Privacy Policy

Who is responsible

The controller is the operator of issatintaypunto.com, trading as IssaTintaYPunto, established in Spain. Contact: issatintaypunto@gmail.com. Identification details required by Spanish law are in the legal notice.

We have not appointed a data protection officer or an Article 27 representative, because we are established in Spain and this processing is not of a scale that requires a DPO.

What we collect

Data you give us: name, email, and shipping address when you order; email and consent when you join the newsletter; email and message when you use the contact form; a voucher code if you apply one.

Order data: products, amounts, and payment status. Card numbers are collected by Stripe, not stored by us.

Data collected automatically, and only if you accept analytics: pages viewed, referring page, browser and device type, and approximate location. We do not collect precise geolocation, account passwords, or sensitive data such as health, beliefs, or official ID numbers. Please do not send us that kind of information.

Why we use it, and the legal basis

Orders, shipping, and customer support: performance of the contract.

Newsletter: your consent. You can withdraw it with the unsubscribe link or by email. Service emails about an order are not marketing.

Contact messages: steps taken at your request, and our legitimate interest in answering you.

Voucher cookies: our legitimate interest in stopping the same voucher from being reused.

Optional analytics: your consent. If you reject them, we do not load Vercel Analytics or Speed Insights.

Accounting, tax, fraud prevention, and responding to authorities: legal obligation, or our legitimate interest in protecting the site and our rights.

Who receives it

We share personal data with processors who act on our instructions, not with advertisers:

Stripe, to take payment and issue receipts. See Stripe's privacy policy.

Sanity, which hosts our content and the records of orders, newsletter subscribers, and contact messages.

Vercel, which hosts the website. Analytics and performance data are sent to Vercel only after you accept.

The email provider we use to send order, shipping, and newsletter messages.

Professional advisers or public authorities, only when needed to comply with the law or to defend a claim.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Transfers outside the EEA

Some providers may process data outside the European Economic Area, including in the United States. Where that happens, we rely on an approved safeguard, such as an adequacy decision or Standard Contractual Clauses.

How long we keep it

Order and invoicing data: up to 6 years, to meet accounting and tax duties.

Newsletter data: until you unsubscribe. We then keep the address marked as unsubscribed so we do not write to you again.

Contact messages: for as long as needed to handle the request, and then deleted or archived if a legal duty requires it.

Analytics: only while your consent lasts. Voucher cookies last up to 1 year. Consent preference stays in your browser until you clear site data.

Your rights

If you are in the EEA or the United Kingdom, you can ask us to access, correct, delete, or restrict your data, to receive a portable copy, and to object to processing based on legitimate interests, including direct marketing. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already took place.

Email issatintaypunto@gmail.com. We may ask for enough information to confirm it is you.

You can also complain to the Spanish Data Protection Agency (aepd.es) or to the authority of the country where you live.

Residents of U.S. states with privacy laws can email the same address to request access, correction, or deletion. We will not discriminate against you for making a request. We do not sell personal information and we do not respond to browser Do Not Track signals; use the cookie banner instead.

Cookies

Essential storage keeps checkout and vouchers working. Optional analytics run only if you accept them in the banner. Details, durations, and how to reject them are in the cookie policy.

Children

The site is not directed at children under 14, which is the age of digital consent in Spain. Purchases require legal capacity to contract, or a parent or guardian. If you believe we have collected a child's data without the required consent, email us and we will delete it.

Security

We use technical and organizational measures appropriate to this site, including HTTPS and payment handling by Stripe. No internet transmission is completely secure, and we cannot guarantee absolute security.

Changes

If we change this policy in a material way, we will update the date above and post the new version here. The version on the site is the one that applies.