Privacy Policy

Last updated: 11 November 2026

We only process the data needed to manage your account and your orders. We do not sell it and we do not use analytics or advertising cookies. We only send you offers by email if you expressly agree, and you can withdraw that at any time. Below you will find the details, in line with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Tatiana Kopenkova (BiPunt), Tax ID (NIF) Z3806002J, Barrio Asunción, 1, 48007 Bilbao, Spain. Email: hola@bipunt.com.

2. What data we process

Account: first name, last name, email and password (stored encrypted, never in readable form). If you log in with Google, Google gives us your name and email; never your Google password. If you choose to, also your phone number and the delivery addresses you save in your account, which you can edit or delete at any time.
Orders: shipping and billing address, phone number if you provide it, products bought, amounts and order history.
Payment: your card details are entered into and processed directly by our payment provider; we never receive or store them. We only receive the payment confirmation.
Communications: the messages you send us by email and our replies.
Visit statistics: pages viewed, products viewed or added to the cart, language, device type, country (derived from the IP address at the moment of the visit) and the website you came from. We do not use cookies for this and do not store your IP address: only an anonymous identifier that changes every day. Visits are not recorded when “Do Not Track” or “Global Privacy Control” is enabled in your browser.
Points programme: points balance and movements, who invited you or whom you invited, and, if you give them, the day and month of your birthday and your consent to receive offers by email (with its date).
Reviews: your rating, the text, the photos you upload and the name we show (first name and initial of your last name); and, if you allow it, your permission to post your photos on Instagram (with its date). Photos are stored without location data or metadata.
Technical data: IP address and browser details, which the server needs to show you the pages and to protect the site. Cookies are explained in the Cookie Policy.

3. Why we use it, on what legal basis and for how long

Purpose	Legal basis (GDPR)	Retention
Creating and managing your account, including when you log in with Google	Performance of a contract: the account you ask for (Art. 6(1)(b))	As long as you keep the account. You can delete it yourself at any time from your account (or ask us), and we erase its data, except order data we must keep by law.
Handling your orders, delivery, returns and warranty, and sending you order status emails	Performance of the sales contract (Art. 6(1)(b))	For the duration of the order and then for the legal periods needed to handle claims and warranty.
Invoicing, accounting and tax obligations	Compliance with legal obligations: tax and commercial law (Art. 6(1)(c))	6 years (Art. 30 of the Spanish Commercial Code).
Answering your questions by email	Legitimate interest in answering the questions you send us (Art. 6(1)(f))	Until your question is resolved and then for up to 1 year, unless it leads to an order.
Site security and fraud prevention	Legitimate interest in protecting the shop and its customers (Art. 6(1)(f))	Only as long as strictly necessary; technical logs are deleted regularly.
Visit statistics to improve the shop (which pages and products interest visitors, where visits come from)	Legitimate interest in understanding, anonymously, how the shop is used (Art. 6(1)(f))	2 years; then deleted automatically.
Keeping your cart and the details you enter while buying (email, address, payment attempts) until you complete the order	Pre-contractual steps taken at your request (Art. 6(1)(b))	If you do not complete the order, 30 days from the last activity; then deleted automatically.
Running your points programme (earning, using and expiring points, invitations and the birthday gift)	Performance of a contract: the programme terms you accept by using your account (Art. 6(1)(b))	As long as you keep the account. If you delete it, we erase the balance and all points movements (orders are kept separately, as explained above).
Sending you news and offers by email, including the birthday note	Your consent (Art. 6(1)(a); Art. 21 LSSI), which you can withdraw at any time from your account	Until you withdraw your consent; we keep the date you gave or withdrew it as proof.
Publishing your reviews and photos on the piece's page and rewarding them with points	Performance of a contract: the programme terms you accept by sending the review (Art. 6(1)(b))	As long as the review is published; you can ask us to remove it at any time. If you delete your account, we erase your reviews and their photos. The photos of a rejected or withdrawn review are deleted.
Posting your photos on our Instagram	Your consent (Art. 6(1)(a)), which you can withdraw at any time	Until you withdraw your consent; we then remove the posts with your photos from our profile.

Purpose: Creating and managing your account, including when you log in with Google
Legal basis (GDPR): Performance of a contract: the account you ask for (Art. 6(1)(b))
Retention: As long as you keep the account. You can delete it yourself at any time from your account (or ask us), and we erase its data, except order data we must keep by law.

Purpose: Handling your orders, delivery, returns and warranty, and sending you order status emails
Legal basis (GDPR): Performance of the sales contract (Art. 6(1)(b))
Retention: For the duration of the order and then for the legal periods needed to handle claims and warranty.

Purpose: Invoicing, accounting and tax obligations
Legal basis (GDPR): Compliance with legal obligations: tax and commercial law (Art. 6(1)(c))
Retention: 6 years (Art. 30 of the Spanish Commercial Code).

Purpose: Answering your questions by email
Legal basis (GDPR): Legitimate interest in answering the questions you send us (Art. 6(1)(f))
Retention: Until your question is resolved and then for up to 1 year, unless it leads to an order.

Purpose: Site security and fraud prevention
Legal basis (GDPR): Legitimate interest in protecting the shop and its customers (Art. 6(1)(f))
Retention: Only as long as strictly necessary; technical logs are deleted regularly.

Purpose: Visit statistics to improve the shop (which pages and products interest visitors, where visits come from)
Legal basis (GDPR): Legitimate interest in understanding, anonymously, how the shop is used (Art. 6(1)(f))
Retention: 2 years; then deleted automatically.

Purpose: Keeping your cart and the details you enter while buying (email, address, payment attempts) until you complete the order
Legal basis (GDPR): Pre-contractual steps taken at your request (Art. 6(1)(b))
Retention: If you do not complete the order, 30 days from the last activity; then deleted automatically.

Purpose: Running your points programme (earning, using and expiring points, invitations and the birthday gift)
Legal basis (GDPR): Performance of a contract: the programme terms you accept by using your account (Art. 6(1)(b))
Retention: As long as you keep the account. If you delete it, we erase the balance and all points movements (orders are kept separately, as explained above).

Purpose: Sending you news and offers by email, including the birthday note
Legal basis (GDPR): Your consent (Art. 6(1)(a); Art. 21 LSSI), which you can withdraw at any time from your account
Retention: Until you withdraw your consent; we keep the date you gave or withdrew it as proof.

Purpose: Publishing your reviews and photos on the piece's page and rewarding them with points
Legal basis (GDPR): Performance of a contract: the programme terms you accept by sending the review (Art. 6(1)(b))
Retention: As long as the review is published; you can ask us to remove it at any time. If you delete your account, we erase your reviews and their photos. The photos of a rejected or withdrawn review are deleted.

Purpose: Posting your photos on our Instagram
Legal basis (GDPR): Your consent (Art. 6(1)(a)), which you can withdraw at any time
Retention: Until you withdraw your consent; we then remove the posts with your photos from our profile.

We only send you news and offers by email if you agree by ticking the box for it (it is never ticked in advance), and you can withdraw at any time from your account or by replying to any of those emails. We do not profile you or make automated decisions that affect you.

Fields marked as required in our forms are needed to create the account or process the order; without them we cannot provide the service.

4. Who we share your data with

We do not sell or rent your data. It is only shared with the providers we need to run the service, under data processing agreements, and with authorities where the law requires it:

Server hosting provider (data centre in the European Union): hosting of the website and its database.
Email provider: sending the emails about your orders and our replies to your questions.
Stripe Payments Europe, Ltd. (Ireland): card payment processing. Stripe also processes some data as an independent controller to prevent fraud and meet its legal obligations.
Google Ireland Limited (Ireland): only if you choose “Continue with Google” to log in.
Shipping platform (Packlink) and delivery companies: delivery name, address and phone number, to bring you your order.
Tax authorities, courts and other public authorities, where there is a legal obligation.
Meta Platforms Ireland Ltd. (Instagram): only the review photos you allow us to post, which will be public on our profile.

Statistics are calculated on our own server. The country comes from a DB-IP geolocation database installed on the server: no data is sent to third parties.

5. International transfers

Our server is located in the European Union. Stripe and Google may process some data in the United States; these transfers are covered by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), under which both companies are certified, and by standard contractual clauses approved by the European Commission.

Meta (Instagram) may process the photos we post with your permission in the United States; it is certified under the EU-US Data Privacy Framework.

6. Your rights

You can exercise the following rights at any time, free of charge:

Access: find out what data about you we process.
Rectification: correct inaccurate or incomplete data.
Erasure: delete your account yourself from the account page, or ask us to delete your data.
Objection and restriction: object to certain processing, or ask us to limit it.
Portability: receive your data in a structured, commonly used format.
Withdrawal of consent: withdraw it at any time, where processing is based on it.

Email us at hola@bipunt.com saying which right you want to exercise. If we have reasonable doubts about your identity, we may ask for additional information. We will reply within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es).

7. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), passwords stored encrypted, access to data limited to those who need it, and backups.

8. Children

Our services are not aimed at children under 14 and we do not knowingly collect their data. To place orders you must have the legal capacity to enter into contracts.

9. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date. If the change is significant, we will let you know by email.