1. Data controller
The controller of your personal data is:
FLOFUM, S.L.
Calle Parcerisa 13, Local 1, 08014 Barcelona, Spain
CIF B75621250
Email: support@casena-store.com
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable Spanish data protection law.
A data protection officer is not appointed, as our processing does not meet the criteria in Article 37 GDPR. Privacy enquiries should be sent to the email address above.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact data | Name, delivery address, email address, telephone number | You, when ordering or contacting us |
| Order data | Items ordered, quantity, price, order reference, delivery status, amount collected on delivery | Generated when you order |
| Refund data | IBAN and account holder name, supplied only where a refund is due | You, when requesting a refund |
| Correspondence | Emails, contact form messages, notes of telephone calls about your order | You, when you contact us |
| Technical data | IP address, browser type and version, device type, operating system, referring page | Collected automatically by our web server |
| Usage data | Pages viewed, time on page, navigation path | Analytics cookies, only with your consent |
We do not collect payment card data. Our only payment method is cash paid to the courier on delivery, so no card, CVV or bank credential ever passes through this website.
We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
3. Why we use it, and our legal basis
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Taking, confirming and delivering your order | Identity, contact, order | Performance of a contract — Art. 6(1)(b) |
| Contacting you about an order by phone or email | Identity, contact, order | Performance of a contract — Art. 6(1)(b) |
| Handling returns, refunds and warranty claims | Order, refund, correspondence | Performance of a contract — Art. 6(1)(b) |
| Answering enquiries you send us | Contact, correspondence | Legitimate interests — Art. 6(1)(f) |
| Keeping accounting and tax records | Identity, order | Legal obligation — Art. 6(1)(c) |
| Site security, fraud prevention and abuse detection | Technical | Legitimate interests — Art. 6(1)(f) |
| Measuring how the website is used | Usage, technical | Consent — Art. 6(1)(a) |
| Sending marketing emails | Contact | Consent — Art. 6(1)(a) |
Where we rely on legitimate interests, we have assessed that our interest in operating and securing the business does not override your rights and freedoms. You may object to that processing at any time — see section 7.
4. Who we share it with
We do not sell your personal data and we do not share it for other companies' marketing. We share it only with:
- Courier and logistics partners — your name, address and telephone number, so the parcel can be delivered and the cash payment collected.
- Our web host and IT providers — who store the site and its data on our instructions.
- Our accountants and tax advisers — for invoicing and statutory reporting.
- Analytics providers — only where you have consented to analytics cookies.
- Public authorities — where we are legally required to disclose, for example in response to a valid order from a court or regulator.
Service providers act as processors under written contracts that require them to process data only on our instructions and to keep it secure.
5. Transfers outside the EEA
We keep personal data within the European Economic Area wherever possible. Where a provider processes data outside the EEA, we ensure an appropriate safeguard is in place under Chapter V GDPR — an adequacy decision of the European Commission, or Standard Contractual Clauses. You may request a copy of the safeguard applying to a specific transfer by writing to us.
6. How long we keep it
| Data | Retention period |
|---|---|
| Order and invoice records | 6 years, to meet Spanish commercial and tax obligations |
| Refund bank details | Deleted once the refund has cleared and the accounting entry is closed |
| Enquiries not resulting in an order | 24 months from last contact |
| Server and security logs | 12 months |
| Analytics data | 14 months |
| Marketing consent records | Until you withdraw consent, plus 3 years as proof that consent was given |
At the end of the period the data is deleted or irreversibly anonymised.
7. Your rights
Under the GDPR you have the right to:
- Access — obtain confirmation of whether we process your data and receive a copy of it
- Rectification — have inaccurate or incomplete data corrected
- Erasure — have your data deleted where one of the grounds in Article 17 applies
- Restriction — have processing limited in the circumstances set out in Article 18
- Data portability — receive data you gave us in a structured, machine-readable format, and have it transmitted to another controller
- Object — object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent — at any time, without affecting processing carried out before withdrawal
To exercise any of these, email support@casena-store.com. We reply within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. Exercising your rights is free of charge; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive.
We may need to verify your identity before acting, to make sure we do not disclose your data to someone else.
8. Right to complain
If you believe we have handled your data unlawfully, you may lodge a complaint with the Spanish supervisory authority:
Agencia Española de Protección de Datos
C/ Jorge Juan 6, 28001 Madrid, Spain
www.aepd.es
You may also complain to the supervisory authority in your own EU country of residence or place of work.
9. Security
We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS) across the website, access controls limiting staff access to what their role requires, and regular software updates on our hosting platform.
No transmission over the internet is completely secure, and we cannot guarantee absolute security. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority as required by Articles 33 and 34 GDPR.
10. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
11. Cookies
Cookies and similar technologies are described separately in our Cookie Policy, including how to change your choices.
12. Links to other websites
This website may link to third-party sites. We are not responsible for their content or privacy practices, and this policy does not apply to them. Please read their privacy notices before providing personal data.
13. Changes to this policy
We may update this policy to reflect changes in our processing or in the law. The current version is always published on this page with the date it took effect. Where a change is material we will draw attention to it on the website.
14. Contact
FLOFUM, S.L., Calle Parcerisa 13, Local 1, 08014 Barcelona, Spain — support@casena-store.com