Your data, your rights
Privacy policy
we treat your data with respect
Sample text. This shop is a demo that is for sale: the owner, tax ID, address and payment details are fictitious. Whoever acquires it must replace them with their own and adapt this text to the law of their country with their adviser.
This policy explains how Oro de Sol Boutique collects, processes and protects the personal data of the users of this website, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and any national legislation supplementing it.
1. Data controller
- Owner
- Oro de Sol Boutique
- Tax ID
- 000000000 (fictitious)
- Address
- Calle Ejemplo, 1 · 00000 Ciudad
- [to be configured]
- Website
- orodesol.com
2. Data we collect
We process the personal data you give us when you place an order or contact us:
- Full name
- Full postal address (street, town or city, postcode, region)
- Phone number
- Email address
- Delivery notes or instructions (if you add any)
- Order information and the payment method you choose
We do not process special categories of data (health, beliefs, etc.) and we do not knowingly collect data from minors. If you are under 16 (or the minimum age set by the law of your country), please do not give us your details without the permission of your mother, father or legal guardian.
3. Purpose and legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing your order and delivering it to your home | Performance of a contract (Art. 6(1)(b) GDPR) | Until the order is fulfilled and for the duration of the legal guarantee period |
| Meeting tax and accounting obligations (invoicing) | Legal obligation (Art. 6(1)(c) GDPR) | The period required by the applicable tax and commercial legislation |
| Answering any enquiries you send us | Consent (Art. 6(1)(a) GDPR) | Until the enquiry is resolved + 1 year |
| Sending you news by email, if you sign up | Consent (Art. 6(1)(a) GDPR) | Until you unsubscribe (every email includes a link to do so) |
4. Recipients (who we share your data with)
We do not sell or pass on your data to third parties for commercial purposes. We only share it with the providers that are strictly necessary for your order to work:
- Netlify, Inc. — website hosting and receipt of orders.
- Resend — sending order confirmation emails.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing, when you choose to pay by PayPal.
- Courier company — to deliver your order. It only receives the essential details.
- Banks — when you pay by bank transfer, your bank and ours process the transaction data.
- Tax adviser or accountant — to meet our accounting obligations, under a duty of confidentiality.
5. International transfers
Some providers (for example, Netlify or Resend) may process data outside the European Economic Area. In those cases appropriate safeguards apply, such as the European Commission's standard contractual clauses, so that your data remains protected to the same standard.
6. Your rights
You can exercise the following rights at any time:
- Access — find out what data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted when it is no longer needed.
- Objection — object to a specific type of processing.
- Restriction — ask us to restrict processing while something is being checked.
- Portability — receive your data in a structured, reusable format.
- Withdrawal of consent — where processing is based on consent, without retroactive effect.
To exercise them, write to us at the email address above, identifying yourself appropriately. If you feel we have not handled your request properly, you can lodge a complaint with the data protection authority of your country of residence, of your place of work or of the place of the alleged infringement.
7. Security
We apply reasonable technical and organisational measures to protect your data: an HTTPS connection, restricted access to the order panel and providers that comply with the GDPR. Even so, no transmission over the Internet is 100% secure; if you notice anything unusual, please let us know.
8. Cookies and local storage
This website does not use third-party advertising or analytics cookies. To make the shopping basket work, we store its contents in your browser's localStorage (only on your device; that information never reaches us). You can clear it at any time from your browser settings.
9. Changes to this policy
We may update this policy when necessary. The date of the latest update appears at the top of this document.