Privacy Policy

1. Data controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you that the controller responsible for processing your personal data is:

2. Data we collect

2.1. Registration and account data

Full name, email address, password (encrypted), contact phone number and tax details (CIF/NIF).

2.2. Company data (B2B clients)

Company name, trade name, tax address, bank details (IBAN), contact person and tax documentation (Modelo 036, census registration certificate or similar).

2.3. Browsing data

IP address, browser and device type, pages visited, visit duration and cookies (see our Cookie Policy).

2.4. Order data

Order history, shipping address, product preferences and order-related communications.

2.5. Products you view while signed in

When you browse while signed in, we record which products you open (on their page or in the catalogue quick view), how many times, and the date of the first and the last visit, linked to your customer account. Our sales team consults it to follow up on your account (for example, to know which models interest you before calling you). The legal basis is our legitimate interest (Art. 6.1.f GDPR) in knowing what our trade customers are looking for in order to serve them better. It is kept for a maximum of 13 months and deleted if your account is deleted or anonymised. You can object at any time by writing to info@calzadosjam.es; if you do, we will stop linking your visits to your account and delete this history. If you are not signed in, the visit only adds to the product's anonymous counter (see our Cookie Policy).

3. Purpose of processing

• Account management: Create and manage your user account on our wholesale platform.
• Professional verification: Validate your status as a professional or business in the sector.
• Unfinished sign-up requests: If you leave your details in the short form on our pages, process your sign-up, call you if needed and, if you don't finish it, send you 2 email reminders (after 24 hours and after 3 days), with a link to unsubscribe.
• Order processing: Manage, process and deliver your orders, including issuing delivery notes and invoices.
• Billing and collections: Issue invoices and manage payments (by bank transfer and, at our warehouse, by card or in cash).
• Commercial communications: Send information about products, offers and news (only with your express consent).
• Service improvement: Analyse platform usage to improve the experience.
• Legal compliance: Comply with legal, tax and commercial obligations.
• Customer support: Respond to enquiries and resolve issues.
• Fraud prevention: Detect and prevent fraudulent activities or misuse of the platform.

4. Legal basis for processing

• Performance of a contract (Art. 6.1.b GDPR): To manage your account, process orders and provide the contracted service.
• Pre-contractual steps at your request (Art. 6.1.b GDPR): To process the sign-up request you leave in the short form, call you if needed and send you the 2 reminders.
• Legal obligation (Art. 6.1.c GDPR): To comply with tax regulations (Ley General Tributaria), commercial regulations (Código de Comercio) and anti-money laundering legislation.
• Consent (Art. 6.1.a GDPR): To send commercial communications and use non-essential cookies. You may withdraw your consent at any time.
• Legitimate interest (Art. 6.1.f GDPR): To improve our services, follow up commercially on the products our customers view while signed in (see 2.5), prevent fraud and ensure platform security.

5. Data recipients

Your data may be shared with the following categories of recipients, solely for the purposes stated:

• Banking institutions: For managing payments by bank transfer and by card.
• Transport agencies: For order delivery (name, address, phone).
• Technology providers: Hosting services (Vercel/Supabase), storage (Vercel Blob), transactional email (Resend) and cache (Upstash), with data processing agreements pursuant to Art. 28 GDPR.
• Google: Web analytics (Google Analytics) and advertising/remarketing (Google Ads), with transfers to the USA covered by the EU-US Data Privacy Framework. The Google tag loads on every visit: even if you reject cookies, it sends Google cookieless pings (page address, browser and device, referring page, time and IP address), which Google uses in aggregate to measure and model conversions (see our Cookie Policy, section 8).
• Public authorities: Agencia Tributaria (AEAT), Social Security and other administrations when legally required.

We do not sell, rent or share your personal data with third parties for commercial purposes unrelated to the provision of our service.

6. International transfers

Some of our technology providers (Supabase, Vercel, Upstash) may process data outside the European Economic Area (EEA). In such cases, we ensure adequate safeguards are in place in accordance with the GDPR: standard contractual clauses approved by the European Commission (Decision 2021/914), certification under the EU-US Data Privacy Framework, or European Commission adequacy decisions.

7. Retention period

When we process your closure, we remove you from the newsletter and from any commercial communications and delete your activity on the website (viewed products, favourites, searches, chat and sessions). If you have an order in progress, we process the closure once it has been shipped or cancelled. The data the law requires us to keep (your customer details and your orders, delivery notes and invoices) are blocked, as provided for in Art. 32 of the LOPDGDD: we use them for nothing other than that obligation and, while the period lasts, they are available only to judges and courts, the Public Prosecutor and the competent public authorities. While they are blocked, we also keep your email address on our mailing exclusion list so that we do not write to you again, unless that email address also appears on an order from another customer or one placed without an account: you will still receive the emails about that order. In the meantime, you cannot open a new account with that email address either: if you come back, sign up with another one or write to us. If your email address had bounced, you had marked one of our emails as spam or you had expressly asked us not to email you, it stays on that exclusion list even when we delete your data, only so that we do not write to you again. The record of the notices the website sends to our own mailbox with your email address (contact form or sign-up request) is deleted after 365 days, and the record of bounces of your email address after 90. The invoices and pro forma invoices we have issued to you are also in our accounting records, with your name and your tax ID: closing your account does not delete them from there, and they are kept with the rest of our accounting books.

Once these periods expire, all other data will be securely deleted or anonymised.

8. Your rights

Under the GDPR (Arts. 15 to 22) and the LOPDGDD, you have the following rights:

• Access (Art. 15): Obtain confirmation of whether we process your data and access it.
• Rectification (Art. 16): Correct inaccurate data or complete incomplete data.
• Erasure (Art. 17): Request deletion of your data when it is no longer necessary.
• Objection (Art. 21): Object to the processing of your data in certain circumstances.
• Restriction (Art. 18): Request restriction of processing in legally prescribed cases.
• Portability (Art. 20): Receive your data in a structured, commonly used and machine-readable format.
• Withdrawal of consent: Withdraw your consent at any time without affecting the lawfulness of prior processing.
• Not to be subject to automated decisions (Art. 22): We do not use decisions based solely on automated processing that produce legal effects on you.

Right to lodge a complaint: If you believe that the processing of your data violates the regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.

9. Security measures

We implement appropriate technical and organisational measures proportionate to the risk, in accordance with Art. 32 GDPR, to ensure the confidentiality, integrity and availability of your data:

• Password encryption using secure algorithms (bcrypt).
• Encrypted communications via HTTPS/TLS across the entire site.
• Role-based access control: only authorised personnel can access personal data.
• Row Level Security (RLS) in the database: each user can only access their own data.
• Automated and encrypted backups.
• Rate limiting and brute-force attack protection.
• Infrastructure providers with security certifications (SOC 2, ISO 27001).

10. Minors

Our platform is intended exclusively for professionals and businesses. We do not intentionally collect data from individuals under 18 years of age. If you become aware that a minor has provided personal data, please contact us so we can proceed with its immediate deletion.

11. Third-party links

Our website may contain links to third-party sites (social networks, suppliers). We are not responsible for the data processing carried out by such third parties. We recommend consulting their respective privacy policies before providing them with personal data.

12. Changes to this policy

We reserve the right to modify this Privacy Policy to adapt it to legislative, case-law or business practice changes. Changes will be published on this page with the corresponding update date. In the event of substantial changes, we will inform you by email or through a prominent notice on the platform.

13. Contact

For any enquiry related to this Privacy Policy or the processing of your personal data: