Privacy policy
Last updated: 08/09/2026
This policy explains how personal data is handled on statoflama.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
The full identification details of the controller are set out in the legal notice. Contact address for data protection matters: hola@statoflama.com.
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Managing your order, shipping and after-sales | Name, shipping and billing address, email, phone, order details | Performance of a contract (art. 6.1.b GDPR) | For the duration of the relationship and afterwards for applicable tax and guarantee periods (up to 6 years) |
| Taking payment | Payment data handled directly by Stripe; we only see the result and the last digits | Performance of a contract | As required by invoicing law |
| Replying to your message from the contact form | Name, email, subject and message content | Consent (art. 6.1.a GDPR) | 1 year from the last communication |
| Site security and abuse prevention | IP address, timestamp, technical browser data | Legitimate interest (art. 6.1.f GDPR) | 12 months maximum |
| Audience measurement (only if you accept) | Cookie identifiers and browsing data | Consent | See the cookie policy |
We do not process special categories of data and we do not make automated decisions with legal effects on you. No registration is required to buy.
3. Recipients
- Stripe Payments Europe, Ltd. (Ireland) — payment processing and fraud prevention. It acts as an independent controller for payment data.
- The courier assigned to each shipment — name, address, phone and email for delivery.
- Hosting and email provider — Hostinger International Ltd., with servers in the European Union, as a data processor.
- Public authorities where there is a legal obligation.
We do not sell or share your data with third parties for advertising. Where a provider involves international transfers, they are carried out with the safeguards of Chapter V of the GDPR (adequacy decisions or standard contractual clauses).
4. Your rights
You may at any time request access to your data, its rectification or erasure, the restriction of or objection to processing, and portability. You may also withdraw consent, without affecting the lawfulness of processing carried out beforehand.
Write to hola@statoflama.com stating the right you wish to exercise. We reply within one month. If you believe your request has not been handled properly, you may complain to the Spanish Data Protection Agency (aepd.es).
5. Security
The site runs entirely over HTTPS. Card details never pass through our servers: they are collected and held by Stripe, certified PCI-DSS Level 1. We apply access control, regular backups and protection of forms against automated submissions.
6. Minors
This site is not aimed at children under 14, who should not provide personal data without the authorisation of a parent or guardian.
7. Changes
If this policy changes, the new version is published here with an updated date.