Privacy policy

Data controller

Controller: Artcreatiu, tax ID (NIF) 47724617P. Contact email to exercise rights and privacy enquiries: info@artcreatiu.com.

Data we process

We may process the following categories of data: identification and contact data (name, surname, email, phone, postal address), user account data, order and billing data, payment data (handled by payment gateways; Artcreatiu does not store full card details), browsing data and cookies (as per the cookie policy), and communication data (contact forms, newsletter, reviews).

Purposes of processing

To manage user registration and the contractual relationship arising from purchases; process orders, shipments, returns and customer service; manage payments and invoicing; send commercial communications where consent exists or under applicable law; analyse website use through analytics cookies, only with your consent; comply with legal obligations in tax, accounting and consumer matters.

Legal basis for processing

Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR) to manage purchases and user accounts. Data subject consent (Art. 6.1.a GDPR) for newsletter, non-essential cookies and optional marketing. Legitimate interest (Art. 6.1.f GDPR) to prevent fraud, ensure site security and improve the shopping experience. Compliance with legal obligations (Art. 6.1.c GDPR) in tax and consumer protection matters.

Retention periods

Customer and order data: for the duration of the commercial relationship and thereafter for legally required periods (generally 5 years for tax purposes and up to 6 years for commercial records). Inactive account data: deleted or anonymised when no longer needed. Newsletter data: until you unsubscribe. Cookie data: as stated in the cookie policy. Contact and withdrawal forms: as long as needed to handle the request and, where applicable, demonstrate its processing.

Recipients and processors

Data may be shared with providers delivering services necessary for our activity (hosting, payment gateways, carriers, email marketing and web analytics tools), always under contracts ensuring GDPR compliance. Data will not be transferred to third parties for their own purposes without a legal basis.

International transfers

Some providers (e.g. Google or Meta for analytics and advertising, where you have given consent) may process data outside the European Economic Area. In such cases, safeguards under the GDPR apply, such as standard contractual clauses approved by the European Commission.

Data subject rights

You may exercise the rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw consent at any time, by emailing info@artcreatiu.com stating the right you wish to exercise and proving your identity. You also have the right not to be subject to decisions based solely on automated processing. We will respond within one month.

Complaint to the supervisory authority

If you believe that the processing of your data does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

Security measures

Artcreatiu applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, taking into account the inherent limitations of the Internet.

Minors

Artcreatiu services are intended for persons aged 18 or over. We do not knowingly collect data from minors without parental or guardian consent.

Changes

Artcreatiu reserves the right to modify this privacy policy to adapt it to regulatory or business changes. The current version will always be published on this page.