Privacy policy
Regulation (EU) 2016/679 (GDPR) and LO 3/2018 (LOPDGDD)
Data controller
- Owner: Chantell Adelina Gebauer Larrosa
- NIF: 60183993P
- Registered address: C/ Alcalde Antonio Pariente Cuesta, 11B, 3G, 28342, Valdemoro, Madrid, España.
- Contact regarding data protection: contacto@universopumpkin.es
- Data Protection Officer: not applicable. This activity does not fall within any of the cases that make it mandatory to appoint one.
What data is collected
Only the data necessary for each of the purposes explained in the following section, and nothing more.
| When | What data |
|---|---|
| When you make a purchase | Name and surname(s), email address, delivery address and, if a business invoice is requested, NIF and registered tax address. A contact telephone number, so that the carrier can notify you of the delivery. If you choose delivery to a pick-up point, which one. |
| When you create an account | Email address and password (encrypted, never visible), plus the addresses you save |
| If you mark pieces as favourites (with an account) | Which pieces you have marked with the heart, and when. Others are only shown how many people have each piece in their favourites, never who |
| When you log in with Apple or Google | Whatever Apple or Google provide us with your permission: your email address and, if you give it, your name. With Apple you can hide your real email; in that case we receive an Apple forwarding address. If you log in with Apple, we store in encrypted form the permission Apple grants us, solely so that we can withdraw it when you delete your account |
| When you pay | No card number. The card details are entered by you directly in the bank's gateway or in PayPal; here we only store whether the payment was successful, the amount and a reference code |
| If you tick «Remember this card for next time» | The card brand (Visa, Mastercard…), its last 4 digits, the expiry date and a reference provided by the bank that can only be used to charge in this shop. Never the full number or the security code (CVV): only the bank holds those |
| If you use our apps and allow notifications | A phone identifier for sending it notifications, the app language and whether you accept news notifications |
| When you open a return | The reason you write, the photos you add to show the problem and the associated conversations |
| When you contact us through the contact form | Your name, your email address, the reason, the order number if you provide it and the message |
| When you browse | The chosen language and the contents of the basket, in technical cookies in your browser. In addition, the server records in its technical logs the IP address, the page requested, the browser and the time of each visit |
| When you accept the terms, sign up for news or unsubscribe | What you accepted or withdrew, when, from where (the website, the app, the payment process…), the version of the text shown to you and the IP address from which it was done |
For what purpose and on what legal basis
Marketing communications —news and offers, by email and in notifications from our apps— are only sent to those who tick that box, which is separate from the terms and is never pre-ticked. Not ticking it does not prevent you from making purchases or having an account.
Each of those emails includes a link to unsubscribe in a single click, without a password and without having to write to us. You can also change it from «My account» or by requesting it by email. The unsubscription is immediate, applies to both email and mobile notifications, and is stored precisely so that we do not write to you again.
Mobile notifications, moreover, only appear if your phone has asked you for permission and you have granted it. You can remove them whenever you wish from your phone's settings, without unsubscribing from email.
Order-related emails and notifications —the confirmation, the dispatch, the invoice or a return— are not commercial: they are part of the purchase and are sent even if you do not want the others.
No automated decisions are made and no profiling is carried out.
| Purpose | Legal basis | Retention |
|---|---|---|
| Processing the order, charging for it and dispatching it | Performance of the contract (art. 6.1.b RGPD (GDPR)) | For the duration of the relationship |
| Issuing and keeping invoices | Legal obligation (art. 6.1.c) | 4 years for tax limitation; 6 under the Commercial Code (Código de Comercio) |
| Handling returns and warranties | Performance of the contract and legal obligation | Until the actions become time-barred |
| Managing your account if you create one | Performance of the contract | Until you delete it |
| Saving your favourites and showing, without saying who, how many people have each piece | Performance of the contract: it is a feature of your account that you use if you wish (art. 6.1.b RGPD (GDPR)) | Until you remove the piece from your favourites or delete your account |
| Remembering your card to pay more quickly, if you request it | Your consent, by ticking «Remember this card for next time» at checkout (art. 6.1.a RGPD (GDPR)) | Until you remove it from «Payment methods», in your account, or delete the account |
| Notifying you on your mobile of your order's status (paid, dispatched, delivered) | Performance of the contract (art. 6.1.b). Separately, the phone asks for its own permission to display notifications: this is a technical system setting, not the legal basis for the processing | Until you withdraw the permission on the phone, log out or delete the account |
| Finding out how the website is used —which pages are visited, what is clicked, at which step of the purchase it is abandoned— in order to improve it | Your consent, by clicking «Accept» on the statistics notice (art. 6.1.a RGPD (GDPR) and art. 22.2 LSSI). If you do not accept, nothing is measured. You can withdraw it whenever you wish from «Statistics preferences», at the foot of each page, and withdrawing it does not affect what was measured previously. The data is pseudonymised: it is not associated with your name, your email or your account | One year from each visit: this is what PostHog retains on the plan we use (the free one), and after that time it deletes it |
| Responding to what you ask us through the contact form or by email | If it concerns an order or a purchase you wish to make, performance of the contract or pre-contractual measures (art. 6.1.b); otherwise, legitimate interest in attending to whoever writes to us (art. 6.1.f) | One year from when the enquiry is resolved; longer only if there is an open complaint, until it is closed |
| Preventing fraud in payments | Legitimate interest (art. 6.1.f) | What is strictly necessary to detect it |
| Being able to demonstrate what you accepted and when | Legal obligation to be able to demonstrate consent (art. 7.1 GDPR) and legitimate interest in defending ourselves against a claim (art. 6.1.f) | While it is in force and, afterwards, 3 years, which is the period in which the most serious infringements lapse (art. 72.2 LOPDGDD and art. 45 LSSI). After that time it is deleted; from an unsubscription we only retain your email address, without the IP address, so as not to contact you again |
| Keeping the website secure and detecting faults or abuse, using the server's technical logs | Legitimate interest in the security of the service (art. 6.1.f) | 30 days; after that they are deleted automatically |
| Sending you news and offers from the shop, by email and in mobile notifications, if you request it | Your consent (art. 6.1.a GDPR and art. 21 LSSI), in a separate tick box that you may leave unticked | Until you unsubscribe; the unsubscription is kept so that we do not contact you again |
Who else sees your data
Only the providers we need in order to deliver the service. Each one processes the data for the sole purpose of delivering its own:
- Supabase — database and account system. The data is hosted in the European Union.
- Redsys — payment gateway for card, Bizum and Apple/Google Pay. A Spanish company.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment with PayPal, if you choose it. It acts as an independent controller of the payment data you provide to it directly.
- Sendcloud (Sendcloud B.V., Netherlands) — the platform used to manage shipments, as a processor; it stores the data in the European Union. Through it, the carrier you choose when purchasing receives what is necessary to deliver your order: name, address or collection point, email address and telephone number. Correos and Correos Express process it on our behalf and solely for delivery; InPost (InPost Spain, S.L.U.) processes it as the controller of its own delivery service at Punto Pack and Locker, in accordance with its privacy policy.
- PostHog Inc. — statistics on the use of the website, on its European cloud (Frankfurt, Germany), only if you accept them. It receives which pages are viewed and what is clicked, the IP address, the browser, the operating system, the language and the screen size, with which it calculates on its servers a pseudonymous identifier that changes every day. It does not receive your name, your email address or what you type in the forms, and it does not record clicks in the account, the payment and the orders.
- Amazon Web Services EMEA SARL — hosting of the website, backups and sending of order, return and, if you request them, news emails (Amazon SES). The servers, the backups and the email sending are in Paris (France, European Union). The emails do not carry anything that reports whether you open them or links that record whether you click them.
- Apple (Apple Distribution International Ltd., Ireland) and Google (Google Ireland Ltd.) — they distribute our apps in their stores, deliver notifications to the phone (we send them the phone identifier and the text of each notification, nothing more) and, if you choose to log in with them, confirm your identity. For what you do in their stores and in your Apple or Google account, they are governed by their own privacy policies.
Transfers outside the European Union
If you choose to pay with PayPal. PayPal (Europe) S.à r.l. et Cie, S.C.A. processes that data as an independent controller, in accordance with its own privacy policy, and the PayPal group transfers data outside the European Economic Area relying on the standard contractual clauses approved by the European Commission. That transfer occurs from the moment you choose that payment method; if you prefer to avoid it, any of the other payment methods stays within the European Union.
If you use our apps and allow notifications. They are delivered by Apple (on the iPhone) and Google (on Android), which receive the phone identifier and the text of each notification. Their notification services may process that data in the United States. Apple relies for those transfers on the European Commission's standard contractual clauses, and Google on the EU–US Data Privacy Framework, to which Google LLC is adhered, and on those same clauses. If you do not want this transfer, it is enough not to allow notifications on the phone: the app works just the same.
With the statistics (PostHog), if you accept them. It stores the data in the European Union, but some of its providers or support teams are in the United States and may access it. Those accesses rely on the EU–US Data Privacy Framework, of which PostHog is part, and on standard contractual clauses.
The remaining providers —hosting and email, the database, the Redsys gateway, Sendcloud and the carriers— process the data in the European Union, and since we only ship to European Union countries, your shipment data does not leave it either. Amazon Web Services belongs to a US group: the data stays in the EU, and any access from the United States is covered by the EU–US Data Privacy Framework and by the standard contractual clauses of its processing agreement.
Minimum age
From the age of 14 you may consent yourself to the processing of your data. Below that age, the authorisation of whoever holds parental responsibility or guardianship is required.
We do not verify anyone's age: when you create an account or place an order, you declare that you meet this requirement. If we detect the data of a child under 14 without that authorisation, we delete it.
Your rights
You may request at any time to access your data, rectify it, erase it, object to the processing, restrict it or receive it in a portable format. It is enough to write to contacto@universopumpkin.es stating what you want; a document proving your identity may be requested.
If you consider that your data has not been processed correctly, you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es).
There is one exception worth knowing: the data of an invoice that has already been issued cannot be erased on request, because there is a legal obligation to retain it during the periods indicated above.
If you have an account, you may also delete it yourself from «Personal details», in your account: we send you an email to confirm it and, upon confirming, the account, your personal data, the saved addresses and your favourites are deleted. Orders and invoices are retained, without linking them to any account, for as long as the law requires.
What is deleted also disappears from the backups when they expire. A backup is made every night, encrypted, which is used only to restore the shop if something fails, and each backup is deleted automatically after 400 days.
Security
The site runs entirely over an encrypted connection. Passwords are stored encrypted and are not readable even from the administration area. The card number and its security code never pass through this site at any time: they are entered in the bank's or PayPal's environment. If you ask to remember a card, we only store the reference the bank gives us, the brand, the last 4 digits and the expiry date, so that no one could use it outside this shop.