1. Data Controller Identification

The personal data provided by users is processed by María [APELLIDOS], operating under the commercial name “Bobbin Circular”, with NIF [NIF] and registered address at [Dirección completa de la tienda], Valencia, España.

For any matter related to personal data, you may contact us at [Email de contacto].

2. Categories of Data We Collect

We may collect and process the following categories of personal data:

a) Identification and Contact Data

• Name and surname
• Valid identification document (DNI, NIE, or passport)
• Telephone number
• Email address
• Postal address (only when necessary for contractual or legal purposes)

b) Consignor Account Data

• Identification data
• EU IBAN only (for payout transfers)
• Information about items delivered, pricing, sales, and payout history
• Internal notes required to manage the consignment relationship
• Communications related to consignment (WhatsApp, email, website forms)

c) Transactional and Accounting Data

• Sales and payout records
• Item identification (brand, description, SKU, size, price)
• Commission calculations
• Accounting records required under Spanish tax law

d) Communications Data

• Messages sent via WhatsApp, email, or website contact forms
• Customer service interactions and requests

e) Newsletter and Communication Preferences

• Email address
• Consent preferences (“Announcements” and/or “Offers”)
• Users may modify or withdraw these preferences at any time

f) Visual and Media Data

• Photographs or videos taken only with prior explicit consent, for promotional or community purposes

g) Website and Technical Data

• Limited, aggregated technical information about website usage (e.g. page visits, traffic patterns)
• Collected through a cookieless, privacy-friendly analytics solution
• Does not use cookies and does not identify individual users

h) Social Media

• We do not collect or store personal data from social media platforms
• Interactions remain within the platform and are governed by its own privacy policies

Data Minimisation Statement

Bobbin Circular does not collect personal data for commercial exploitation, advertising profiles, or resale. All data processing is strictly limited to: (i) managing the consignment contract, (ii) complying with Spanish legal obligations, or (iii) sending communications only when the user has explicitly requested them. We do not process personal data for purposes unrelated to our services.

3. How We Collect the Data

a) Directly from the User

• When entering into a consignment agreement
• When presenting identification and EU IBAN details
• When contacting us via WhatsApp, email, phone, or website forms
• When subscribing to the newsletter
• When providing consent for photography
• When requesting information or services

b) Automatically Through the Website

• Aggregated, non-identifying usage data
• Technical data required for website security and performance
• Collected without cookies or user tracking

4. Purpose of Processing

Personal data is processed exclusively for the following purposes:

a) Management of the Consignment Service

• Accepting items
• Setting prices
• Tracking sales
• Calculating payouts
• Managing returns or donations
• Communicating with consignors

b) Contractual Relationship

• Establishing, managing, and fulfilling the consignment agreement

c) Customer Service

• Responding to inquiries, requests, and communications

d) Newsletter and Communications (With Consent)

• Sending store announcements and/or offers selected by the user

e) Photography and Media (With Consent)

• Using images solely for agreed promotional or community purposes

f) Website Operation and Improvement

• Understanding aggregated website usage
• Ensuring proper functionality through cookieless analytics

g) Legal and Accounting Compliance

• Meeting obligations under Spanish tax, accounting, and commercial law

5. Legal Basis for Processing

Processing is carried out based on:

a) Contract Execution

• Art. 6(1)(b) GDPR

b) Legal Obligations

• Art. 6(1)(c) GDPR

c) User Consent

• Art. 6(1)(a) GDPR

d) Legitimate Interest

• Art. 6(1)(f) GDPR
• Limited to customer service, website security, and operational needs

e) Pre-contractual Measures

• Art. 6(1)(b) GDPR

6. Data Retention

Personal data is retained only for as long as necessary:

a) Consignor and Accounting Data

• 5–6 years (legal requirement)

b) Communications

• 12–24 months, unless legally required longer

c) Newsletter Data

• Until consent is withdrawn

d) Photographs

• Until consent is withdrawn

e) Aggregated Analytics Data

• Retained only for statistical purposes
• Does not allow user identification

f) GDPR Rights Requests

• Up to 3 years

7. Sharing of Data and Third Parties

We do not sell personal data.

Data may be shared only when strictly necessary and under GDPR-compliant agreements with:

a) Accounting and Administrative Professionals

b) Financial Institutions

• For EU IBAN payout transfers only

c) Website and Technical Service Providers

• Operating within the European Union

d) Communication and Newsletter Service Providers

e) Public Authorities

• Only when legally required

8. International Data Transfers

a) Analytics

• We do not transfer personal data internationally for analytics or profiling purposes

b) Exceptional Cases

• If any limited technical data is processed outside the EEA, appropriate safeguards (such as Standard Contractual Clauses) will apply

9. User Rights

Users have the right to:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Objection
• Withdraw consent at any time

Users may also lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

Requests can be sent to [Email de contacto].
Proof of identity may be required.

10. Cookies

• We do not use cookies for analytics, advertising, or profiling
• We may use strictly necessary technical cookies for website functionality and security
• These cookies do not track users and do not require consent
• Website usage is measured using a cookieless, privacy-friendly analytics solution

11. Security Measures

We apply appropriate technical and organisational measures, including:

• Restricted access to data
• Secure digital storage
• Encrypted communications where supported
• Regular system updates
• Secure handling and disposal of documents
• GDPR-compliant agreements with service providers

12. Updates to This Privacy Policy

This Privacy Policy may be updated to reflect changes in legal requirements or our practices.
The latest version will always be available on www.bobbin.es.

13. Contact Information

María [APELLIDOS]
Operating under the commercial name “Bobbin Circular”
NIF: [NIF]
Address: [Dirección completa], Valencia, España
Email: [Email de contacto]