Privacy Policy

1. Data Controller

The entity responsible for processing your personal data is:

• Responsible Name: [Enter Owner's Full Name or Company Name]
• VAT / NIF: [Enter NIF/CIF]
• Address: [Enter Complete Address, Spain]
• Email: [Enter Contact Email, e.g., legal@yourdomain.com]

2. Personal Data We Collect

We process the personal data that you provide directly to us during your interaction with our website:

• Contact and Shipping Information: Full name, email address, physical delivery address, billing address, and phone number when placing an order or registering an account.
• Payment Information: All payment details are processed and encrypted directly by Stripe. We do not store or have access to your full credit card details.
• Browsing Data: IP address, browser type, and navigation logs collected through technical and analytical cookies.

3. Purposes of Processing

Your personal data is collected and processed for the following purposes:

• Order Fulfillment: To manage, process, and ship the products purchased by you, as well as handling customer service requests, returns, or warranty claims.
• Account Registration: To create and manage your user account in the store.
• Marketing Communications: To send you newsletters and promotional offers if you have subscribed and given your explicit marketing consent.
• Security & Anti-Fraud: To monitor and prevent fraudulent activities or security breaches (such as checking rate limits and verifying tokens).

4. Legal Basis for Processing

The legal basis for processing your data depends on the purpose:

• Contractual Performance: Processing of shipping, billing, and contact details is necessary to perform the purchase contract.
• Consent: Sending promotional emails and newsletters is based on your explicit consent, which you can withdraw at any time.
• Legal Obligation: Retention of billing data for accounting and tax regulations.
• Legitimate Interest: Protecting our website against fraud and cybersecurity threats.

5. Data Sharing and International Transfers

We do not sell your personal data. We only share data with essential third-party service providers (Data Processors) to run our store:

• Firebase (Google LLC): Used for secure user authentication (Firebase Auth) and database hosting (Firestore). Data is processed under EU standard contractual clauses.
• Stripe Inc.: Used for secure payment processing and fraud prevention.
• Resend / Nodemailer: Used for sending transactional emails (order confirmations, return updates).

6. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with accounting, tax, or legal obligations (typically up to 5-6 years for tax records in Spain).

7. Your Rights (ARCO+)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (Omission): Request deletion of your personal data when it is no longer necessary.
• Right to Restriction: Request limit on how we process your data.
• Right to Object: Object to processing for direct marketing purposes.
• Right to Data Portability: Request transfer of your data to another organization.

To exercise these rights, please email us at [Enter Contact Email] with a copy of your ID card (DNI/NIE) or an equivalent document to verify your identity.

If you believe your data has been handled incorrectly, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.