Privacy

English translation for convenience. The Spanish version is the legally binding one.

• Controller: Sergey Evstegneiev (self-employed), Lloret de Mar (Girona, Spain), hola@arpadeboca.es.
• Requests for items on order: we keep your name, email, comment, country and the products requested, to tell you when they are available and send you the purchase link. Legal basis: pre-contractual steps at your request (art. 6.1.b GDPR). Recipient: only our web hosting provider. Retention: up to 12 months without an order; then deleted. You can withdraw the request at any time by writing to hola@arpadeboca.es.
• Orders (once in stock): handling orders, shipping, invoicing and customer service; legal basis: performance of the contract (art. 6.1.b GDPR) and tax obligations (6.1.c); recipients: carrier, payment provider and accountant; retention: invoicing data 6 years (Spanish Commercial Code) / 4 years (General Tax Law).
• Your rights: access, rectification, erasure, objection, restriction and portability at hola@arpadeboca.es; complaints to the Spanish Data Protection Agency (aepd.es).
• Our own statistics, without cookies: when you visit the site we record the page viewed, the referring page, campaign parameters (utm, gclid) and actions such as playing a recording or adding to the cart, to learn what interests visitors and where they come from. We store nothing on your device and do not keep your IP: from the IP and browser we compute an encrypted code that changes every day. Legal basis: legitimate interest (art. 6.1.f GDPR). Retention: 26 months.
• Google Analytics and Google Ads (only if you accept): measuring visits and the effectiveness of our ads with cookies from Google Ireland Ltd. Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time from «Cookies» in the page footer. Google may process data in the USA under the EU-US Data Privacy Framework. Details in the cookie policy.
• Local storage: the cart, language, shipping country and your cookie choice, strictly necessary (no prior consent needed, art. 22.2 LSSI).