PRIVACY POLICY

This Privacy Policy describes how MIJAS HANDICRAFTS SL (referred to as “the Company”, “we”, “us”, or “our”) collects, uses, and discloses your personal information when you visit or make a purchase from www.craftmijas.com (the “Site”).

1. Data Controller

The data controller responsible for your personal information is:

• Company Name: MIJAS HANDICRAFTS SL
• Registration Number (CIF): B93384196
• Registered Address: PLAZA DE LA CONSTITUCION 1, Mijas, Málaga, 29650, Spain
• Email: support@craftmijas.com
• Telephone: +34 952 59 02 90

2. Personal Information We Collect

When you interact with the Site, we collect certain information necessary to process your orders and provide a functional browsing experience:

• Order Information: This includes name, billing address, shipping address, payment information (processed securely), email address, and phone number.
• Device Information: This includes version of web browser, IP address, time zone, and cookie information to ensure the technical stability of our platform.

3. Legal Basis for Processing

In accordance with the GDPR, we process your personal data under the following legal bases:

• Performance of a Contract: To fulfil your order and manage the delivery of our products.
• Legal Obligation: To comply with tax, accounting, and regulatory requirements in Spain and the European Union.
• Legitimate Interests: To maintain the security of our Site and improve our commercial offerings.

4. Payment Processing and Stripe

To provide a reliable purchasing environment, all payment transactions are handled by our third-party payment processor, Stripe.

• Stripe collects and processes your payment card data according to its own privacy policy.
• Your payment details are encrypted using industry-standard protocols. MIJAS HANDICRAFTS SL does not store or have access to your full credit card number or sensitive authentication data.
• For further information on how Stripe handles your data, please refer to the Stripe Privacy Policy.

5. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Transaction Records: Under Spanish Commercial and Tax Law, we are required to retain transaction-related data (invoices, proof of payment) for a period of six (6) years.
• Communication Data: General enquiries are retained for the duration of the correspondence and for a reasonable period thereafter to ensure continuity of service.

6. Disclosure of Personal Information

We share your personal information with service providers to help us provide our services and fulfil our contracts with you, as described above. For example:

• Logistics Partners: To deliver your purchased goods to your specified address.
• Payment Services: Specifically Stripe, to facilitate the secure settlement of funds.
• Regulatory Authorities: When required by law or to protect our legal rights.

7. International Data Transfers

Where your data is transferred outside of the European Economic Area (EEA), we ensure that appropriate safeguards are in place (such as Standard Contractual Clauses approved by the European Commission) to ensure your data remains protected to an equivalent standard as within the EU.

8. Your Rights Under GDPR

As a resident of the European Union, you have the following rights regarding your personal data:

• The Right of Access: To request copies of your personal data.
• The Right to Rectification: To request that we correct any information you believe is inaccurate.
• The Right to Erasure: To request that we erase your personal data, under certain conditions.
• The Right to Restrict Processing: To request that we restrict the processing of your personal data.
• The Right to Data Portability: To request that we transfer the data we have collected to another organisation.
• The Right to Object: To object to our processing of your personal data.

To exercise any of these rights, please contact us at support@craftmijas.com.

9. Security

We implement robust technical and organisational measures intended to protect your personal data against unauthorised access, loss, or alteration. While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage can be claimed as entirely infallible.

10. Contact Us

For more information about our privacy practices, or if you have questions or concerns, please contact us via the details provided in Section 1. If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD).