Information under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Controller
Alexander Neurohr (Stock Up), NIF [NIF], [dirección], 29692 San Luis de Sabinillas, Manilva (Málaga), Spain. Email: [email].
What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling orders, shipping and invoices | Name, address, email, phone, products bought, lot number | Performance of contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c)) | 6 years from the order (Spanish Commercial Code, Art. 30) and applicable tax periods |
| Answering questions and wholesale enquiries | Name, company, tax ID, email, message | Pre-contractual steps (Art. 6(1)(b)) | Until the enquiry is closed plus 1 year |
| Sending news by email | Email, language | Consent (Art. 6(1)(a)) | Until you unsubscribe |
| Site usage statistics (Google Analytics 4) | Cookie identifiers, pages viewed, technical browser data | Consent (Art. 6(1)(a)) | 14 months |
| Heatmaps and session recordings (Microsoft Clarity) | Cookie identifiers, clicks, scrolling and mouse movement, pages viewed, technical browser data; never what you type into forms | Consent (Art. 6(1)(a)) | Recordings 30 days (a sample up to 9 months) |
| Unfinished-cart and stock-up reminders | Email, products of the order or cart, language | Consent (Art. 6(1)(a)), the box on the cart | Until you click "Stop marketing emails"; the opt-out is kept so we respect it |
| Passwordless account | Email and the su_account cookie | Performance of the contract (Art. 6(1)(b)) | Session 30 days; orders as above |
| Product recall (food safety) | Order data and lot number | Legal obligation (Regulation (EC) 178/2002, Art. 18) | For the traceability period of the lot |
We do not take automated decisions or build profiles with legal effects.
Recipients and processors
We share only the data needed with:
- Stripe Payments Europe Ltd. — payments by card, Bizum, Apple Pay, Google Pay and SEPA. We never receive or store your full card details.
- Sendcloud B.V. and the chosen carrier (Correos, InPost, SEUR or others) — labels and delivery.
- Resend — order emails.
- Vercel Inc. — website hosting.
- Neon — order database.
- Google Ireland Ltd. — analytics, only if you accept analytics cookies.
- Microsoft Ireland Operations Ltd. — heatmaps and session recordings (Microsoft Clarity), only if you accept analytics cookies.
- Tax advisers and tax authorities where the law requires it.
Some of these providers may process data outside the European Economic Area (for example in the USA). They do so under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. [Review the provider list and safeguards before launch.]
Your rights
You can request access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by writing to [email] with a copy of an ID document or another means of identification.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Security
We use encrypted connections (HTTPS), password and two-factor access, and providers with adequate security guarantees.
Changes
We may update this policy. The version in force is always the one on this page. Last updated: [fecha].