Política de privacidad

Privacy policy

This policy explains what we do with your personal data, why, and what you can demand of us. It is written to comply with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018.

What we collect, why, and on what legal basis

Data	Why we have it	Legal basis
Name, delivery and billing address, email, phone	To process your order, deliver it, invoice it and deal with returns	Performance of the contract
Order history and payment confirmation	To handle guarantees, refunds and accounting	Contract, and our legal obligations
Messages you send us	To answer your question and keep a record of what we told you	Contract, or our legitimate interest in supporting customers
Email address for our newsletter	To send you occasional product news, only if you asked for it	Your consent, which you may withdraw at any time
Invoicing and tax records	Because Spanish tax and accounting law requires us to keep them	Legal obligation
Device, browser, IP address and pages viewed	To keep the store working and secure, and to understand which explanations are unclear	Legitimate interest, and consent for non-essential cookies

We do not make automated decisions that produce legal effects for you, and we do not build profiles that do.

Who else sees your data

Only those who need it to get your order to you:

Shopify, which hosts this store and runs the checkout.
Payment providers, which process your payment. They receive your card details directly; we never do.
Our supplier and fulfilment partner, which packs and ships your order and therefore receives your name and delivery address. Some of our suppliers are outside the European Union.
Carriers, which deliver the parcel and need your address and usually a contact detail for delivery notifications.
Our accountant and tax authorities, for invoicing and tax obligations.
Analytics and advertising providers, where you have consented to non-essential cookies.

We do not sell your personal data, and we never pass your address to anyone for their own marketing.

Transfers outside the European Union

Some of the providers above are established outside the European Economic Area, including in the United States. Where your data is transferred there, we rely on a valid transfer mechanism under Chapter V of the GDPR: an adequacy decision of the European Commission, or Standard Contractual Clauses, together with additional safeguards where they are needed. You may ask us for details of the mechanism used for a specific provider.

How long we keep it

Order and invoicing data: for the periods required by Spanish tax and commercial law, which are up to six years.
Support messages: up to three years after the matter is closed.
Newsletter subscription: until you unsubscribe.
Cookie and analytics data: for the retention period stated in our cookie policy.

Your rights

You can ask us at any time to:

tell you what data we hold about you, and give you a copy;
correct anything that is wrong;
delete your data, where we are not legally obliged to keep it;
restrict or object to how we use it;
transfer it to another provider in a machine-readable format;
withdraw consent you gave us, without affecting what we did lawfully before you withdrew it.

Write to helpandsupportdrivetrim@gmail.com . We will reply within one month. We may need to confirm your identity first, which protects you as much as us. Exercising any of these rights is free and we will never treat you differently for it.

If you think we have handled your data badly, tell us first so we can fix it. You also have the right to complain to the Spanish Data Protection Agency, the Agencia Española de Protección de Datos, at www.aepd.es, or to the supervisory authority of the EU country where you live.

Security

The store runs over an encrypted connection and payments are handled by certified payment providers. No system is perfect, so please do not send us card numbers or other sensitive details by email — we will never ask you to.

Children

This store is not intended for children and we do not knowingly collect data from them. If you believe a child has given us personal data, write to us and we will delete it.