Privacy policy

1. Data controller

• Controller: [RAZÓN SOCIAL / COMPANY NAME]
• Tax ID: [NIF/CIF]
• Address: [DIRECCIÓN COMPLETA / FULL ADDRESS]
• Contact email: hello@rinconpeludo.com

2. What data we process

• Order data: first name, last name, email, phone and delivery address.
• Payment data: handled directly by the payment provider (bank, PayPal or Apple Pay). We never store card numbers.
• Newsletter data: your email, if you subscribe.
• Contact data: whatever you share when you write to us.
• Technical data: IP address and browsing data needed for the website to work securely.

3. Why we use it and legal basis

• To process your orders, deliveries, returns and warranty claims — performance of a contract (art. 6.1.b GDPR).
• To issue invoices and meet accounting and tax obligations — legal obligation (art. 6.1.c GDPR).
• To answer your questions — your consent or pre-contractual steps (art. 6.1.a and 6.1.b GDPR).
• To send you our newsletter — your consent (art. 6.1.a GDPR), which you can withdraw at any time.
• To keep the website secure and prevent fraud — legitimate interest (art. 6.1.f GDPR).

4. How long we keep it

• Order and invoice data: for the duration of the business relationship and then for the legal period (6 years under the Spanish Commercial Code and 4 years under tax law).
• Newsletter: until you unsubscribe.
• Enquiries: as long as needed to reply and no longer than one year.

5. Who we share it with

We never sell your data. We only share it with service providers acting as processors under contract: carriers and couriers, payment providers, web hosting, email tools and our accountants — and with public authorities where required by law.

If a provider is located outside the European Economic Area, transfers are made with GDPR safeguards (adequacy decision or the European Commission’s standard contractual clauses).

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by emailing hello@rinconpeludo.com and stating the right you wish to exercise.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the authority in your country.

7. Children

Purchases are intended for adults. We do not knowingly collect data from children under 14.

8. Security

We apply technical and organisational measures to protect your data, such as encrypted connections (HTTPS) and restricted access.

9. Changes

We may update this policy. Any changes will be published here with the date of the update.