Privacy policy
How Corp-Merch.ES collects, uses and protects personal data of customers, prospects and website visitors in Spain.
What data we collect
We collect personal data you provide directly (name, business email, company, phone, shipping address, order details) and technical data captured automatically (IP address, browser, pages viewed, referrer). For B2B customers we additionally process VAT number, billing entity and order history. Marketing data — newsletter subscription, campaign attribution — is processed only with prior consent.
Lawful bases and retention
Order processing relies on contract performance (GDPR Art. 6(1)(b)); invoicing and tax retention rely on legal obligation (Art. 6(1)(c)). Marketing communications and analytics cookies rely on consent (Art. 6(1)(a)). Customer-account data is retained for the duration of the relationship plus 10 years for accounting law; marketing data is retained until consent withdrawal. Server logs are kept 90 days.
Local data-protection authority
In Spain the competent supervisory authority is the AEPD — Agencia Española de Protección de Datos (Spanish DPA). LOPDGDD — Organic Law 3/2018 on Data Protection and Digital Rights governs national specificities such as employment-context processing and minors' consent. You may lodge a complaint with the authority at any time, free of charge, without affecting other legal remedies.
FAQ
Who is the data controller?
The data controller is Corp-Merch.ES, the local trading name of our group operating in Spain. Full registration details are in the Impressum.
Do you transfer data outside the EU?
Most processing happens inside the EU. Where sub-processors are located outside the EU we rely on Standard Contractual Clauses 2021/914 and conduct transfer impact assessments.
How do I exercise my GDPR rights?
Email [email protected] with proof of identity. We respond within 30 days as required by Art. 12(3).
Do you use cookies?
Only essential cookies load before consent. Analytics and marketing cookies require opt-in via the cookie banner — see our cookie policy.
How long do you keep my data?
Customer data: relationship + 10 years (accounting). Prospect data: 24 months from last contact. Marketing: until you unsubscribe.