PRIVACY POLICY UGC CAMPAIGN – BIO-OIL

Data Controller

The data controller of the personal data provided in the context of this campaign is THE KILITE, S.L., with VAT number B66873118, and located at C/ Modolell 29B, 08021 Barcelona (hereinafter, “The Kilite”).
The Kilite manages the collection and processing of personal data related to the Bio-Oil UGC campaign. In cases where Bio-Oil participates in the evaluation, follow-up, or execution of the campaign as a recipient of the necessary information for its development, it will act as the data recipient or, if applicable, in the legal role corresponding to the actual setup of the campaign.

Purposes of Processing

The personal data provided by interested parties will be processed for the following purposes:

a) To manage participation in the Bio-Oil UGC campaign, including receiving applications or profiles, evaluating their suitability for the campaign, and, if applicable, selecting collaborators.

b) To manage necessary communications related to the campaign, including operational contacts, action coordination, issue resolution, and overall collaboration follow-up.

c) To manage the sending of products, materials, or information necessary for the proper execution of the campaign, when applicable.

d) To perform administrative, logistical, and operational follow-up of the collaboration and, if necessary, verify compliance with the requirements or deliverables associated with the campaign.

e) To comply with applicable legal obligations and, if necessary, to file, exercise, or defend claims.

f) Only when the interested party expressly authorizes it, to keep their contact data for future campaigns or collaborations of a similar nature.

Categories of Data Processed

Depending on the campaign phase and the progress of the process, the following categories of data may be processed:

a) Identifying data: name and surname.

b) Contact data: email address and, if applicable, phone number.

c) Data related to the professional or content creator profile: links to social media profiles, username, general profile metrics, and any other public or voluntarily provided information relevant for assessing the suitability of the profile for the campaign.

d) Logistical data: postal address or other data necessary for the sending of products, when the person is selected or it is necessary for the execution of the collaboration. No data will be requested that is not adequate, relevant, and limited to what is necessary for managing the campaign.

Legal Basis for Processing

The legal basis for processing will be as follows:

a) The consent of the interested party, regarding the voluntary submission of their data to participate in the campaign and, if applicable, for processing their data for future campaigns or collaborations, when this purpose is accepted separately.

b) The application of pre-contractual measures or the execution of a contractual or professional relationship, when the interested party is selected and it is necessary to process their data to manage the collaboration, operational communications, or product delivery.

c) Compliance with legal obligations that are applicable to the controller.

d) The legitimate interest of the controller for the proper administrative management of the campaign and for the filing, exercising, or defending claims, always within the limits established by applicable law.

Mandatory or Voluntary Data

The completion of data identified as mandatory will be necessary to process the application or manage the collaboration. Failure to provide this data may prevent the assessment of the profile, participation in the campaign, or proper execution of the collaboration.
Logistical data will only be requested when necessary for the sending of products or for the material execution of the campaign.

Data Recipients

Personal data may be communicated, when necessary for the purposes described, to the following categories of recipients:

a) Bio-Oil, to the extent necessary for the evaluation, coordination, follow-up, and execution of the campaign.

b) Logistic or courier service providers, exclusively for managing shipments.

c) Technological providers or platforms offering services for support, storage, management, or tracking of the campaign.

d) Public administrations, judges, courts, or competent authorities, when there is a legal obligation or when necessary to defend rights and legitimate interests.

Data will not be transferred to third parties for purposes unrelated to those indicated here.

International Transfers

In general, no international data transfers outside the European Economic Area are foreseen.
However, if campaign management involves platforms, tools, or providers located outside the European Economic Area or that entail access from third countries, such transfers will be made with the appropriate safeguards required by applicable law, including, if necessary, the adoption of standard contractual clauses or other legally approved mechanisms.

Data Retention Period

Personal data will be retained for the time necessary to manage the campaign and, if applicable, the pre-contractual, contractual, or professional relationship arising from it.
Once the campaign is completed or the corresponding relationship has ended, the data may be retained in a blocked form for the necessary periods to comply with legal obligations and for the filing, exercising, or defending of claims.
After these periods, the data will be deleted.
If the interested party has expressly authorized the use of their data for future campaigns or collaborations, the data will be retained for that purpose until they withdraw their consent or request its deletion, without prejudice to its blocked retention when legally required.

Rights of Interested Parties

The interested party may exercise, at any time, the rights of access, rectification, deletion, opposition, limitation of processing, and portability, as provided by applicable law.
Additionally, when the processing is based on consent, the interested party may withdraw their consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
To exercise these rights, the interested party may contact The Kilite through the following means:

• Email: media@thekilite.com

• Postal address: C/ Modolell 29B, 08021 Barcelona

The interested party also has the right to file a complaint with the Spanish Data Protection Agency if they consider that their data is being processed unlawfully.

Security Measures

The Kilite will adopt the appropriate technical and organizational measures to ensure an adequate level of security relative to the risk, in order to protect personal data from unauthorized access, alteration, loss, destruction, or improper communication.
Security measures will be applied proportionally to the nature of the data processed and the operations carried out within the campaign.

Amendments to the Privacy Policy

The Kilite may update this privacy policy when necessary due to regulatory, operational, or organizational changes. In such cases, the updated version will be made available to interested parties through appropriate means.