Política de privacidad

 

This Privacy Policy describes how reddressx.shop handles personal information when you visit our storefront, place an order, communicate with us, or request support. In this policy, “we,” “us,” and “our” mean the business operating reddressx.shop. Contact details for privacy questions and requests appear below.

1. Information We Collect

• Contact and delivery information: your name, email address, telephone number, billing address, and shipping address.
• Order information: products purchased, order identifiers, amounts paid, delivery status, and records of cancellations, returns, or refunds.
• Payment-related information: payment status, transaction references, and limited payment-method information made available by the payment provider. Payment credentials supplied at checkout are handled by the payment service involved in the transaction.
• Communications: messages, attachments, product-issue descriptions, and other information you choose to provide when contacting us.
• Technical and usage information: IP address, browser and device details, pages requested, timestamps, and identifiers needed to maintain a session, operate the cart, and protect checkout.

We obtain information directly from you, automatically through operation of the storefront, and from providers handling payments, hosting, fulfillment, delivery, and fraud prevention. Please provide only information relevant to your request and avoid sending passwords or complete payment-card details by email.

2. Purposes and Lawful Bases

We process personal data to form and perform contracts, take requested pre-contract steps, process payments, deliver orders, handle returns and support, prevent fraud, maintain security, keep tax and accounting records, and defend legal claims. Bases may include Article 6(1)(b) GDPR for contract, Article 6(1)(c) for legal obligations, Article 6(1)(f) for proportionate legitimate interests, and Article 6(1)(a) for consent.

Consent must be freely given, specific, informed, and unambiguous and may be withdrawn without affecting earlier processing. We document legitimate-interest balancing where appropriate and do not label unnecessary processing as contractually required.

3. Recipients of Information

We disclose relevant information to service providers that support the storefront and order process, including Shopify as our commerce platform, payment processors, delivery carriers, fulfillment providers, technical-support providers, and professional advisers. We limit disclosures to the functions involved and applicable legal requirements.

Information may also be disclosed when reasonably necessary to comply with a valid legal demand, protect legal rights, investigate fraud, or address security incidents. If the business is transferred or reorganized, relevant records may be transferred subject to appropriate protections and any required notice.

Shopify and payment providers may process certain information for their own legal, security, and service purposes. Their separate notices explain those activities. See Shopify's Privacy Policy and Shopify's privacy controls. Your purchase contract remains with our store.

4. Cookies, Terminal-Equipment Access, and Advertising

The storefront may use cookies, pixels, local storage, software development kits, and similar technologies. Under Article 22.2 LSSI, non-essential storage or access on a user’s device requires clear and complete information and valid consent; strictly technical operations necessary to transmit a communication or provide a service expressly requested by the user may be exempt.

Non-essential analytics, advertising, profiling, or cross-site tracking must remain disabled until consent. The banner should offer accept and reject choices at the same time, level, and visibility, support granular choices, record consent, and make withdrawal as easy as acceptance, consistent with AEPD guidance.

Actual Shopify apps, pixels, consent settings, enhanced services, and cookie lifetimes were not verified. This draft therefore does not claim the store sells personal data, avoids targeted advertising, or uses any specific tracker. Complete a live cookie inventory and consent test before publication.

5. Retention and Security

We retain information for as long as reasonably needed for the purposes described above, including order support, accounting, tax requirements, fraud prevention, and the establishment or defense of legal claims. Retention depends on the information's nature, the transaction, applicable obligations, and any unresolved dispute. Information no longer required is deleted or de-identified where appropriate.

We use reasonable safeguards intended to protect personal information. No method of transmission or storage is completely secure. Please contact us if you believe an order or communication associated with our store has been compromised.

6. Privacy Requests and Complaint Procedure

Subject to GDPR conditions and exemptions, individuals may request access, rectification, erasure, restriction, portability, or objection; withdraw consent; and request safeguards concerning qualifying automated decisions. Email info@reddressx.shop. We may request proportionate identity or authority evidence.

Under Article 12 GDPR, we respond without undue delay and normally within one month. Where necessary because of complexity or number, that period may be extended by two further months, with notice and reasons within the first month. Requests are normally free; any lawful fee or refusal for manifestly unfounded or excessive requests will be explained.

An internal request does not remove the right to complain to the Spanish Data Protection Agency (AEPD) or seek a judicial remedy.

7. Children and International Processing

The store is not directed to children. Under Article 7 LOPDGDD, a child aged 14 or older may generally consent to personal-data processing unless law requires assistance; for younger children, consent normally requires a parent or guardian. This does not make the store suitable for minors or eliminate product-specific age rules.

Providers may process data outside the European Economic Area. Transfers must rely on a lawful GDPR mechanism, such as an adequacy decision, approved standard contractual clauses with a transfer assessment and supplementary measures, binding corporate rules, or a narrowly applicable derogation.

8. Order Records and the Role of Each Participant

Different participants in a transaction can hold different records. We use the customer and order information available to us to administer the purchase and provide support. A payment provider may separately maintain payment authentication and dispute records, while a carrier may hold routing, delivery, signature, and delivery-photograph information. Their handling of information may be governed by their own notices and legal duties.

A request sent to us covers information for which we are responsible and the assistance we are legally required to obtain from our providers. We will explain when a request concerns a separate provider's independently controlled records. Referring you to a provider does not release us from our own responsibilities for information disclosed through our store.

9. Information Supplied About Other People

You may supply another person's delivery details when arranging a gift or an authorized purchase. Provide only the information needed to complete that request and ensure you have an appropriate reason to provide it. We use a recipient's delivery information for the transaction and related support; receiving a gift does not by itself constitute agreement to receive marketing.

When a person asks about an order placed by someone else, we may need to confirm their authority before revealing information, changing an address, or discussing a payment. Verification should reflect the sensitivity of the action. A request for general product information ordinarily does not require identity verification.

10. Financial Information and Sensitive Details

Checkout may require payment details necessary for the method you select. Do not assume that a payment processor's collection of a card credential means our support team can see the complete credential. We use payment status and the limited transaction information made available to us for order administration, fraud checks, refunds, and dispute resolution.

We do not ask customers to send passwords, complete card numbers, health records, or government identifiers in ordinary support correspondence. If a specific legal or transaction requirement makes additional information necessary, we will explain the purpose and an appropriate method for providing it. Any legally defined sensitive information is handled subject to the limitations applicable to its actual use.

11. Operational Logs and Service Diagnostics

Technical information helps the storefront respond to page requests, maintain a shopping session, detect suspicious activity, and investigate failures. Relevant records may indicate that a checkout request encountered an error without containing the full contents of a payment credential. Access to diagnostic information should be tied to the operational task involved.

12. Preference Choices and Their Effects

Some privacy choices operate at browser level and others relate to an identifiable customer record. Deleting cookies or switching devices may remove locally stored preferences. If you use more than one browser, you may need to manage local cookie settings on each. A browser choice does not necessarily identify every transaction associated with your email address.

You may also contact us directly to explain a privacy concern. We will distinguish an opt-out request from a deletion request or a request to stop promotional email because those actions have different effects. Necessary records may remain after marketing stops, and deleting an order record does not automatically undo a completed financial transaction.

13. Spanish and EU Transparency and Data-Use Disclosures

This notice is intended to meet Articles 12–14 GDPR and Organic Law 3/2018 (LOPDGDD) by explaining the controller, data categories and sources, purposes, legal bases, recipients, retention logic, transfers, rights, complaint route, and consequences of not providing necessary data.

The live notice must match the actual Shopify plan, payment and fulfilment providers, apps, analytics, advertising pixels, customer accounts, and international transfers. We will not describe a provider as a processor, joint controller, or independent controller without checking the actual arrangement.

14. GDPR and LOPDGDD Rights

Applicable rights include access, rectification, erasure, restriction, notification, portability, objection, and protections concerning qualifying automated decisions under Articles 15–22 GDPR, supplemented by the LOPDGDD. The right to object is highlighted where processing relies on legitimate interests or direct marketing.

Rights are not absolute. We may retain information required for tax, accounting, fraud prevention, product safety, legal claims, or another binding obligation. Any limitation will be explained by reference to the applicable rule.

15. Identity Verification and Representatives

We use proportionate verification and do not request more information than reasonably necessary. A representative may act where the law permits and authority can be demonstrated. We may communicate directly with the individual where needed to confirm authority or protect information.

A request is not rejected solely because it arrives by email or does not use a form. Where clarification is reasonably needed to identify the requested information, we will explain what is needed and why. Excessive or manifestly unfounded requests may be handled only as permitted by law.

16. Deletion Exceptions and Corrected Records

A deletion request does not always require erasing every record immediately. Relevant exceptions may permit retention to complete a requested transaction, comply with tax or other legal obligations, prevent fraud, address security incidents, or establish and defend legal claims. We will explain a material exception rather than use recordkeeping as a blanket reason to disregard the request.

A correction can update an inaccurate contact or order-support record while preserving the historical accuracy of an invoice or transaction log where required. We distinguish correcting a fact from altering a valid record of what occurred. If we disagree that information is inaccurate, we will explain the decision and any available review route.

17. Retention by Record Type

Transaction records are retained according to accounting, tax, payment-dispute, and contract requirements. Support records are assessed according to the unresolved issue and the need to demonstrate its resolution. Technical records are assessed according to security and troubleshooting needs. Marketing preferences may need to be retained in a limited suppression record so an unsubscribe request continues to be respected.

These criteria do not create an unlimited retention period. When the relevant need ends, information should be deleted or de-identified subject to lawful exceptions and practical backup handling. Where deletion from a backup is not immediate, the information should not be restored to ordinary use merely to avoid the effect of a valid request.

18. International Requests and Transfers

Personal data may be processed outside the European Economic Area by Shopify, payment providers, carriers, cloud providers, or support services. The live notice must identify actual destinations and mechanisms. Safeguards may include an EU adequacy decision, approved standard contractual clauses, binding corporate rules, or a specific Article 49 GDPR derogation used only where appropriate.

Individuals may request information about relevant safeguards. A provider’s separate notice does not remove our duty to describe our role, assess transfer risk, and implement supplementary protections where needed.

19. Public Reviews and Voluntary Content

If a review or other public-submission feature is available and you choose to publish content, information you include may be visible to other visitors. Avoid posting order numbers, home addresses, phone numbers, payment information, or another person's private details. Private support correspondence is not treated as permission to publish it as a testimonial.

20. Security Concerns and Suspicious Messages

Contact us if you receive a message that appears to misuse our store identity or asks for unexpected sensitive information. Describe the message and provide only the details needed to assess it. Do not open a suspicious attachment or provide a password simply because a message mentions an order number.

Where a security incident affects personal information, we will assess the event and provide notices required by applicable law. This policy is not a guarantee that an incident can never occur. A report to customer service does not require a customer to perform a technical investigation or collect information from someone else's account.

21. Material Changes in Processing

Changes to collection purposes, recipient categories, or advertising practices can require more than editing a date. Before implementing a material new practice, we will provide the information and choices required by applicable law. Previously collected information will not automatically be repurposed merely because a revised policy is posted.

Questions about a policy change may be sent to info@reddressx.shop with the relevant date or paragraph. We will explain the practice at issue and the available request route. If a concern remains unresolved, you may use any complaint or appeal channel available under applicable law without being penalized for doing so.

22. Changes, Controller Contact, and the AEPD

We may update this notice prospectively when processing, providers, law, or store configuration changes. Material changes will be highlighted where required. Earlier processing remains governed by the applicable version and mandatory law.

Controller contact: reddressx.shop, C. BELVIS DE LA JARA 23, 005 IZ, MADRID, MADRID, Spain; info@reddressx.shop. This is a draft storefront identifier, not a substitute for the operator’s legal name and complete address. The legal name or company name, NIF/CIF, legal form and representative, registry data if applicable, telephone or other rapid direct-contact channel, and postcode must be supplied where required before publication.

Individuals may complain to the Agencia Española de Protección de Datos (AEPD). No data protection officer is named because none was provided; identify one if appointment is legally required.