In compliance with the information duty established in Article 10 of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce, the following information is provided: Company that owns this website: Estudio Castillejos S.L. – PUNTO HABITAT Tax Identification Number (C.I.F.): B61895645 Address: Calle de la Industria 137, Barcelona (08025), Barcelona, Spain Phone: +34 93 455 85 35 Email: info@puntohabitat.es PURPOSE The Data Controller provides users with this document with the aim of complying with the current regulations on Data Protection, within the framework of the new regulatory framework established pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter, the “GDPR”), and national legislation, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, the “LOPDGDD”). This document also informs all website users about the conditions of use of the same. Anyone who accesses this website assumes the role of a user, committing to the observance and strict compliance with the provisions set forth herein, as well as any other applicable legal provision. The Data Controller reserves the right to modify any type of information that may appear on the website, without any obligation to give prior notice or inform users of such obligations, with publication on the Data Controller’s website being considered sufficient. RESPONSIBILITY The Data Controller disclaims any responsibility for the information published on its website, provided that this information has been manipulated or introduced by a third party unrelated to it. IP ADDRESSES The servers of the website may automatically detect the IP address and domain name used by the user. An IP address is automatically assigned to a computer when it connects to the Internet. All this information is recorded in a server activity file, duly registered, which allows the subsequent processing of data in order to obtain solely statistical measurements that allow us to know the number of page views, the number of visits made to web servers, the order of visits, access points, etc. LINK POLICY From this website, it is possible to redirect to third-party website contents. Since the Data Controller cannot always control the contents entered by third parties on its websites, it assumes no responsibility for such contents. In any case, the Data Controller states that it will proceed to immediately withdraw any content that may contravene national or international legislation, morality, or public order, proceeding to the immediate removal of the redirection to such a website and notifying the competent authorities of the content in question. The Data Controller is not responsible for the information and contents stored, including but not limited to, in forums, chats, blog generators, comments, social networks, or any other means that allows third parties to independently publish content on the Data Controller’s website. However, in compliance with the provisions of Articles 11 and 16 of the LSSICE, the Data Controller makes itself available to all users, authorities, and security forces, actively collaborating in the withdrawal or, where applicable, blocking of all those contents that could affect or contravene national or international legislation, the rights of third parties, or morality and public order. In the event that the user believes that there is content on the website that could be classified as such, please notify the website administrator immediately. This website has been reviewed and tested to ensure its proper functioning. In principle, it can be guaranteed to function correctly 365 days a year, 24 hours a day. However, the Data Controller does not rule out the possibility of certain programming errors, or that there may be force majeure events, natural disasters, strikes, or similar circumstances that may make access to the website impossible. DATA PROTECTION The Data Controller is deeply committed to complying with the provisions of the current regulations on data protection, within the framework of the new regulatory framework established pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter, the “GDPR”), and the LOPDGDD. Likewise, the Data Controller informs that it complies with Law 34/2002 of July 11, on Information Society Services and Electronic Commerce and will request your consent for the processing of your data for commercial purposes at all times. INTELLECTUAL AND INDUSTRIAL PROPERTY The website, including but not limited to, its programming, editing, compilation, and other elements necessary for its operation, designs, logos, text, and/or graphics, are the property of the Data Controller or, if applicable, have a license or express authorization from the authors. All website content is duly protected by intellectual and industrial property regulations. Regardless of the purpose for which they were intended, the total or partial reproduction, use, exploitation, distribution, and commercialization requires the prior written authorization of the Data Controller in all cases. Any use not previously authorized by the Data Controller will be considered a serious breach of the intellectual or industrial property rights of the author. Designs, logos, text, and/or graphics unrelated to the provider and that may appear on the website belong to their respective owners, who are themselves responsible for any possible controversy that may arise regarding them. In any case, the Data Controller has the express and prior authorization of the same. The Data Controller expressly authorizes third parties to redirect directly to the specific contents of the website, in any case redirecting to the Data Controller’s main website. The Data Controller recognizes in favor of its owners the corresponding intellectual and industrial property rights, not implying their mere mention or appearance on the website the existence of rights or responsibility of the Data Controller over them, nor endorsement, sponsorship, or recommendation on their part. For all those images in which the design software allows it, the corresponding references to authorship and the corresponding license have been included. To make any kind of observation regarding possible breaches of intellectual or industrial property rights, as well as any of the website contents, you can do so in writing or by email to the addresses indicated in the header. SSL The Data Controller has contracted an SSL certificate (“Secure Sockets Layer”) for its website. An SSL certificate allows you to protect all personal and confidential information that may be handled on a website, regardless of the information being transmitted, such as, for example, from any of the contact forms on the website to the server, or the data entered for newsletter subscriptions or access to protected areas, etc. The website’s address will appear in green, activating the “https” protocol that allows secure connections from a web server to the user’s browser. PRIVACY POLICY PUNTO HABITAT informs users of the website about its policy regarding the processing and protection of the personal data of users and clients. It guarantees at all times the complete and full compliance with the obligations established by the regulations on data protection and information society services: Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data (GDPR), Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), and Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSICE). DATA CONTROLLER Company that owns this website: Estudio Castillejos S.L. – PUNTO HABITAT Tax Identification Number (C.I.F.): B61895645 Address: Calle de la Industria 137, Barcelona (08025), Barcelona, Spain Phone: +34 93 455 85 35 Email: info@puntohabitat.es PURPOSES OF DATA PROCESSING The data provided by the User is used for various purposes, as listed below: Purpose of processing Legal basis for processing Manage queries submitted through web forms. Legitimate interest of the Company to respond to information requests via the website. Consent explicitly given at the time of data collection through web forms. Send newsletters, commercial communications, and promotions. Consent explicitly given at the time of data collection through web forms. Create and manage your user registration. Consent explicitly given at the time of data collection through web forms. For the development, fulfillment, and execution of the purchase or service contract that you have entered into through our website. Consent explicitly given at the time of data collection through web forms. We consider that we have a legitimate interest in performing the necessary checks to detect and prevent possible fraud when making a purchase. Execution of a contract. Perform accounting management. Execution of a contract. Comply with current tax obligations. Compliance with legal obligations applicable to us. Manage incidents and website maintenance. Legitimate interest of the Company. Creation of a file of Non-compliance with monetary obligations. Legitimate interest in preventing fraud. (Art. 6.1.f GDPR). DATA RETENTION PERIOD Purpose of processing Legal basis for processing Manage queries submitted through the contact form We will process your data for as long as necessary to address your request or query. Send newsletters, commercial communications, and promotions. We will process your data until you unsubscribe. Create and manage your user registration. We will process your data for as long as you maintain the status of a registered user (i.e., until you decide to unsubscribe). For the development, fulfillment, and execution of the purchase or service contract that you have entered into through our website. We will process your data for the time necessary to manage the purchase of the products or services you have acquired, including possible returns, complaints, or claims associated with the purchase of the specific product or service. Perform accounting management. We will process your data for the time necessary to comply with the legal prescription periods applicable to you. Comply with current tax obligations. We will process your data for the time necessary to comply with the legal prescription periods applicable to you. Manage incidents and website maintenance. We will process your data for the time necessary to comply with the legal prescription periods applicable to you. Creation of a file of Non-compliance with monetary obligations. We will process your data for the time necessary to comply with the legal prescription periods applicable to you. RECIPIENTS OF THE DATA To fulfill the purposes indicated in this Privacy Policy, it is necessary for us to grant access to your data to third parties who provide support in the services we offer (Data Processors), namely:

• Financial entities
• Technology service providers
• Logistics, transport, and delivery service providers and collaborators
• Marketing and advertising service providers and collaborators

Data Processors for the performance of a contract or provision of a service to the Data Controller, following its instructions at all times and ensuring the same security levels. DATA SOURCE The personal data will be provided by the interested party voluntarily. Failure to provide certain data or answers that may be formulated in the registration processes or in the different electronic forms that may be presented to the User may result in the impossibility of accessing certain services for which it is essential to have personal data, in which case the Data Controller will inform of the mandatory and/or necessary nature of providing personal data for the proper functioning of the service. The Data Controller assures you of the confidentiality of your personal data and guarantees the security of the same, taking the necessary measures to prevent its alteration, loss, treatment, or unauthorized access. INFORMATION PROVIDED BY THE USER Individuals under 14 years of age may not provide their personal data without the prior consent of their father/mother and/or legal guardians. Users, by entering their data in the contact forms or provided in download forms, expressly and freely and unequivocally accept that their data are necessary to meet their request, by the Data Controller, with the inclusion of data in the remaining fields being voluntary. The User guarantees that the personal data provided are true and is responsible for communicating any changes to them. All the data requested through the website are necessary for the provision of an optimal service to the User. In the event that not all the data is provided, it is not guaranteed that the information and services provided by the Data Controller will be completely adjusted to your needs. SECURITY MEASURES In accordance with the provisions of the current regulations on the protection of personal data, the Data Controller is complying with all the provisions of the GDPR and LOPDGDD regulations for the processing of personal data for its responsibility, which are treated in a lawful, fair, and transparent manner in relation to the interested party and are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. The Data Controller guarantees that it has implemented appropriate technical and organizational policies to apply the security measures established by the GDPR and LOPDGDD in order to protect the rights and freedoms of Users and has communicated the appropriate information to enable them to exercise them. SECURITY BREACHES The Data Controller will report any security breach affecting the database used by this website, or that affects any of our third-party services, to all persons, whose data may have been affected, and to the authorities, within 72 hours following the detection of the breach. APPLICABLE LAW AND JURISDICTION To resolve all disputes or issues related to this website or the activities carried out on it, Spanish law will apply, to which the parties expressly submit, being competent to resolve all conflicts arising or related to its use the Courts and Tribunals of Barcelona.