Privacy

This page is a translation of the Spanish version. If the two differ, the Spanish version governs. This does not limit any of your rights as a consumer.

Summary

• Who is responsible: the owner of the shop (details below). There is no data protection officer, because the law does not require one in this case.
• What data we use today: your IP address (to protect the shop from abuse), technical logs and the emails you send us.
• What is not active yet: the news list, customer accounts, orders and payments, order emails, digital downloads and the shop assistant. We describe them below anyway and say in each case that they are not active yet.
• Your rights: you can exercise them by writing to hola@lasmanualidadesdemon.com.
• We do not make automated decisions that have legal effects on you or similarly affect you.

Data controller

Detail	Information
Controller	Montserrat Galán Buján (Las Manualidades de Mon)
Tax ID (NIF)	02266200X
Address	Rúa Emilia Pardo Bazán 29, Planta 2, 32004 Ourense, Spain
Email	hola@lasmanualidadesdemon.com

What we process, why and for how long

For each activity we state the purpose, legal basis, data, retention period and processors or recipients. GDPR refers to Regulation (EU) 2016/679.

1. News and opening list (newsletter)

This activity is not active in the shop yet.

• Purpose: to send you news from the shop or tell you when it opens, if you sign up.
• Legal basis: your consent (Article 6(1)(a) GDPR).
• Data: email address, language and a record of your consent (the text you accepted and the date).
• How it works: double opt-in. After you enter your email we send you a message with a confirmation link, valid for 7 days. If you do not confirm, we delete the sign-up after about 8 days (the link expires after 7 days and a daily clean-up removes unconfirmed records). If that address had already unsubscribed before, we do not delete it: it goes back to being recorded as unsubscribed (see below).
• Retention: if you confirm, until you unsubscribe.
• Processors: Resend (email delivery), Neon (database) and Cloudflare (hosting).

What happens when you unsubscribe. When you unsubscribe we do not delete the record: we mark it as unsubscribed and keep it. We keep your email, language, the consent record (text and date), the source of the sign-up, the date you confirmed, the date you unsubscribed and the date of the last confirmation email sent. We do this so that the form cannot be used to email someone again who has said they do not want to receive emails, and as proof of the consent given and withdrawn. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in respecting your decision to unsubscribe and in being able to show that we comply. We keep it indefinitely for as long as it serves that purpose, and we review every year whether it is still needed. If you request erasure (Article 17 GDPR), we keep only a minimal suppression marker instead of deleting everything, so that your address is not added again.

Waiting time between confirmation emails. We do not send a new confirmation email to the same address within one hour of the previous one. If that address has ever unsubscribed, the wait is 30 days, counted from the later of the last confirmation email and the last unsubscribe. If you try to sign up again within that window, nothing changes and no email is sent.

2. Customer accounts and sessions

This activity is not active in the shop yet: the shop does not offer account creation yet.

• Purpose: to create and manage your account and keep your session signed in securely.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Data: name, email address, password (stored using an irreversible hash, never as readable text) and session data, including the IP address and browser (user-agent), for security and, if you use them, the basket and wish list saved in your account.
• Retention: while your account exists.
• Processors: Neon, Cloudflare and Resend.

3. Orders, payments and invoicing

This activity is not active in the shop yet: for now, orders and payments cannot be made.

• Purpose: to handle your order, collect payment, ship it if it is a physical product, issue the invoice and meet tax and accounting obligations.
• Legal basis: performance of a contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).
• Data: contact details, shipping address and order data. Stripe processes your full card number and security code; we do not see or store them. We may store the card brand, its last 4 digits and its expiry date, to identify the payment.
• Retention: for the periods required by tax and commercial law.
• Processors and recipients: Stripe, as payment provider. Stripe also acts as an independent controller for some purposes of its own, such as fraud prevention. The Spanish tax authority (Agencia Tributaria) and the shop’s tax advisor may also receive data where the law requires it.
• Transfers: Stripe may process data in the United States (see “International transfers”).

4. Order confirmation and download emails

This activity is not active in the shop yet.

• Purpose: to send you your order confirmation and, for digital products, access to the download.
• Legal basis: performance of a contract (Article 6(1)(b)).
• Data: email address and order data.
• Retention: together with the order, for the same period.
• Processor: Resend.

5. Digital downloads

This activity is not active in the shop yet.

• Purpose: to give you access to the digital products you buy.
• Legal basis: performance of a contract (Article 6(1)(b)).
• Data: a record of the digital products you are entitled to download.
• Retention: access to each download expires 30 days after it is enabled or after 5 downloads. The download record is kept together with the order, for the same period.
• Processor: Cloudflare R2, where the files are stored, in the European Union.

6. Shop assistant (chatbot)

The assistant is an artificial intelligence system, not a person. It only works with a signed-in session, and the shop does not offer signing in yet.

• Purpose: to answer the question you ask it.
• Legal basis: legitimate interest in answering your enquiry (Article 6(1)(f)).
• Data: your question and, at most, your 6 previous messages in the conversation (not the assistant’s replies), which are sent so it can answer you. The server does not store the text of the conversation.
• Retention: the conversation is only stored in your browser and is deleted when you close the tab, clear the chat or sign out. A question counter linked to your account deletes itself about one hour after your last question.
• Processors: Scaleway (Paris, European Union), which generates the answer, and Cloudflare Workers AI, which processes your question to look up shop information.
• Reaching a person: you can always write to us at hola@lasmanualidadesdemon.com.

7. Abuse prevention and rate limiting

This activity is active.

• Purpose: to protect the shop from abuse and excessive use (for example, limiting the number of requests in a row).
• Legal basis: legitimate interest in protecting the shop (Article 6(1)(f)).
• Data: IP address.
• Retention: from about 2 minutes to 2 hours.
• Processor: Cloudflare.

8. Technical logs

This activity is active.

• Purpose: to detect and fix faults and keep the service secure.
• Legal basis: legitimate interest (Article 6(1)(f)).
• Data: technical identifiers and error codes, plus Cloudflare’s request logs.
• Retention: a few days.
• Processor: Cloudflare (United States; see “International transfers”).

9. Emails you send us

This activity is active.

• Purpose: to answer the messages you send to hola@, pedidos@ or soporte@ lasmanualidadesdemon.com.
• Legal basis: performance of a contract when the message is about an order; otherwise, legitimate interest in answering your enquiry (Article 6(1)(f)).
• Data: whatever you include in your message.
• Retention: as long as needed to handle your request.
• Processor: Cloudflare Email Routing, which receives the messages sent to those shop addresses and forwards them to the owner’s own email mailbox.
• Destination mailbox: the messages are received and stored in that mailbox of the owner’s own, whose provider is Google (Gmail).

International transfers

Some of the providers we use process data in the United States: Cloudflare and, once the corresponding services are switched on, Resend and Stripe. In the case of Cloudflare, Resend and Stripe, these transfers rely on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) and, in addition or failing that, on the European Commission’s standard contractual clauses. The emails you send us are stored in the owner’s Gmail mailbox. Google may process that data outside the European Union, including in the United States. According to Google, Google LLC participates in the EU-US Data Privacy Framework and, where a transfer is not covered by an adequacy decision, relies on the European Commission’s standard contractual clauses; you can check this at policies.google.com/privacy/frameworks. Some services are provided from within the European Union, such as storing downloads on Cloudflare R2 and Scaleway in Paris, but we cannot say that all your data stays in the European Union. You can ask us for information about these safeguards, or a copy, at hola@lasmanualidadesdemon.com.

Do you have to provide your data?

We only ask for the data needed for each purpose. If you do not provide it, we cannot provide that service. For example, without a shipping address we cannot deliver a physical order. Signing up for news is always voluntary.

Your rights

You can exercise your rights of access, rectification, erasure, restriction of processing, objection and portability at any time. Where processing is based on your consent, you can withdraw it whenever you want, without affecting processing carried out before you withdrew it.

To exercise them, write to hola@lasmanualidadesdemon.com. If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es, or through its electronic office.

Cookies

The shop does not use analytics, advertising or third-party tracking cookies. You will find the details in the cookie policy.