Privacy policy
What data we process, why, for how long, and your rights.
Data controller
Drafted as a working basis under the GDPR, the Spanish LOPDGDD and the LSSI-CE. Before the shop opens it must be reviewed by a lawyer and completed with the company details marked in brackets.
- Controller: [legal name] — Tax ID [tax identification]
- Address: [full address]
- Privacy contact: privacy@guilleoutes.com
- Data protection officer: [name and contact, if appointed]
What we process and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running your account | Name, email, hashed password | Performance of a contract (art. 6(1)(b)) | While the account is active |
| Orders and returns | Address, phone, purchase history | Performance of a contract (art. 6(1)(b)) | 5 years (warranty and claims) |
| Taking payment | Amount and reference; the card is handled by the bank | Performance of a contract (art. 6(1)(b)) | As payment rules require |
| Invoicing and accounting | Tax details of the transaction | Legal obligation (art. 6(1)(c)) | 6 years (Spanish Commercial Code) |
| Publishing a drawing in the children's gallery | The image, its title, the child's first name and age; the account and email of the adult who authorises it | Consent of the holder of parental authority (art. 6(1)(a) GDPR, art. 7 LOPDGDD) | Until it is taken down; the consent record, 3 years longer |
| Sending you news | Name and email | Consent (art. 6(1)(a)) | Until you unsubscribe |
| Measuring site usage | Aggregated browsing data | Consent (cookies) | 13 months |
We never process special-category data, and we make no automated decisions that significantly affect you. We do not build profiles to sell.
Who else sees your data
- The bank that processes the payment (Redsys and your bank). We never see or store your card number.
- The courier, to deliver your order.
- Our hosting and email providers, as processors, under an article 28 GDPR agreement.
- Public authorities, where the law requires it.
We do not transfer data outside the European Economic Area. Should that ever become necessary, it will be done under the safeguards in chapter V of the GDPR and stated here.
The children's gallery: children's data
The children's gallery publishes drawings made by children. It is a public area: anyone can see it without registering, and search engines may index it. Because the author is a minor, this part works under its own rules, and these are them.
Painting in the studio needs no account and leaves no data on our servers: the drawing stays in that device's browser until somebody presses publish. Publishing does require an adult's account — they are the ones authorising it and answering for it. Under article 7 of the Spanish LOPDGDD, consent for a child under fourteen is given by the holder of parental authority; we ask for it in every case, whatever the child's age.
What is published, exactly:
- The image of the drawing.
- The title given to it by whoever made it.
- Their first name and, only if filled in, their age. The age field is optional.
- The date it was published.
And what is never published: surnames, school, town, photographs of the child, or any contact details for them. The form refuses names that look like a full name, precisely so that a surname does not end up published because it was typed into the wrong box. The adult's email is kept as evidence of the permission and is shown on no page.
We store the consent together with the exact wording that was on screen on the day it was given, the version of this document and the language, because article 7(1) of the GDPR requires us to be able to demonstrate what was agreed and when. It is specific to that drawing: publishing one does not authorise publishing the next.
Withdrawing is as easy as giving it was, which is what article 7(3) requires. Under “My account” → “My drawings”, every drawing has a button to take it off the gallery — it disappears immediately and can be put back — and another to delete it for good. No explanation, no email to anybody. You can also write to privacy@guilleoutes.com and we will do it.
One exception, stated plainly: if somebody has bought a t-shirt printed with that drawing, we keep the image for as long as it takes to make it and to honour the warranty on that order. The drawing still disappears from the site; what is kept is the copy attached to that order, and it is kept because there is a contract to perform (art. 6(1)(b)), not because there is still consent to publish it.
For our part, we may take any drawing off the gallery if it should not be there. If you think we have taken yours down by mistake, write to us.
Drawings are published immediately, with no prior review. That is a deliberate choice: publishing requires the account of an identified adult, which we think is a better safeguard than a moderation queue. If you see something that should not be in the gallery, email hola@guilleoutes.com and we will take it down.
Your rights
- Access: find out what we hold about you.
- Rectification: correct anything wrong.
- Erasure: ask us to delete it.
- Objection and restriction of processing.
- Portability: receive it in a reusable format.
- Withdraw consent at any time, without affecting what was lawful before.
Email privacy@guilleoutes.com saying which right you are exercising. We reply within one month. From “My account” you can withdraw marketing consent yourself, and equally take any drawing out of the children’s gallery. If you are unhappy with our answer, you may complain to the Spanish Data Protection Agency (www.aepd.es).
Security
Passwords are stored hashed and nobody on the team can read them. Connections always use HTTPS. Database access is restricted per user, so nobody can see another person's data. Payment gateway credentials are stored encrypted.
Did not find what you were looking for? Email us and we reply within 24 working hours.