Privacy policy

Controller:

Miguel Ángel Ortega García (NIF 25705128Y) · C/ Canal 44, 29140 Málaga · +34 689 421 262 · info@gravelplus.es · No DPO appointed (Art. 37.1 GDPR).

Data processed & legal basis

Customers & orders: name, email, address, phone, NIF, order data, IBAN (exceptionally) · Performance of contract + legal obligation (Art. 6.1.b/c GDPR) · Retained 6 years.

Marketing (newsletter): email · Consent (Art. 6.1.a GDPR) · Until unsubscribed.

Suppliers: contact details · Legitimate interest (Art. 6.1.f GDPR) · 6 years.

Website/contact form: name, email, IP · Legitimate interest · 1 year.

Processors

Shopify Inc., Google Ireland Ltd., Ayuda T Soluciones Profesionales SL, logistics provider (Germany), WhatsApp Ireland Ltd. (pending). Data may be disclosed to tax authorities, financial institutions and couriers as required by law.

International transfers

Google Ireland Ltd. and WhatsApp Ireland Ltd. may process data outside the EEA under EU Standard Contractual Clauses and EU-US Data Privacy Framework (Decision 2023/1795).

Cookies

First-party technical cookies only (session, cart, language/currency). Exempt from consent under Art. 22.2 LSSI-CE. No analytics or advertising cookies.