Privacy policy

Data controller

The data controller is Eva Canosa Lista, trading as Galencaixe.

Spanish tax identification number (NIF): 78805988F. Address: Lugar As Casillas 61, 15680 Ordes, A Coruña, Spain.

For enquiries and to exercise your rights: hello@galencaixe.com. No data protection officer (DPO) is currently appointed.

Purposes and legal bases

Galencaixe processes personal data only for the purposes needed to provide its B2C online shopping services:

• Orders and after-sales support: To manage orders, payments, physical or digital deliveries and after-sales support: performance of the contract.
• User accounts: To create and manage your account and provide the requested service: performance of the contract and management of the requested service.
• Contact and support: To handle and respond to your enquiry or reported problem. The legal basis is handling your request and, where it relates to an order or service, performing or managing the contractual relationship. The form is not used as a request for blanket consent.
• Billing and obligations: To manage invoicing, accounting and compliance with applicable obligations: legal obligation.
• Fraud, security and claims: To prevent fraudulent use, maintain security and defend rights in response to claims: legitimate interest or legal obligation, where applicable.
• Google Analytics: To analyze website use only where valid cookie consent has been given, within its scope and period of validity.
• Shop news by email: To send shop news by email only to customers who tick the optional box at checkout: consent, which can be withdrawn at any time by emailing hello@galencaixe.com.

Categories of data

• Identification and contact details.
• Details needed for your order and delivery.
• User account information.
• Payment information limited to references or status received from the provider. The shop does not process full card details.
• Support communications.
• Technical data strictly necessary for security and for the service to function.

Special categories of data are not deliberately collected.

Recipients and service providers

To provide the service, Galencaixe may share necessary data with, or allow access to it by, the following providers and recipients:

• Hetzner, for server infrastructure, website hosting and databases.
• Stripe, for payments and payment methods offered through Stripe.
• MXroute, for email.
• Sentry (Functional Software, Inc.), for technical error diagnostics, with data storage in the European Union.
• Correos or other carriers shown for, or applicable to, your order, for deliveries.
• Google, only for Google Analytics where you have given consent.
• Public authorities, courts or competent bodies where required by law.

International transfers

Some providers may process data outside the European Economic Area. Where this happens, Galencaixe will apply the mechanisms and safeguards required by law for these transfers.

Retention

• Orders, invoices and related documents: for the periods required by tax, accounting and contract law, and as long as needed to defend against claims.
• User account: while it remains active and afterwards for the periods needed to meet legal obligations or handle claims. You can request account deletion by getting in touch. Information that must be kept by law will be retained or blocked from use.
• Contact and support: for as long as needed to handle your request, and afterwards for a reasonable period to address any resulting liabilities.
• Google Analytics: according to the configured retention periods and valid consent.

Your rights

You can request access to, correction or deletion of your data, object to its processing, request restricted processing and, where applicable, data portability. Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of earlier processing.

To exercise your rights, email hello@galencaixe.com with your request and the information needed to verify it.

You also have the right to complain to the Spanish Data Protection Agency (AEPD).

Children

The services are not specifically aimed at children, and there is no intention to deliberately collect their data beyond what is legally permitted.

Automated decisions

Galencaixe does not currently make decisions based solely on automated processing that have legal or similarly significant effects on you.

Security

Galencaixe applies reasonable technical and organizational measures, appropriate to the risk, to protect data against unauthorized access, loss, alteration or improper disclosure. These measures are reviewed and updated when needed.

Error diagnostics with Sentry

I use Sentry (Functional Software, Inc.), with data storage in the European Union, to detect technical shop failures. Reports contain the error location in the code, the website version and the failed operation. Original messages, private URLs, cookies, forms and customer and order data are filtered before sending.

Server diagnostics rely on the legitimate interest in keeping the shop available and secure. Sending errors from your browser is optional and starts only if you accept ‘Error diagnostics (Sentry)’ in cookie settings. You can withdraw this choice there at any time, independently of Analytics.

I do not record sessions or create visitor identifiers with Sentry. The provider receives your IP during the connection, but the project is configured not to store it in events. Event history is 30 days on the free plan; during the initial trial the provider may retain events for up to 90 days. I do not keep a separate archive.

Updates

This policy may be updated when processing activities, providers or legal requirements change. The date of the latest update will appear at the start of the document.