Privacy policy
What data we process, why, for how long and what you can require from us.
1. Data controller
Under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD), the controller of your personal data is:
- Owner: [to be completed in the company record]
- Tax ID (NIF/VAT): [to be completed in the company record]
- Registered address: [to be completed in the company record]
- Email: [to be completed in the company record]
- Phone: [to be completed in the company record]
- Website: https://fitowaredemo.gestioerp.com
2. What data we process
We only process the data needed to provide the service:
- Identification and contact data: name and surname or company name, tax ID, postal address, email and phone number.
- Purchase data: products bought, amounts, chosen payment method, and delivery and billing addresses.
- Billing data: whatever is needed to issue invoices and keep the accounts.
- Browsing data: IP address and minimal technical data logged for security reasons.
We do not process special categories of data and we do not take automated decisions producing legal effects on you. Card details are not stored on our systems: they are handled directly by the bank or the payment gateway.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Managing your registration and customer account | Performance of a contract (Art. 6(1)(b) GDPR) |
| Processing the order, payment, delivery and returns | Performance of a contract (Art. 6(1)(b) GDPR) |
| Issuing invoices and meeting tax and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Handling enquiries, incidents and complaints | Performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| Sending commercial communications about products similar to those purchased | Legitimate interest (Art. 6(1)(f) GDPR and Art. 21.2 LSSI-CE), with a right to object in every message |
| Sending the newsletter when you request it | Consent (Art. 6(1)(a) GDPR) |
| Preventing fraud and keeping the site secure | Legitimate interest (Art. 6(1)(f) GDPR) |
4. How long we keep your data
- Account data: for as long as you keep the account open and do not request its deletion.
- Order and billing data: six years under Article 30 of the Spanish Commercial Code, and four years for tax purposes under the General Tax Act.
- Data for commercial communications: until you withdraw consent or object.
- Product warranty data: for the duration of the statutory warranty period and any resulting claims.
Once those periods have elapsed, the data is blocked and remains available only to courts and public authorities in order to address any liabilities, and is deleted once those are time-barred.
5. Who we share your data with
We only share your data where it is essential to provide the service or where the law requires it:
- Carriers, so that your order can be delivered.
- Banks and payment gateways, to process payment.
- Tax and accounting advisers and the tax authorities, to meet legal obligations.
- IT service providers (hosting, email, backups), acting as processors under a contract signed pursuant to Article 28 GDPR.
No international data transfers outside the European Economic Area take place. Should any become necessary, they would be carried out with the safeguards set out in Chapter V GDPR and you would be informed beforehand.
6. Your rights
You may exercise the following rights at any time, free of charge:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to have your data deleted when it is no longer necessary.
- Objection: to object to processing based on our legitimate interest.
- Restriction: to have processing suspended while a claim is resolved.
- Portability: to receive your data in a structured, commonly used format.
- Withdrawal of consent given, without affecting the lawfulness of prior processing.
To exercise them, write to [to be completed in the company record] stating the right you wish to exercise and attaching a copy of a document proving your identity. We will reply within one month.
If you believe your request has not been dealt with properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es) or with the supervisory authority of your country of residence.
7. Security
We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR: HTTPS-encrypted communications, access control by username and password, regular backups and activity logging. Payment data travels encrypted directly to the bank.
8. Minors
This site is not aimed at children under 14. By registering, the user declares that they are older than that or have the authorisation of their parents or guardians.
9. Changes to this policy
This policy may be updated to reflect legislative changes or new services. If a change materially affects you, we will let you know by email or through a prominent notice in the shop.
Last updated: 12-08-2026