Legal
Annex II — Terms on the processing and disclosure of personal data
Annex to the CanGerard General Contracting Terms and Conditions for Sellers. It governs the processing of the personal data of Buyers that the Platform discloses to the Seller and the data-protection obligations of both parties. If the language versions diverge, the Spanish version prevails.
Version: 1.0 · 02/07/2026
1. Subject matter and position of the parties
1.1. This Annex governs the processing of the personal data of Buyers that the Platform discloses to the Seller for the performance of Orders, as well as the data-protection obligations of both parties in the relationship. 1.2. The Platform and the Seller act as independent data controllers: the Platform, with regard to the operation of the Site and its own legal obligations; the Seller, with regard to the preparation, dispatch, delivery and after-sales service of its Orders. The parties are not joint controllers (Art. 26 GDPR), nor is there a controller-processor relationship between them (Art. 28 GDPR) with regard to these data, without prejudice to section 7.
2. Data disclosed and purpose
2.1. For each Order, the Platform discloses to the Seller exclusively: the recipient's full name, the delivery address and, where necessary for transport, a contact telephone number. Where the Buyer requests a full invoice, also the Buyer's tax details, for the sole purpose of invoicing (see section 8). 2.2. The basis for the disclosure is the performance of the contract of sale (Art. 6(1)(b) GDPR). The Seller shall process these data solely to: prepare and dispatch the Order; manage its delivery and any incidents; handle returns, withdrawals and guarantees; issue, where applicable, the legally required documentation; and respond to requests from authorities.
3. Prohibitions
The Seller undertakes not to: (a) use Buyers' data for its own purposes of marketing, customer acquisition, loyalty schemes, profiling or database enrichment; (b) contact Buyers outside the management of the Order and its incidents; (c) disclose the data to third parties other than the carriers and postal operators necessary for delivery; (d) transfer them outside the European Economic Area; or (e) retain them beyond what is provided for in section 5. Breach of this section constitutes a serious breach for the purposes of clause 20 of the Terms and Conditions.
4. Obligations of the Seller as controller
The Seller shall comply with the GDPR and the LOPDGDD with regard to its own processing and, in particular: shall process the data confidentially, restricting them to the staff who need them; shall apply security measures appropriate to the risk (access control, no reuse of lists, secure destruction of delivery notes and labels); shall maintain, where required of it, its record of processing activities; and shall be liable for the damages and penalties arising from its own breaches, holding the Platform harmless.
5. Retention and erasure
The Seller shall erase or anonymise Buyers' data when they are no longer necessary for the management of the Order and its incidents, and shall in any event apply the blocking regime of Art. 32 LOPDGDD with regard to the documentation it must retain under a legal obligation (tax and commercial), limiting its use to making it available to authorities during the limitation periods.
6. Exercise of rights
6.1. Each party shall handle data subjects' rights with regard to its own processing. If one party receives a request that concerns the other party's processing, it shall forward it to that party within a maximum of 5 working days, informing the data subject. 6.2. The parties shall cooperate in good faith in handling rights that affect both of them (e.g., erasure of the data of an Order already delivered, subject to legal blocking obligations).
7. Processing on behalf of the Platform
Where the Seller uses Dashboard tools that involve processing data on behalf of the Platform (e.g., Buyer-communication modules hosted on the Site), it shall do so following the Platform's instructions and only within the tool, without extracting the data. Conversely, the Platform does not act as a processor for the Seller.
8. Invoicing on behalf of the Seller
Within the framework of Annex I, the Platform processes the data necessary to issue the invoices (including, where applicable, the tax details of Buyers who request a full invoice) as controller of its own processing arising from its legal and contractual obligations, and makes the invoices available to the Seller, who retains them as the party liable for tax purposes.
9. Security breaches
Each party shall notify the other, without undue delay and at the latest within 48 hours of becoming aware of it, of any security breach affecting data of Buyers linked to the other party's Orders, providing the available information (nature, categories and approximate number of data subjects affected, measures adopted) and cooperating in its management, without prejudice to each controller's obligations towards the AEPD and the data subjects affected.
10. The Seller's own data
The data of a Seller who is a natural person and the contact details of the Seller's staff (Art. 19 LOPDGDD) are processed by the Platform in accordance with the Site's Privacy Policy, for the management of the contractual relationship, compliance with the Platform's legal obligations (verification, invoicing, online platforms) and defence against claims.
11. Information and verification
Upon a reasoned request from the Platform (e.g., following a Buyer's complaint about unsolicited communications), the Seller shall provide reasonable information evidencing compliance with this Annex.
12. Liability
Each party is liable towards data subjects and the AEPD for its own breaches. If one party were to bear penalties or compensation caused by the other party's breach, it may recover the full amount from that party.
13. Term
This Annex applies throughout the entire relationship and, with regard to the data disclosed, for as long as the Seller retains them in accordance with section 5. Its content shall be updated when the applicable rules or the data flows change, in accordance with clause 21 of the Terms and Conditions.