Privacy policy
Last updated: 19 October 2026
Courtesy translation. In case of discrepancy, the Spanish version prevails.
1. Data controller
In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you that the controller of your data is:
- Owner: [Legal name] (trading name: Planet Vintage)
- Tax ID (NIF/CIF): [Tax ID (NIF/CIF)]
- Address: [Address]
- Contact for privacy matters: [Email]
2. What data we process
- Identity and contact: first name, surname, email and telephone number.
- Delivery and billing: addresses and, if you request an invoice, your tax ID.
- Order: items purchased, amounts, status and order history.
- Payment: transaction reference and status. We do not receive or store your full card number: it is handled by the payment provider.
- Account: email and password (stored encrypted), if you create an account.
- Technical: IP address, device and browser type, and security logs.
- Preferences: the language you choose on the Website.
- Communications: the messages you send us.
You provide the data yourself or it is generated when you use the Website. We do not make automated decisions or build profiles that have legal effects on you.
3. What we use it for, legal basis and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing your account and orders: sign-up, purchase, delivery and after-sales support. | Performance of a contract (Art. 6(1)(b) GDPR). | For as long as the relationship lasts and, afterwards, blocked for the limitation periods. |
| Meeting legal obligations: invoicing, accounting, tax and consumer law. | Legal obligation (Art. 6(1)(c) GDPR). | The periods set by law, which generally range from 4 to 6 years. |
| Answering enquiries, requests and complaints. | Pre-contractual steps or legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR). | The time needed to deal with them and the limitation periods. |
| Website security and prevention of payment and access fraud. | Legitimate interest (Art. 6(1)(f) GDPR). | The time strictly necessary for that purpose. |
| Sending you marketing communications or a newsletter, only if you subscribe. | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. | Until you withdraw your consent. |
| Remembering the language you choose. | Legitimate interest; it is a preference you decide. | 12 months. |
4. Who we share your data with
We do not disclose your data to third parties except where required by law. To provide the service, the following have access to it as processors, under a contract that obliges them to protect it:
- Stripe Payments Europe, Ltd.: payment processing.
- Supabase: database and account authentication.
- Vercel Inc.: website hosting.
- [Email provider]: sending transactional emails (order confirmations and status updates).
- Carriers and couriers: delivering your order (name, address and telephone number).
- Tax and accounting advisers: invoicing and tax obligations.
- Public authorities, judges and courts, where the law requires it.
5. International transfers
Some of these providers may process data outside the European Economic Area, for example in the United States. In that case the transfer relies on appropriate safeguards: a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses. You can ask for information about them at [Email].
6. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, by writing to [Email] and stating which right you wish to exercise. We may ask for a document proving your identity. We will reply within one month, which may be extended as the GDPR allows.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence, such as the Information Commissioner's Office in the UK (www.ico.org.uk).
7. Minors
Purchases on the Website are reserved for people aged 18 or over. Children under 14 may not give us personal data without the consent of their parents or guardians (Art. 7 LOPDGDD). If we find data from a minor without that consent, we will delete it.
8. Security
We apply appropriate technical and organisational measures: encrypted communications, role-based access control, passwords stored in encrypted form, and access limited to those who need it. If a security breach affecting your data occurs, we will act and notify it as required by law.
9. Changes to this policy
We may update this policy to reflect changes in the law or on the Website. The current version is the one published here, with the update date shown at the top.