Legal information

Privacy Policy

DRAFT — not published, not linked. Contains [PENDING] placeholders to be completed with real data and requires legal review before publishing.

1. Data Controller

The controller responsible for processing the personal data collected through this website (hogarlab.shop) is:

  • Legal name: [PENDING: full legal/company name of the entity that owns hogarlab.shop]
  • Tax ID (NIF/CIF): [PENDING: NIF or CIF]
  • Registered address: [PENDING: full registered address]
  • Contact email: [PENDING: contact email for privacy/data protection matters]
  • Contact phone: [PENDING: phone number, if this channel is offered]

2. Purpose of data processing

At Hogarlab we process the information provided by data subjects for the following purposes:

  • Managing the purchase, processing, shipping and invoicing of orders placed in the store.
  • Handling queries, requests and complaints submitted through the contact forms.
  • Managing the customer account, when the user chooses to create one.
  • [PENDING: are newsletters or commercial email communications sent? If so, add: “Sending commercial communications and newsletters about products, offers and news, provided the user has given explicit consent to do so.”]
  • [PENDING: is remarketing/retargeting done with Meta Ads, Google Ads, TikTok Ads? If so, add the purpose of personalized advertising based on browsing behavior.]
  • Carrying out statistical analysis of website usage to improve the user experience and the product catalog.
  • Complying with the legal and tax obligations applicable to online sales activity (invoicing, accounting, fraud prevention).

3. Legal basis

The legal basis for processing the data is:

  • Performance of a contract: for managing orders, shipping and invoicing, since the processing is necessary to provide the purchase service requested.
  • Consent of the data subject: for sending commercial communications/newsletters and for the use of non-essential cookies (analytics, advertising), consent which the user may withdraw at any time without affecting the lawfulness of processing carried out prior to withdrawal.
  • Legitimate interest of the controller: for fraud prevention and website security.
  • Compliance with a legal obligation: for retaining the tax and accounting documentation required by Spanish tax and commercial law.

4. Data recipients

In order to provide the service, certain data is shared with the following third parties, only to the extent necessary for the purpose indicated:

  • Payment gateway: [PENDING: name of the payment provider, e.g. Stripe, PayPal, Redsys] — processes payment data directly; Hogarlab does not store full card details on its own systems.
  • Shipping/logistics company: [PENDING: name of the carrier(s) used] — receives the name, address and phone number necessary to make the delivery.
  • Email marketing tool: [PENDING: if applicable, name of the tool used for newsletters, e.g. Mailchimp, Klaviyo]
  • Web analytics tools: [PENDING: confirm whether Google Analytics, Meta Pixel, TikTok Pixel, Hotjar or others are installed — each receives browsing data in anonymized or pseudonymized form depending on its configuration]
  • Hosting provider: Hostinger, where the website’s technical infrastructure is hosted.
  • Personal data is not sold or transferred to third parties for purposes other than those described here.

5. User rights and how to exercise them

Any individual has the right to obtain confirmation as to whether Hogarlab is processing personal data concerning them, and in particular has the right to:

  • Access: find out what personal data we process about you.
  • Rectification: request the correction of inaccurate or incomplete data.
  • Erasure (“right to be forgotten”): request the deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
  • Objection: object to the processing of your data in certain circumstances, in particular regarding its use for direct marketing purposes.
  • Restriction of processing: request the restriction of processing of your data in certain cases.
  • Portability: receive your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller.

To exercise these rights, you may write to [PENDING: contact email], indicating the right you wish to exercise and attaching a copy of a document proving your identity. Likewise, if you believe your rights have not been properly addressed, you have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).

6. Retention period

Personal data will be retained:

  • For as long as the business relationship with the customer is maintained and, after it ends, for the periods legally required to address any liability arising from the processing (generally, data with tax relevance is kept for the statute-of-limitations period for tax obligations, currently 4 years in Spain, although commercial documentation may need to be kept for 6 years under the Commercial Code).
  • Data processed on the basis of consent (for example, for newsletters) will be retained until the data subject withdraws that consent.
  • [PENDING: confirm whether a specific retention period different from the above applies, per the company’s internal policy]

7. Source of the data

The personal data processed by Hogarlab comes directly from the data subject, through:

  • The account-creation and/or checkout form of the online store.
  • The website’s contact form.
  • Voluntary subscription to the newsletter, where applicable.

No personal data is collected from sources other than the data subject, except for technical browsing data automatically collected by the analytics tools mentioned in section 4.

8. International data transfers

[PENDING: confirm whether any of the providers mentioned above (payment gateway, analytics/email marketing tools) stores or processes data on servers outside the European Economic Area. If so, the destination country and the safeguards applied must be detailed here (e.g. European Commission standard contractual clauses, EU-US Data Privacy Framework, etc.). Many common tools such as Google Analytics, Meta or Mailchimp transfer data to the US, so this section will likely be necessary.]

Last updated: [PENDING: publication date]. This document is a template generated to fit Hogarlab’s activity and does not replace review by a professional qualified in data protection law before publication.