Privacy policy
In case of discrepancy, the Spanish version prevails.
Last updated: 2026-10-29 (version 2026-10-borrador-6)
Introduction
At Aida Soler Suárez we take the protection of your personal data seriously. This policy follows the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection and Digital Rights Guarantee (LOPDGDD).
1. Data controller
- Identity: Aida Soler Suárez
- Tax ID (NIF/CIF): 73103126H
- Address: Calle Almadén 8, piso 3 puerta 6, 28014, Madrid, Madrid, España
- Email: solersuarezaida@gmail.com
2. What data we process and why
Name and surname: requested when creating an account, to identify it and to be able to pre-fill your details on future orders (speeding up checkout). They are not used for any other purpose.
National ID / Tax ID: never required to buy. It is only requested, optionally, if you check "I need a full invoice" at checkout, because invoicing regulations require that data on full invoices (unlike a simplified invoice, which does not require it).
Phone number: requested at checkout because it is necessary so the carrier can contact you for delivery. If you prefer not to provide it, delivery may be delayed or the carrier may be unable to notify you of issues.
Workshop bookings: we process your name, email, optional phone number, the names of attendees and any notes you add (for example, accessibility needs) solely to manage the booking, payment, workshop notices and reminders and, where applicable, the waiting list. Legal basis: performance of the contract (GDPR art. 6.1.b). If you mark an attendee as a minor, the data is provided by their parent or legal guardian. Notes may contain health data (allergies, accessibility needs): we only process them if you tick the explicit-consent box (GDPR art. 9.2.a), they are optional, used only to prepare the workshop, you can withdraw consent by writing to us, and we delete them 30 days after the workshop date. Bookings are kept with the rest of the order data for tax-law reasons. Waiting-list data (name, email and seats) is deleted 30 days after the workshop date.
| Purpose | Legal basis | Retention |
|---|---|---|
| Manage orders, payment, shipping and after-sales | Performance of a contract (GDPR art. 6.1.b) | Duration of the contract and applicable statute-of-limitations periods |
| Product personalisation (image and message you send us) | Performance of a contract (GDPR art. 6.1.b) | 30 days after the order is delivered; if the order is not completed, deleted after about 2 days |
| Invoicing and tax obligations | Legal obligation (GDPR art. 6.1.c) | 6 years (Spanish commercial and tax law) |
| User account (name, surname, email) | Performance of a contract (GDPR art. 6.1.b) | Until you close the account; orders and invoices are still kept as required by law |
| Handling contact enquiries | Consent (GDPR art. 6.1.a) | 12 months from the last activity |
| Newsletter and marketing communications | Consent (GDPR art. 6.1.a) and art. 21 of the Spanish LSSI-CE | Until you unsubscribe (link in every email); after that we keep only your email on a suppression list for 5 years, then delete it |
| Name and email on the order (customer contact) | Performance of the contract (GDPR art. 6.1.b) | Name and email are deleted 30 days after delivery and the delivery address (street and phone) after 90 days, unless a request is open; the rest of the order is kept for the tax periods |
| Security and fraud prevention (includes an IP-derived identifier and security logs) | Legitimate interest (GDPR art. 6.1.f) | IP-derived identifier for rate limiting: 2 days; security logs: 90 days; administration action log: 2 years (6 years if it concerns orders, invoices or refunds), without customer personal data |
| Diagnosis of technical website errors (message, stack and path, with no IP or user, and emails and identifiers removed) | Legitimate interest (art. 6.1.f GDPR) | 30 days |
| In-person workshop bookings and waiting list (name, email, attendees, notes) | Performance of a contract (GDPR art. 6.1.b) | Notes and waiting list: 30 days after the session ends; booking data: 6 years (commercial law), then anonymised |
| Handling data-rights requests (access, erasure, etc.) | Legal obligation (GDPR art. 6.1.c) | Record of the request and of our reply: 3 years (blocked, kept only to handle possible complaints); copy of an identity document, if we had to ask for one: deleted once your identity is verified |
3. Orders shipped to someone else (gifts)
If, when placing an order, you enter a shipping address different from your own (for example, to send the product as a gift), you provide us with personal data of that third person (name and address, and phone where applicable) that we did not collect directly from them.
In that case, the legal basis for processing the recipient's data is GDPR article 14 (data not obtained from the data subject): we use it exclusively to manage the shipment, for the same purpose and retention periods as the rest of the order data. We ask that you inform the recipient yourself that their shipping details were provided by you to complete your purchase, and that they can exercise their rights as explained in section 6.
4. Recipients and data processors
We do not sell your data. It is only shared with providers who need it to deliver the service, under a data-processing agreement in line with GDPR art. 28:
- Supabase (database, authentication and functions): data processor. Data is stored on a server located in France (European Economic Area).
- Netlify (web hosting): data processor, based in the US. It is certified under the EU-US Data Privacy Framework (DPF) and its data processing agreement incorporates the European Commission's standard contractual clauses.
- Resend (transactional and newsletter emails): data processor, based in the US. This involves an international transfer of data (name and email) outside the European Economic Area. Safeguards applied: the European Commission's standard contractual clauses, incorporated in its data processing agreement (DPA), and Resend's certification under the EU-US Data Privacy Framework (DPF).
- Correos (Sociedad Estatal Correos y Telégrafos, S.A., order delivery): receives the recipient's name, address and, where applicable, phone number to carry out the delivery. It is based in Spain, so no international transfer is involved.
- Square (payments): acts as a data processor for handling the charge, but is an independent controller for the data it uses for its own legal obligations and fraud-prevention duties (e.g. identity verification or regulatory compliance). See Square's own privacy policy for details.
- Tax advisor, where applicable, and public authorities when required by law.
5. International transfers
As stated in section 4, Resend and Netlify process data in the US, and Square may process data outside the European Economic Area under its own data processing terms. Database data is hosted in France. For every international transfer, appropriate safeguards under GDPR Chapter V apply (adequacy decision, such as the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses). You can ask us for more information about these safeguards by writing to solersuarezaida@gmail.com.
6. Your rights
If you have an account, you can download your data (access and portability), correct it and delete your account from your profile, under Settings. For this and for your other rights (or if you bought without an account), you can exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated decisions through the contact form (https://aidasolersuarez.com/en/contacto?tema=derechos, choosing "Exercise my data protection rights"), which lets us track the response deadline, or by writing to solersuarezaida@gmail.com with the subject "Data Protection", stating the email or order number you bought with. Only if we have reasonable doubts about your identity will we ask for an ID document, which we will delete once it is verified. We will respond within one month. You can withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es
7. Minors and security
This site is not aimed at children under 14; in addition, to buy you declare that you are over 18 (see Terms and Conditions). We apply appropriate technical and organisational measures: encrypted HTTPS connection, passwords stored using hashing (not in plain text or reversibly encrypted) and access control over data.
8. Cookies and technical storage
This website only uses strictly technical storage (login session, chosen language, shopping cart) and does not load analytics, advertising or tracking cookies or scripts, whether our own or third-party, for normal browsing on the site. When you pay, you are redirected to the payment page hosted by Square, where Square may set its own fraud-prevention cookies. See our Cookies Policy for full details.