvement

We continuously review and enhance our security practices to ensure the ongoing protection of your personal data. This includes staying informed about new security threats and implementing appropriate measures to counteract them.

9.4 User Responsibility

While we take significant steps to protect your data, it is important for users to also take precautions. We recommend that you:

• Use strong, unique passwords for your accounts.
• Regularly update your passwords and security settings.
• Be cautious of phishing attempts and suspicious communications.

By using our website, you acknowledge that you understand and agree to our data security practices as outlined in this section. If you have any questions or concerns about our data security measures, please contact us at contact@gilles-smarthomeplaya.com.

10. INTERNATIONAL TRANSFERS​‌​‍

Gilles Smart Home Playa is committed to ensuring that your personal data is protected when transferred outside the European Economic Area (EEA). In compliance with the General Data Protection Regulation (GDPR), we implement appropriate safeguards to protect your data during international transfers.

10.1 Transfers Outside the EEA

When we transfer personal data to countries outside the EEA, we ensure that the data is afforded an adequate level of protection. This is achieved through one of the following mechanisms:

• Adequacy Decisions: Transfers may occur to countries that the European Commission has deemed to provide an adequate level of data protection.
• Standard Contractual Clauses (SCCs): We may use SCCs approved by the European Commission, which provide contractual obligations to protect your data.
• Binding Corporate Rules (BCRs): For intra-group transfers, we may rely on BCRs that have been approved by the relevant data protection authorities.

10.2 Safeguards and Compliance

We ensure that all international data transfers comply with the GDPR and other applicable data protection laws. This includes:

• Data Processing Agreements: We enter into agreements with third-party service providers to ensure they comply with GDPR requirements.
• Risk Assessments: Prior to any transfer, we conduct thorough risk assessments to evaluate the potential impact on data subjects' rights and freedoms.
• Ongoing Monitoring: We continuously monitor the legal landscape and update our practices to maintain compliance with international data transfer regulations.

10.3 Data Subject Rights

In accordance with Articles 15 to 22 of the GDPR, you have the right to request information about the international transfers of your personal data. You may also request a copy of the safeguards in place for such transfers.

10.4 Contact Information

For further information regarding international data transfers or to exercise your rights, please contact our Data Protection Officer at contact@gilles-smarthomeplaya.com.

By adhering to these practices, Gilles Smart Home Playa ensures that your personal data is handled with the utmost care and in compliance with international data protection standards.

11. COOKIES AND SIMILAR TECHNOLOGIES​‌​‍

11.1 Introduction

Gilles Smart Home Playa ("we", "us", "our") uses cookies and similar technologies on our website gilles-smarthomeplaya.com to enhance user experience, analyze website traffic, and for marketing purposes. This section outlines the types of cookies we use, their purposes, and how you can manage your cookie preferences.

11.2 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They are widely used to make websites work more efficiently, as well as to provide information to the site owners.

11.3 Types of Cookies Used

We use the following categories of cookies on our website:

11.4 Purpose of Cookies

• Essential Cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms.
• Analytics Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us know which pages are the most and least popular and see how visitors move around the site.
• Marketing Cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies

12. POLICY UPDATES​‌​‍

Gilles Smart Home Playa reserves the right to modify this Privacy Policy at any time. Any changes will be posted on this page with an updated "Last updated" date at the top of the document. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

12.1 Notification of Changes

In the event of significant changes to this Privacy Policy, we will notify you either through the email address you have provided us, or by placing a prominent notice on our website. This ensures that you are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.

12.2 Effective Date of Changes

All changes to this Privacy Policy are effective when they are posted on this page. Your continued use of our services following the posting of changes constitutes your acceptance of such changes.

12.3 Historical Versions

For your convenience, previous versions of this Privacy Policy will be archived and available for review. If you wish to access these versions, please contact us at contact@gilles-smarthomeplaya.com.

12.4 Legal Compliance

We are committed to ensuring that our Privacy Policy remains compliant with applicable laws and regulations, including the General Data Protection Regulation (GDPR). Any updates will reflect our ongoing commitment to protecting your privacy and ensuring transparency in our data processing activities.

By using our website, you acknowledge that you have read and understood this Privacy Policy, including any updates, and agree to be bound by its terms.

13. CONTACT AND COMPLAINTS​‌​‍

If you have any questions, concerns, or complaints regarding this Privacy Policy or the handling of your personal data, please contact us using the following details:

• Company Name: Gilles Smart Home Playa
• Contact Email: contact@gilles-smarthomeplaya.com
• Phone Number: +52 984 138 6009
• Physical Address: Calle 26 entre 10 y 20 Lote 1. 102 Kaan, Col. Centro, (MX) 77710 Playa del Carmen

13.1 Data Protection Officer

For matters specifically related to data protection, you may contact our Data Protection Officer at the email provided above.

13.2 Supervisory Authority

In accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that your data protection rights have been violated. You can contact the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or the relevant authority in your country of residence.

13.3 EU Online Dispute Resolution

For online dispute resolution, you may also refer to the EU Online Dispute Resolution platform.

We are committed to resolving any issues promptly and efficiently, and we appreciate your feedback to help us improve our services.