Privacy policy

The data controller is SIGNES HATS SL, Calle Lepanto 30, 03740 Gata de Gorgos, Alicante, Spain. Questions about data protection go to support@signeshats.live, or by telephone to +34 1815617068.

This policy is written under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD). The supervisory authority is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

We ask for as little as the job requires. In practice that means four situations:

• Placing an order — name, email, phone, delivery address and country. Legal basis: performance of the contract. Without these we cannot deliver anything.
• Contacting us — name, email, optional phone, country, subject and your message. Legal basis: your consent, given by ticking the box on the form.
• Wholesale enquiries — business name, contact details, and the buying details you choose to give us including any head-circumference split. Legal basis: steps taken at your request prior to entering into a contract.
• The seasonal letter — email address only. Legal basis: your consent, asked for separately from anything to do with an order.

We do not collect special category data. We do not profile you, and we take no automated decisions that produce legal effects concerning you.

• Order records: six years, the period Spanish commercial and tax law requires for accounting documentation.
• Head-circumference data, including size splits submitted through the wholesale form: twelve months maximum, then deleted.
• Contact form messages: twenty-four months from the last exchange, so that a follow-up question can be answered in context.
• Newsletter subscription: until you withdraw consent, plus a suppression record so that we do not email you again by mistake.
• Checkout details where payment was not completed: twelve months, so an incomplete order can be followed up. You can ask us to erase them sooner and we will.

We never see or store your card number, expiry date or security code. Those fields are handled entirely within the payment processor's own environment, which is certified to the Payment Card Industry Data Security Standard.

What reaches us is the outcome of the transaction and the details you typed into our own form: name, address, contact details and what you bought.

Only the parties that need to in order to get a hat to you or to run the site:

• The carrier delivering your order, which receives the delivery address and your phone number.
• The payment processor, which receives what it needs to authorise the transaction.
• Our hosting and email providers, which act as processors under contract.
• Public authorities, where the law requires it.

We do not sell personal data and we do not share it for anyone else's marketing. Where a processor is located outside the European Economic Area, the transfer is covered by an adequacy decision or by the European Commission's standard contractual clauses.

You may ask us at any time to give you access to your data, to rectify it, to erase it, to restrict or object to its processing, or to send it to you or another controller in a portable format. Where processing rests on consent, you may withdraw that consent at any time without affecting what was lawful before you did.

Write to support@signeshats.live with enough information for us to identify you. We answer within one month. There is no charge.

If you are not satisfied with our answer, you may complain to the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

This site is not directed at children under 13 and we do not knowingly process their data. Between 13 and 17, an order requires the consent of a parent or guardian, and we ask for the guardian's email address at checkout.

If you believe a child has given us personal data without the necessary consent, tell us and we will delete it.

Strictly necessary cookies keep the bag and the checkout form working. Nothing beyond those runs until you have made a choice in the banner, and the first layer of that banner offers accepting everything and rejecting everything with equal prominence.

Measurement and marketing consents are asked for separately from one another and separately from the processing needed to complete an order. The cookie policy sets out the detail and how to change your mind.

The site is served over HTTPS throughout. Access to order data is limited to the people who need it to do their job, and is protected by individual accounts with two-factor authentication.

No system is perfect. If a breach ever occurs that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours and tell you directly where the law requires it.