pureripplepckbcn.hair
Compliance & Governance

Privacy Policy

This document outlines how Continental Pure Ripple Operations B.V. collects, protects, processes, and retains personal information gathered through our online presence and client communications.

1. Introduction & Data Controller

Continental Pure Ripple Operations B.V. ("we", "us", "our"), operating the domain pureripplepckbcn.hair, acts as the primary Data Controller under the General Data Protection Regulation (EU) 2016/679 (GDPR). Our registered corporate seat is located at Keizersgracht 421, 1016 EK Amsterdam, Netherlands.

We take a restrained, principle-driven approach to data collection. We only process personal details necessary to answer commercial vending inquiries, coordinate technical site assessments, and maintain basic website security.

2. Categories of Information Collected

Depending on how you engage with our platform, we may process:

  • Contact & Enquiry Details: Your name, business email address, company affiliation, telephone number, and message content submitted through our online inquiry forms.
  • Technical Telemetry: Anonymized or pseudonymized IP addresses, browser classification, operating system details, referring URLs, and timestamps recorded by web servers for security and debugging purposes.
  • Cookie Preference Tokens: Small local storage flags or session cookies recording whether you have acknowledged our technical policies.

3. Legal Bases for Processing

Under Article 6 of the GDPR, we process personal information on the following grounds:

  • Legitimate Interests: Operating an informative, functional web portal, preventing unauthorized intrusion or cyber abuse, and responding to prospective B2B inquiries regarding equipment and route management.
  • Contractual Preparation: Taking pre-contractual steps at your explicit request (such as compiling an installation feasibility assessment or service scope proposal).
  • Consent: Where you provide direct consent for optional analytical tags or newsletter notifications (which you may withdraw at any time).

4. Use of Third-Party Processors

We do not sell, rent, or trade your personal data to advertisers or unrelated commercial brokers. We may share information with strictly vetted infrastructure providers under binding Data Processing Agreements (DPAs):

  • Hosting & Infrastructure Providers: Secure data centers located within the European Economic Area (EEA) providing server capacity and CDN routing.
  • Email Routing Platforms: Transactional mail relays responsible for dispatching incoming form submissions securely to our Amsterdam operations desk.
  • Security Analysts: Automated firewall mechanisms that filter malicious bot traffic and automated form spam.

5. International Data Transfers

Our core hosting resources and operational offices reside within the European Union. In any circumstance where third-party technical vendors maintain server nodes outside the EEA, transfers are governed by standard contractual clauses (SCCs) approved by the European Commission, ensuring equivalent levels of data protection.

6. Data Retention Protocols

We retain contact form records and correspondence only for as long as necessary to fulfill the initial inquiry or manage an ongoing business engagement. Inquiries that do not mature into commercial contracts are routinely purged from our active inbox records within 24 months, unless legal, tax, or audit compliance mandates extended archiving.

7. Your Statutory Rights Under GDPR

If you reside within the European Union, European Economic Area, or United Kingdom, you maintain statutory rights regarding your personal data:

  • Right of Access (Article 15): You may request copies of personal records we hold about you.
  • Right to Rectification (Article 16): You may request correction of inaccurate or incomplete information.
  • Right to Erasure (Article 17): Commonly known as the "right to be forgotten", allowing you to request deletion where no overriding legal obligation exists.
  • Right to Restriction (Article 18): The right to pause active processing under specific dispute circumstances.
  • Right to Data Portability (Article 20): You may request transmission of structured, machine-readable records to another controller.
  • Right to Object (Article 21): You may object to data processing grounded solely in our legitimate interests.

To exercise any of these statutory rights, submit a written inquiry to our data team at [email protected]. We aim to respond within 30 calendar days without levying administrative charges for reasonable requests.

8. California Consumer Privacy Act (CCPA / CPRA) Considerations

While our operational focus centers primarily on European commercial venues, we extend equivalent transparency to California residents where applicable: we do not sell personal identifiers, do not share consumer data for cross-context behavioral advertising, and honor statutory requests for access and deletion without discriminatory pricing.

9. Protection of Minors

Our website and vending services are intended strictly for commercial B2B audiences, facilities managers, and commercial real estate operators. We do not intentionally collect personal information from individuals under sixteen years of age.

10. Updates to This Policy

Operational practices, software configurations, and statutory guidelines evolve. Any revisions to this policy will be published here with an updated revision date.

Effective Date: January 1, 2026