Privacy Policy

Last updated: 30 September 2026

We only process the data needed to manage your account and your orders. We do not sell it, we do not send advertising and we do not use analytics or advertising cookies. Below you will find the details, in line with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Tatiana Kopenkova (BiPunt), Tax ID (NIF) Z3806002J, Barrio Asunción, 1, 48007 Bilbao, Spain. Email: tk.design.media.23@gmail.com.

2. What data we process

Account: first name, last name, email and password (stored encrypted, never in readable form). If you sign in with Google, Google gives us your name and email; never your Google password.
Orders: shipping and billing address, phone number if you provide it, products bought, amounts and order history.
Payment: your card details are entered into and processed directly by our payment provider; we never receive or store them. We only receive the payment confirmation.
Communications: the messages you send us by email and our replies.
Technical data: IP address and browser details, which the server needs to show you the pages and to protect the site. Cookies are explained in the Cookie Policy.

3. Why we use it, on what legal basis and for how long

Purpose	Legal basis (GDPR)	Retention
Creating and managing your account, including when you sign in with Google	Performance of a contract: the account you ask for (Art. 6(1)(b))	As long as you keep the account. If you ask us to delete it, we erase its data, except order data we must keep by law.
Handling your orders, delivery, returns and warranty, and sending you order status emails	Performance of the sales contract (Art. 6(1)(b))	For the duration of the order and then for the legal periods needed to handle claims and warranty.
Invoicing, accounting and tax obligations	Compliance with legal obligations: tax and commercial law (Art. 6(1)(c))	6 years (Art. 30 of the Spanish Commercial Code).
Answering your questions by email	Legitimate interest in answering the questions you send us (Art. 6(1)(f))	Until your question is resolved and then for up to 1 year, unless it leads to an order.
Site security and fraud prevention	Legitimate interest in protecting the shop and its customers (Art. 6(1)(f))	Only as long as strictly necessary; technical logs are deleted regularly.

Purpose: Creating and managing your account, including when you sign in with Google
Legal basis (GDPR): Performance of a contract: the account you ask for (Art. 6(1)(b))
Retention: As long as you keep the account. If you ask us to delete it, we erase its data, except order data we must keep by law.

Purpose: Handling your orders, delivery, returns and warranty, and sending you order status emails
Legal basis (GDPR): Performance of the sales contract (Art. 6(1)(b))
Retention: For the duration of the order and then for the legal periods needed to handle claims and warranty.

Purpose: Invoicing, accounting and tax obligations
Legal basis (GDPR): Compliance with legal obligations: tax and commercial law (Art. 6(1)(c))
Retention: 6 years (Art. 30 of the Spanish Commercial Code).

Purpose: Answering your questions by email
Legal basis (GDPR): Legitimate interest in answering the questions you send us (Art. 6(1)(f))
Retention: Until your question is resolved and then for up to 1 year, unless it leads to an order.

Purpose: Site security and fraud prevention
Legal basis (GDPR): Legitimate interest in protecting the shop and its customers (Art. 6(1)(f))
Retention: Only as long as strictly necessary; technical logs are deleted regularly.

We do not send marketing emails or newsletters. If we ever do, it will only be with your prior consent, which you can withdraw at any time. We do not profile you or make automated decisions that affect you.

Fields marked as required in our forms are needed to create the account or process the order; without them we cannot provide the service.

4. Who we share your data with

We do not sell or rent your data. It is only shared with the providers we need to run the service, under data processing agreements, and with authorities where the law requires it:

Server hosting provider (data centre in the European Union): hosting of the website and its database.
Email provider: sending the emails about your orders and our replies to your questions.
Stripe Payments Europe, Ltd. (Ireland): card payment processing. Stripe also processes some data as an independent controller to prevent fraud and meet its legal obligations.
Google Ireland Limited (Ireland): only if you choose “Continue with Google” to sign in.
Delivery companies: delivery name, address and phone number, to bring you your order.
Tax authorities, courts and other public authorities, where there is a legal obligation.

5. International transfers

Our server is located in the European Union. Stripe and Google may process some data in the United States; these transfers are covered by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), under which both companies are certified, and by standard contractual clauses approved by the European Commission.

6. Your rights

You can exercise the following rights at any time, free of charge:

Access: find out what data about you we process.
Rectification: correct inaccurate or incomplete data.
Erasure: ask us to delete your data, including your account.
Objection and restriction of processing.
Portability: receive your data in a structured, commonly used format.
Withdraw your consent, where processing is based on it.

Email us at tk.design.media.23@gmail.com saying which right you want to exercise. If we have reasonable doubts about your identity, we may ask for additional information. We will reply within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es).

7. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), passwords stored encrypted, access to data limited to those who need it, and backups.

8. Children

Our services are not aimed at children under 14 and we do not knowingly collect their data. To place orders you must have the legal capacity to enter into contracts.

9. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date. If the change is significant, we will let you know by email.