Privacy policy

Who is responsible

Controller

Mercedes García Pérez (Hilos de Bruja)

Spanish tax ID (NIF)

75135036Q

Address

Calle Rodríguez de la Fuente, 12, Bajo A, 18110 Las Gabias (Granada), Spain

Contact

hola@hilosdebruja.com

I am one person working alone. There is no data protection officer because the law does not require me to appoint one, so this is on me.

What I collect and why

Preparing and shipping your order

Name, email, delivery address and order details. Legal basis: performance of the sales contract. Without this I cannot send you anything.

Tax and accounting duties

Invoicing details and amounts. Legal basis: my legal obligations.

Taking payment

Payment is processed by Stripe on their own gateway. I never see or store your card number.

Handling a commission

Whatever you tell me about the piece you want. Legal basis: performance of the contract.

Answering you if you write

Your email and your message. Legal basis: your consent in writing to me, or the legitimate interest in replying to enquiries.

Publishing your testimonial

Your name or initial and what you wrote. Legal basis: your express consent, which you tick yourself and can withdraw at any time.

Telling you about the next piece

Your email, only if you sign up. Legal basis: your consent. Every email carries an unsubscribe link.

I do not collect data I do not need and I do not buy lists from anyone. Everything I hold, you gave me.

How long I keep it

• Orders and invoices: 6 years from the transaction, as the Spanish Commercial Code requires, and 4 years for tax purposes.
• Email enquiries: 1 year after the matter is closed, unless it becomes an order.
• Testimonials: while they remain published. Withdraw consent and they come down.
• Mailing list: until you unsubscribe.

Who else sees your data

I do not sell, rent or hand over your data to anyone. To operate I rely on a few providers, who may only process it on my instructions and under a signed processing agreement:

Stripe

Card payments. They are the controller of their own payment data.

Vercel

Website hosting.

Sanity

The content system where the catalogue lives.

Resend

Sending confirmation emails.

Courier

Only your name and address, so the parcel can reach you.

Tax authorities and courts may also gain access where the law requires it.

Data leaving Europe

Some of those providers are US companies. Where that means data leaves the European Union, the transfer relies on the Standard Contractual Clauses approved by the European Commission or on the EU-US Data Privacy Framework, depending on the provider. Ask me and I will send you the specific safeguards.

What you can demand

• Access the data I hold about you.
• Correct it if it is wrong.
• Have it erased once there is no reason to keep it.
• Restrict or object to my use of it.
• Take it elsewhere in a machine-readable format.
• Withdraw your consent at any time, without affecting what was done before.

For any of these, write to hola@hilosdebruja.com from the address you ordered with, or to my postal address. I reply within a month at the latest, and usually much sooner.

If you think I have got it wrong, you may complain to the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid) or to your own national authority. But write to me first: almost everything sorts itself out that way.

Two more things

I make no automated decisions about you and build no profiles. There is no algorithm behind this deciding anything.

This shop is not aimed at children under 14 and I do not knowingly collect their data.