Privacy policy

PRIVACY POLICY

1. Data Controller

2. Purposes and Legal Basis for Data Processing

At DESTANTS, we process personal data provided by users for the following purposes and under the following legal bases:

  1. Management and Execution of Purchase Contracts:

    • Purpose: Processing orders, managing payments, issuing invoices, handling shipments, and managing returns or customer service inquiries.

    • Legal Basis: Performance of a contract to which the data subject is party (Art. 6.1.b GDPR).

  2. Customer Care and Inquiries:

    • Purpose: Responding to requests for information, questions, or suggestions submitted via email or contact forms.

    • Legal Basis: Legitimate interest in serving our customers and website visitors (Art. 6.1.f GDPR).

  3. Commercial Communications and Newsletter:

    • Purpose: Sending newsletters, updates, exclusive offers, and product launch announcements.

    • Legal Basis: Prior, explicit consent provided by the user upon subscription (Art. 6.1.a GDPR). You may revoke your consent at any time via the unsubscribe link included in every email.

  4. Fraud Prevention and Website Security:

    • Purpose: Detecting and preventing fraudulent transactions or unauthorized site activity.

    • Legal Basis: Legitimate interest (Art. 6.1.f GDPR) and compliance with legal obligations regarding secure payments.

3. Data Recipients and Service Providers (Data Processors)

To deliver our services, we share strictly necessary data with external service providers under data processing agreements that guarantee confidentiality and high standards of data protection:

  • E-commerce Platform: Shopify Inc. (website hosting, technical store operations, and product catalog management).

  • Email Marketing & Automations: Klaviyo Inc. (newsletter management and customer email communication).

  • Analytics and Advertising Services: Google Ireland Limited / Google LLC (Google Analytics and marketing campaigns).

  • Secure Payment Gateways: Klarna Bank AB and PayPal (Europe) S.à r.l. (payment processing). Payment platforms act as data controllers/co-controllers for credit checks and fraud prevention.

  • Logistics and Shipping Companies: Courier agencies (e.g., Correos, SEUR, DHL, or other logistics partners) for physical order delivery to the address provided by the user.

4. International Data Transfers

Some of our primary technology providers are located or store data outside the European Economic Area (EEA), mainly in the United States and Canada.

To ensure a level of data protection equivalent to that required by the GDPR, DESTANTS operates exclusively with providers offering full legal safeguards:

  • Shopify: Based in Canada (recognized by the European Commission as providing an adequate level of data protection) and Shopify Inc. in the US certified under the EU-US Data Privacy Framework (DPF) and bound by Standard Contractual Clauses (SCCs).

  • Klaviyo Inc.: Certified under the EU-US Data Privacy Framework (DPF) and bound by Standard Contractual Clauses (SCCs).

  • Google LLC: Certified under the EU-US Data Privacy Framework (DPF).

5. Data Retention Periods

  • Purchase and Billing Data: Retained for the statutory period required by Spanish commercial and tax law (minimum of 5 to 6 years).

  • Newsletter and Marketing Subscriber Data: Retained as long as the user does not request erasure or unsubscribe.

  • Direct Inquiries: Retained for the time necessary to resolve the query and for a subsequent period to handle any legal liabilities.

6. Users' Rights

Any user may exercise the following rights recognized under the GDPR free of charge:

  • Access: Request confirmation on whether we are processing personal data concerning you.

  • Rectification: Request the correction of inaccurate or incomplete data.

  • Erasure ("Right to be forgotten"): Request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected.

  • Objection: Object to the processing of your data for direct marketing purposes or based on legitimate interest.

  • Restriction of Processing: Request the temporary suspension of data processing under legally established conditions.

  • Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.

To exercise these rights, please send a written request along with proof of identity to shop@destants.com with the subject line "Data Protection".

If you consider that your data rights have been infringed, you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es (C/ Jorge Juan, 6, 28001 – Madrid, Spain).