Privacy Policy

This policy explains what personal data we collect when you use this website or buy from us, why, and what rights you have. We only collect what we need and we never sell your data.

Who is responsible

The data controller is Arcanae Craft.

What we collect

• Order data: your name, shipping and billing address, email, phone (if given) and order details, so we can process and deliver your order.
• Payment data: payments are handled by Stripe. Stripe processes your card details directly; we only receive confirmation of payment and limited information such as the last four digits. We never store full card numbers.
• Newsletter: your email address, if you choose to sign up.
• Technical data: basic information your browser sends (such as IP address and device/browser type) and essential cookies needed for the site and cart to work.

Why we use it, and our legal basis

• To fulfil your order: performance of our contract with you (GDPR Art. 6(1)(b)).
• To meet legal and tax obligations: for example issuing and keeping invoices (Art. 6(1)(c)).
• To send the newsletter: your consent, which you can withdraw at any time (Art. 6(1)(a)).
• To keep the site secure and working: our legitimate interest (Art. 6(1)(f)).

Who we share it with

We share data only with providers who help us run the shop, and only as needed:

• Stripe: payment processing.
• Shipping brokers and couriers (such as Packlink, Correos, GLS, SEUR, DHL, UPS), used to deliver your order.
• Google Firebase: website hosting and infrastructure.

Some of these providers may process data outside the European Economic Area (for example in the United States). Where they do, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

Order and invoice data is kept for as long as the law requires (commercial and tax records in Spain are typically kept for up to six years). Newsletter data is kept until you unsubscribe.

Your rights

You can ask us to access, correct, delete, restrict or port your data, or object to a use of it, and you can withdraw consent at any time. Write to us and we will respond within the legal time limits. You also have the right to complain to the Spanish Data Protection Agency (AEPD) at aepd.es.

Security

We use reasonable technical and organisational measures to protect your data, and payments run over Stripe's secure, PCI-compliant systems.

Children

This shop is intended for adults and is not directed at children.

Changes

We may update this policy; the current version is always the one published here.