Privacy Policy
Last updated: 15/06/2026
Your privacy matters to us. The Tramas Group of Companies wishes to maintain a transparent relationship with you, informing you about how we collect, use and protect the personal data you provide to us or that is generated as a result of your relationship with our companies, brands, stores, websites, forms, online services, commercial campaigns or service channels.
This Privacy Policy aims to inform you clearly about the processing of your personal data, in accordance with Regulation (EU) 2016/679 of 27 April, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
For any queries regarding this Privacy Policy, please contact us at: protecciondedatos@tramasmas.com.
1. Who is the data controller?
The companies in the Tramas Group included in this Policy are as follows, all with registered address at Calle Río Viejo 48, 41700 Dos Hermanas, Seville:
- Grupo Empresarial Tramas, S. L. - CIF B90290578
- Tramas Retail, S. L. - CIF B91110528
- Tramas Home, S. L. - CIF B75267880
Within the Tramas Family programme, the three companies act as joint controllers pursuant to Article 26 of the GDPR, by virtue of the Joint Controller Agreement entered into between them. The essential content of that agreement is set out in section 6 of this Policy.
2. What personal data do we process and how do we obtain it?
We may process personal data that you provide to us directly, as well as data generated as a result of your relationship with any of the companies in the Tramas Group. By way of example:
- Identification and contact data: name, surname, postal address, email address, telephone.
- Data provided voluntarily through physical or digital forms, registrations, purchases, requests, surveys, promotions or campaigns.
- Data arising from purchases, orders, returns, incidents, warranties, invoicing or any commercial relationship.
- Data arising from communications you maintain with us through any channel.
- Browsing data on online services, including IP address, cookies or similar technologies, in accordance with our Cookies Policy.
- Image data in CCTV processing, visits or events where prior notice is given.
3. What is our legal basis for processing your personal data?
We process your data on the legal bases set out in Article 6 of the GDPR.
3.1. User consent
Where you have given it expressly, freely, specifically, informedly and unambiguously, in particular for the sending of commercial communications and enrolment in Tramas Family. You may withdraw your consent at any time without affecting the lawfulness of prior processing.
3.2. Performance of a contractual or pre-contractual relationship
Where necessary to manage the relationship you have with us as a customer, buyer, supplier or person interested in our products or services.
3.3. Legitimate interests
We may process your data on the basis of our legitimate interests where those interests do not override your rights and freedoms, for example for statistical analysis, service improvement, fraud prevention or facility security. Specifically within Tramas Family, the segmentation and personalisation of communications is based exclusively on the consent given at the time of registration in the programme. Legitimate interest as a basis for personalisation is reserved exclusively for other Group processing activities outside Tramas Family.
3.4. Compliance with legal obligations
Where necessary to comply with tax, accounting, commercial, administrative obligations or requirements of competent authorities.
4. What do we use your personal data for?
4.1. Managing the commercial, contractual or user relationship
Management of orders, purchases, payments, deliveries, returns, warranties, incidents, invoicing and handling of queries or complaints.
4.2. Sending commercial communications
Where we have an adequate legal basis, sending promotional or informational communications about the Group companies' products, services, news, offers and campaigns by any means permitted by the applicable regulations.
4.3. Tramas Family
Tramas Family is the loyalty programme, benefits and commercial communications programme associated with the Tramas+ and Tramas Home brands, jointly promoted by:
- Grupo Empresarial Tramas, S. L. (Tramas+) - CIF B90290578
- Tramas Retail, S. L. (Tramas+) - CIF B91110528
- Tramas Home, S. L. (Tramas Home) - CIF B75267880
The three companies act as joint controllers pursuant to Article 26 of the GDPR (see section 6).
Within Tramas Family we will process your data to manage your enrolment and membership in the programme, send you commercial communications from Tramas+ and Tramas Home, manage your participation in promotions and campaigns, and personalise communications based on your preferences and interactions.
The legal basis is your consent, given when submitting the registration form.
"By submitting this form I declare that I am over 18 years of age, I accept the General Terms and Conditions of Tramas Family and the Privacy Policy, and I consent to receiving commercial communications from Tramas+ (Grupo Empresarial Tramas, S.L. and Tramas Retail, S.L.) and Tramas Home (Tramas Home, S.L.)."
4.4. Personalisation, segmentation and commercial analysis
Internal analysis, segmentation, results measurement and personalisation of communications to improve products, services and campaigns. Within Tramas Family, this purpose is based on consent. For other Group processing activities it may be based on legitimate interests where applicable.
For the management and automation of commercial communications we use Klaviyo or equivalent tools, acting as data processors (see section 8).
4.5. Customer service, recruitment, statistical analysis, security and facilities
Handling of queries, complaints and incidents; evaluation of applications for selection processes; market research and aggregated analysis; CCTV of facilities on the basis of legitimate interests.
5. Summary of purposes, legal bases and categories of data
The table below summarises the main processing purposes. It does not replace the rest of this Policy.
| Purpose | Legal basis | Categories of data |
|---|---|---|
| Management of purchases, orders and services | Performance of contract / legal obligation | Identification data, contact, transactions, service-derived data |
| General commercial communications | Consent / legitimate interests where applicable | Identification data, contact, preferences, usage-derived data |
| Tramas Family | Consent | Identification data, contact, programme participation, preferences, interaction with communications |
| Segmentation and personalisation | Consent (within Tramas Family). Legitimate interests for other Group processing. | Contact data, purchases, browsing, interaction, preferences |
| Customer service and enquiries | Performance of contract / legitimate interests | Identification data, contact, communications, incidents |
| Legal obligations | Legal obligation | Identification data, transactions, invoicing, data required to comply with regulations |
| CCTV and security | Legitimate interests | Image and security-related data |
| Recruitment applications | Consent / pre-contractual measures | Identification data, contact, CV, professional experience |
6. Joint controllership in Tramas Family — Agreement under Art. 26 GDPR
Within Tramas Family, Grupo Empresarial Tramas, S. L., Tramas Retail, S. L. and Tramas Home, S. L. act as joint controllers pursuant to Article 26 of the GDPR. The three companies jointly determine the purposes and means of processing the personal data of programme members.
Pursuant to Article 26(2) of the GDPR, the essential content of the Joint Controller Agreement entered into between the three companies is as follows:
- Joint controllers: Grupo Empresarial Tramas, S. L. (CIF B90290578), Tramas Retail, S. L. (CIF B91110528) and Tramas Home, S. L. (CIF B75267880).
- Joint processing activity: management of the Tramas Family loyalty programme, including member enrolment, sending of commercial communications under the Tramas+ and Tramas Home brands, personalisation and segmentation of communications, and management of opt-outs and exercise of rights.
- Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).
- Single point of contact for the exercise of rights: Grupo Empresarial Tramas, S. L. — protecciondedatos@tramasmas.com. Without prejudice to the foregoing, you may direct your request to any of the three companies, which will handle it and respond within the legally established timeframe.
- Management of security breaches: the joint controller that becomes aware of a breach will notify the others within a maximum of 24 hours, with Grupo Empresarial Tramas, S. L. being responsible for notifying the AEPD within 72 hours.
- Liability: the three companies are jointly and severally liable to data subjects and the AEPD, without prejudice to the internal recourse actions provided for in the Agreement.
The full Joint Controller Agreement is available for inspection upon request sent to protecciondedatos@tramasmas.com.
7. Data sharing between Group companies
In the case of Tramas Family, and provided that you have given your consent at the time of registration, your data may be processed and shared between the three joint controllers for the purpose of managing your membership in the programme and sending you commercial communications from Tramas+ and Tramas Home. The legal basis is your consent.
Outside Tramas Family, data may be shared between Group companies where there is a sufficient legal basis to do so.
8. To whom will your data be disclosed?
No disclosure to third parties is envisaged except where necessary for the purposes described or where a legal obligation exists. Possible recipients include:
- Public administrations, tax authorities, courts or security forces where a legal obligation exists.
- Financial institutions, logistics providers, technology providers and marketing platforms acting as data processors.
- Credit reference files in the event of non-payment of obligations, in accordance with the applicable regulations.
For the management and automation of Tramas Family commercial communications we use Klaviyo, Inc. as our data processor. Data Processor — Klaviyo, Inc.: Klaviyo acts as data processor under Klaviyo's standard Data Processing Agreement (DPA), updated on 17 December 2025, executed with each of the three joint controllers of the Tramas Family programme (Grupo Empresarial Tramas, S. L., Tramas Retail, S. L. and Tramas Home, S. L.), pursuant to Art. 28 GDPR. Personal data processed by Klaviyo may be transferred to the United States under Standard Contractual Clauses (Module 2, EU Implementing Decision 2021/914) and the EU-US Data Privacy Framework (DPF). DPA available at: https://www.klaviyo.com/es/legal/data-processing-agreement
9. How long do we retain your personal data?
We will retain your data for as long as necessary to fulfil the purposes for which it was collected and for the duration of our relationship with you. After that period, data may be retained in a blocked form for the applicable statutory limitation periods (generally 5 years for contractual liability pursuant to Art. 1964 CC, and 4 years for tax obligations).
For online services, if we detect no use of or interaction with your account or our services for a period of two (2) years, we will block your data.
Prior notice before blocking due to inactivity: before blocking your account due to inactivity, we will send you a notice at least 30 days in advance so that you may reactivate it or request the permanent deletion of your data. If we receive no response or there is no interaction within that period, we will proceed to block your data. Blocked data may be retained for the statutory limitation periods indicated above and will be permanently deleted once those periods have elapsed.
In the case of Tramas Family, your data will be retained for as long as you remain a member or until you withdraw your consent or request cancellation. Following cancellation, data will be blocked and retained for the applicable limitation periods.
10. How can you stop receiving commercial communications?
You can stop receiving commercial communications at any time by using the unsubscribe link included in each commercial email, or by writing to protecciondedatos@tramasmas.com.
Opting out of commercial communications will not prevent the sending of non-commercial communications necessary for the management of orders, warranties, returns, incidents or legal obligations.
11. What are your rights?
You may exercise the following rights at any time: access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent. You also have the right to lodge a complaint with the AEPD (www.aepd.es).
12. How can you exercise your rights?
By contacting:
Grupo Empresarial Tramas, S. L. — Single point of contact for Tramas Family
Calle Río Viejo 48, 41700 Dos Hermanas, Seville
Email: protecciondedatos@tramasmas.com
Data protection officer / contact: José María Jurado
We may ask you to verify your identity in order to process your request correctly.
13. Changes to this Policy
We may amend this Policy when necessary due to regulatory, technical or organisational changes. When we make significant changes, we will inform you through the appropriate channels. We recommend that you consult it periodically.
