Política de privacidad

This policy explains how personal data is processed under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

Legal entity

[COMPANY LEGAL NAME, S.L.]

CIF / VAT

[CIF]

Registered address

[FULL ADDRESS, MARBELLA/MÁLAGA, SPAIN]

Email

[EMAIL]

What we collect and why

• Order data (name, email, phone, delivery address, order contents) — to conclude and perform the sales contract. Legal basis: performance of a contract.
• Billing and tax records — to comply with Spanish commercial and tax obligations. Legal basis: legal obligation.
• Contact form messages — to answer your enquiry. Legal basis: your request / legitimate interest.
• Marketing email — only if you opt in. Legal basis: consent, withdrawable at any time.
• Analytics and advertising cookies — only after you accept them in the cookie banner. Legal basis: consent. See the cookie policy.

Recipients

Data is shared only with processors needed to run the shop: hosting and database infrastructure, the payment provider that processes your card payment, the carrier that delivers your parcel, and our accountants. Processors act under data-processing agreements. We do not sell personal data.

International transfers

Where a processor operates outside the EEA, transfers rely on an adequacy decision or on the European Commission's standard contractual clauses.

Retention

Order and invoicing records are kept for the statutory period (six years under Spanish commercial law, four years for tax purposes). Contact messages are kept for up to two years. Marketing consent data is kept until you withdraw consent.

Your rights

You may request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent at any time, by writing to [EMAIL]. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

Security

Traffic is encrypted in transit, access to the order database is restricted by row-level security policies, and card details are never stored on our servers — they are handled entirely by the payment provider.