PRIVACY POLICY – CASA LOPEZ S.A.
Casa Lopez S.A. (hereinafter, "Casa Lopez"), with legal domicile in the Argentine Republic, as data controller for personal data processing, informs users (hereinafter, the "Users") about its privacy policy in accordance with the Law 25,326 on Personal Data Protection of the Argentine Republic and, additionally, to the principles of the European Union’s General Data Protection Regulation (GDPR), in order to ensure transparent, lawful, and secure management of any personal information that may be collected through the website.
1. PERSONAL DATA COLLECTED
Casa Lopez may collect and process the following personal data voluntarily provided by the User when using the website:
- First name, last name, address, phone number, email address.
- Account access data (username, password).
- Data required for invoicing and payment (through MercadoPago).
- Information related to shipping and logistics (e.g., OCA).
- Purchase history and commercial preferences.
- Data for newsletter subscription and commercial communications (through Brevo or other authorized tools).
- Browsing and analytics data obtained through cookies and pixels (Google Analytics, Meta/Facebook Pixel, etc.) for statistical or remarketing purposes.
- National identity document number (DNI), required for invoicing.
- Email address registered to receive back-in-stock notifications for a product.
- IP address and technical connection data, for security purposes and to record operations carried out on gift cards.
- Name and email address provided by Meta, when the User chooses to sign in with their Facebook account.
- Curriculum vitae and contact details of applicants who apply through the careers form.
2. PURPOSE OF PROCESSING
Personal data is used for the following lawful purposes:
- Process purchase orders and manage payments through MercadoPago.
- Arrange product shipping through OCA or other logistics operators.
- Create and manage registered User accounts.
- Provide assistance and respond to inquiries or requests.
- Send transactional communications (purchase confirmations, shipping notices, etc.).
- Send commercial or promotional communications, newsletters, and remarketing actions (if the User has consented or if there is applicable legitimate interest under regulations).
- Perform statistical and performance analysis and continuously improve the site.
- Comply with legal and regulatory obligations.
3. LEGAL BASIS
The processing of personal data is based on:
- The User’s free, express, and informed consent, granted by providing the data or accepting this Policy.
- Performance of a contractual relationship, when the User makes a purchase or creates an account.
- Compliance with legal obligations, such as invoicing, tax obligations, and Argentine regulations.
- Legitimate interest, especially in the case of service improvements, site security, and permitted commercial communications.
4. DISCLOSURE AND TRANSFER OF DATA TO THIRD PARTIES
Casa Lopez does not sell or commercialize personal data.
Without prejudice to this, it may share them exclusively with trusted third parties for purposes related to operations:
- Payment platforms: Mercado Pago.
- Logistics and shipping: OCA or other authorized carriers.
- Email marketing, automation and commercial communications: Brevo (formerly Sendinblue). Beyond sending emails, Brevo records the User’s browsing on the site through an identifier stored in their browser, in order to personalise communications.
- Analytics and advertising tools: Google Analytics, Meta (Facebook/Instagram) Ads, and similar.
- Messaging: WhatsApp (Meta Platforms, Inc.), when the User voluntarily starts a conversation from the chat button on the site. In that case Meta processes the phone number and message content under its own policies.
- Web notifications: Brevo and its push notification provider, only where the User expressly grants permission in their browser.
- Form protection: Google reCAPTCHA, on the contact and job application pages. To tell a person apart from an automated system, Google receives the User’s IP address and technical data about their device and browser.
In all cases, these third parties only access the necessary data and are bound by confidentiality obligations. If international data transfers are made, Casa Lopez ensures they will be carried out in accordance with appropriate protection standards.
5. COOKIES AND SIMILAR TECHNOLOGIES
The site uses its own and third-party cookies for technical, statistical, analytics, and/or remarketing purposes.
Users may configure their browser to refuse or delete cookies at any time, and to revoke any permissions previously granted to the site. Doing so may limit certain functions, such as the shopping cart or signing in.
Push notifications. The site may ask the User for permission to send notifications through their browser. This permission is voluntary and expressly granted: if the User allows it, an identifier for their browser or device is stored, which makes it possible to send notices even when they are not visiting the site. Permission can be revoked at any time from the browser settings.
6. USERS’ RIGHTS
Users may exercise their rights of access, rectification, updating, deletion, and/or objection at any time, in accordance with Law 25,326 and GDPR regulations, by sending a request to:
Casa Lopez will respond within the legally established timeframes. If deletion is requested, the data may be retained in a blocked state only if there is a legal retention obligation or for defense against potential claims.
7. INFORMATION SECURITY
Casa Lopez adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or destruction, including encryption, access controls, and secure protocols.
8. UPDATES TO THIS POLICY
Casa Lopez may modify this Policy to reflect legal changes or improvements to its practices. Users are advised to review this section periodically. The current version will always be the one published on the website.
9. ENFORCEMENT AUTHORITY IN ARGENTINA
THE AGENCY FOR ACCESS TO PUBLIC INFORMATION , the enforcement authority under Law 25,326, has the power to handle complaints and claims related to the protection of personal data.
10. DATA RETENTION PERIOD
Data is retained for as long as the relationship with the User lasts and, thereafter, for the periods required by applicable legal, tax and accounting obligations.
- Invoicing and transaction data: ten (10) years, in accordance with Argentine tax regulations.
- Curriculum vitae and applicant data: up to twelve (12) months. Used solely for recruitment purposes and never shared with third parties.
- Data used for commercial communications: until the User withdraws consent.
- Browsing data and cookies: from the duration of the session up to a maximum of fourteen (14) months, depending on the cookie. They can be deleted at any time from the browser settings.
Once those periods have elapsed, data is deleted or anonymised, unless it must be kept blocked due to a legal retention obligation or to defend against potential claims.