Start here: what you can ask us to do
Most privacy notices bury your rights at the bottom. Here they are first, because they are the part that matters to you.
Write to support@gardy-craft.com and you can require us to hand over a copy of everything we hold about you, correct anything wrong, delete it where the law allows, pause our use of it while a dispute is settled, hand it to another company in a portable format, or stop entirely where we are relying on our own legitimate interests. Where you gave consent, you can take it back whenever you like.
We answer inside one month. Genuinely complicated requests can take a further two, and if that happens we will tell you why before the first month is out. None of it costs anything. We may ask you to prove who you are first, since handing your file to the wrong person would be the worse failure.
Unhappy with how we handled it? The Spanish regulator is the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, aepd.es. You may also go to the authority where you live or work anywhere in the EU. Coming to us first is welcome but never required.
Who is asking
The company answerable for your data is FLOFUM, S.L., registered at Calle Parcerisa 13, Local 1, 08014 Barcelona, Spain, CIF B75621250. Everything here follows Regulation (EU) 2016/679 and Spanish data protection law. Our processing is nowhere near the scale that requires a data protection officer under Article 37, so we have not appointed one — questions come to the address above and a person answers them.
The short answer on what we hold
Ordering means telling us your name, where the parcel is going, an email address and a phone number — enough for a courier to find you and for us to ring before dispatch. Placing the order creates a record of it: what you bought, what it cost, what the courier collected, where the parcel got to.
Asking for a refund means giving us an IBAN, because a courier took cash and there is no card to credit. That banking detail is deleted the moment the transfer clears and the accounting entry closes — we have no reason to keep it and no wish to.
Writing to us leaves correspondence. Visiting the site leaves the usual technical trace in a web server log: an IP address, which browser and device, which page sent you. If you accepted the measurement cookies, we also see which pages were read and in what order — aggregated, never tied to you by name.
What we never hold is card data. Not because we protect it especially well, but because none is ever created: the only way to pay us is cash to a courier, so no card number, CVV or banking credential passes through this website at any point.
Nothing here is knowingly collected from anyone under 16. Tell us if you think otherwise and it goes.
Why we are allowed to use it
Four grounds cover everything we do.
Because we have a contract with you. Taking the order, ringing to confirm it, getting it delivered, and dealing with returns, refunds and warranty claims afterwards. Without this data none of that can happen.
Because the law says so. Invoices and accounting records are kept for six years, which Spanish commercial law requires of us whether we like it or not.
Because we have a legitimate interest. Replying to an enquiry that never becomes an order, and keeping the site secure against fraud and abuse. We have weighed that against your rights and concluded it does not override them — and you can object at any time regardless.
Because you agreed. Measurement cookies and marketing email, and nothing else. Both are off until you say otherwise, and you can withdraw at any point without unpicking what was lawful beforehand.
Where it goes
Your data is never sold and never shared for another company's marketing. It reaches four kinds of recipient and no others:
- The courier gets your name, address and phone number, because otherwise the parcel arrives nowhere.
- Our hosting and IT suppliers hold the site and its data, strictly on our instructions.
- Our accountants see order records, for invoicing and statutory filing.
- A public authority gets whatever a valid legal obligation compels — and nothing on a casual request.
Everyone in that list works under a written contract binding them to our instructions and to keeping the data secure. Where any of them processes data outside the European Economic Area, an appropriate Chapter V safeguard is in place — an adequacy decision or Standard Contractual Clauses. Ask which one covers a given transfer and we will tell you.
How long any of it survives
Order records and invoices: six years, because Spanish commercial law says so. Refund bank details: gone as soon as the money has moved. An enquiry that never became an order: two years from the last thing either of us said. Server logs: twelve months. Measurement data: fourteen months. A record that you consented to marketing: for as long as the consent stands, then three years as proof it was freely given.
When a period runs out the data is deleted outright or stripped of anything that could identify you.
Keeping it safe, honestly described
The site runs over HTTPS throughout, staff access is limited to those whose job needs it, and the platform is kept patched. That is a reasonable standard and it is what Article 32 asks for.
What it is not is a guarantee. No transmission across the internet is perfectly secure and anyone who tells you otherwise is selling something. If a breach ever occurs that is likely to put your rights at serious risk, we will tell you and the regulator, as Articles 33 and 34 require.
Two things we do not do
No automated decision-making or profiling that produces legal effects for you or anything similarly significant. No decision about you is taken by a machine alone.
No responsibility for other people's websites. We link out occasionally; those sites have their own notices and their own standards, and this one does not extend to them.
Cookies, separately
Handled in full on the Cookie Policy page, including how to change your mind after the fact.
Changes
Revised whenever our processing or the law moves. The current version always sits here with the date it took effect, and anything material gets flagged on the site rather than slipped in quietly.