Privacy policy
What personal data we use, why, for how long and how you can control it.
Last updated: 5 November 2026
Data controller
THEFULLART TCG, SOCIEDAD LIMITADA, tax ID (NIF) [NIF], registered office at [DOMICILIO SOCIAL]. [DATOS REGISTRALES]. Email: [EMAIL DE CONTACTO]. Phone: [TELÉFONO]. For any question about your data, write to [EMAIL DE CONTACTO].
What data we process
- Contact and shipping details: name, email, postal address and, if you give it, phone number.
- Order data: products, amounts, the payment method used (for example “card” or “Bizum”) and shipping status. Your card details are handled directly by Stripe: we never see or store them.
- Account data, if you create one: email, encrypted password (never stored in plain text), addresses, wishlist and restock alerts.
- Technical data: IP address and session data, to keep the website secure (for example, limiting sign-in attempts).
“See it in your hand” uses your device's camera, but the image is processed only in your browser: we never receive or store it.
Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing your purchase: payment, packing, shipping, support and returns | Performance of the contract (art. 6.1.b) |
| Creating and keeping your customer account | Performance of the contract you accept when you sign up (art. 6.1.b) |
| Letting you know when a card is back in stock | Your consent, which you can withdraw at any time (art. 6.1.a) |
| Invoicing, accounting, tax and consumer law obligations | Legal obligation (art. 6.1.c) |
| Website security and fraud prevention | Legitimate interest in protecting the store and its customers (art. 6.1.f) |
We don't send you advertising by email or build marketing profiles. If we ever offer a newsletter, we'll ask for your permission separately.
How long we keep it
- Orders and invoicing: 6 years, as required for accounting records (art. 30 of the Spanish Commercial Code), and in any case for as long as the guarantee lasts.
- Customer account: until you delete it. You can do it yourself under My account → My details.
- Restock alerts: until we notify you or you cancel them.
- Security technical data: only as long as needed for that purpose.
After those periods, the data is deleted or anonymised.
Who we share it with
Only with the providers we need to serve you, who process the data on our behalf under a data processing agreement:
- Stripe Payments Europe, Ltd. (Ireland), to process payments. Stripe also processes some data as an independent controller to prevent fraud and meet its legal obligations.
- Our web hosting provider (Cosmosdata), where the website, the database and the store's email run.
- The carrier delivering your order (for example Correos or SEUR), which receives your name, address and, if given, phone number.
We may also have to disclose data to tax authorities, courts or other authorities when the law requires it.
Transfers outside the European Economic Area
Stripe may process data in the United States. It does so with GDPR safeguards: the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission.
Your rights
You can ask to access, correct or delete your data, object to or restrict its processing, and request its portability. If you gave us consent, you can withdraw it at any time, without affecting what was done before. Write to [EMAIL DE CONTACTO] saying which right you want to exercise; if we need to verify your identity, we'll tell you.
If you have an account, under My account → My details you can download all your data or delete the account yourself.
If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).
Minors
You must be at least 14 to create an account (art. 7 of Spanish Organic Law 3/2018). Purchases must be made by an adult or with their authorisation.
Security
The website always uses an encrypted connection (HTTPS), passwords are stored hashed with Argon2 and access to the store's admin panel requires two-step verification.