Privacy Policy & GDPR

The controller of your personal data is:

• Controller: Tina Kostresevic
• Tax ID (NIE): Z2018058C
• Address: Calle San Claudio 13, 38631 Las Galletas
• Email: info@magneticcanarias.es
• Phone: +34 612 437 184

Depending on your relationship with us, we may process:

• Identification and contact data: name and surname, email address, phone number.
• Delivery and billing data: address, postcode, island or town and, where relevant, professional tax number.
• Order data: products, amounts, purchase history and shipment status.
• Payment data: handled directly by our payment provider; we only receive payment confirmation and partial transaction details.
• Account data: email address and login credentials, managed by our authentication provider.
• Communication data: messages sent by email, contact form or social media.
• Shop assistant queries: the text you type into the assistant chat. We do not ask for personal data in the chat and recommend you do not include any.

Some data is necessary to process an order: name and surname, email address, contact phone number and a complete delivery address (or your choice of in-person pickup). This data is essential in order to manage the purchase, make the delivery, issue the required sales documentation and comply with our legal, accounting and tax obligations.

If you do not provide the data necessary for these purposes, we will not be able to complete the order or provide the requested service. Any other data is optional and its absence may only limit the quality of our service (for example, delivery notifications).

Each purpose relies on a specific GDPR legal basis:

• Managing orders, payments, shipping, in-person pickup, returns and warranties: performance of the contract (Art. 6(1)(b) GDPR).
• Creating and managing your customer account and access to your order history: performance of the contract at your request (Art. 6(1)(b) GDPR).
• Answering enquiries received through the contact form or by email: performance of the contract where they concern an order, or your consent and our legitimate interest in responding to requests for information (Art. 6(1)(b) or 6(1)(f) GDPR).
• Issuing and keeping sales documents and accounting and tax records: compliance with legal obligations (Art. 6(1)(c) GDPR).
• Sending newsletters and commercial messages: your prior consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Payment fraud prevention and security of the online shop: our legitimate interest in protecting the shop and our customers against fraudulent use (Art. 6(1)(f) GDPR).
• Handling complaints and defending against possible legal claims: our legitimate interest in exercising or defending our rights (Art. 6(1)(f) GDPR).
• Automatic answers to questions about products and shipping through the shop assistant: our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). Using the assistant is voluntary.

We do not sell or share your data with third parties for advertising purposes. In order to run the shop we share only the data strictly necessary with the following categories of recipients, which act as processors or as independent controllers as appropriate:

• Payment provider (Stripe Payments Europe, Ltd. and its group): processes card payments and any refunds. It receives the order and contact data needed for the transaction and for fraud prevention; full card details are entered directly in its secure environment and we never store them.
• Hosting and database provider (Vercel for website hosting and Supabase for the database and image storage): securely stores the shop content, accounts and orders so that the website can operate.
• Authentication and account provider (Supabase Auth): handles registration, sign-in and password recovery. If you choose to sign in with Google, Google shares your name and email address with us; we do not use reCAPTCHA.
• Email providers (Resend for transactional and account emails, sending from magneticcanarias.es; Lovable's email service for the newsletter, sending from notify.magneticcanarias.es): send order confirmations, status updates, payment reminders, account emails and, where you have consented, the newsletter on our behalf.
• Shop assistant provider (a language model from OpenAI or a compatible provider): receives the text of your question and the catalogue information needed to answer it. It does not receive your name, email or orders.
• Carrier or postal service (Correos): the website does not transmit your data to the carrier automatically; when we prepare the shipment we manually provide Correos with the name, delivery address and phone number needed for delivery. If you choose in-person pickup, no data is shared with a carrier.
• Google embedded font and map services (Google Fonts across the site and an embedded Google Maps map only on the "Find us" page): when these load, your browser connects directly to Google, which may process your IP address and technical browser data.
• Professional advisers and public authorities: our accounting and tax adviser, and public bodies or courts, only where there is a legal obligation or where it is necessary to exercise or defend rights.

Some of the providers we actually use (Stripe, Supabase, Vercel, Resend, OpenAI, Lovable and Google) belong to groups whose parent companies are in the United States. As a result, some data may be processed or accessed from third countries, mainly the United States.

Where that happens, the transfer relies on the mechanisms set out in Chapter V of the GDPR: an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework where the provider is certified) or, failing that, Standard Contractual Clauses approved by the European Commission together with additional technical and organisational measures such as encryption in transit and at rest.

You can ask us about the safeguards applicable to a specific provider by writing to info@magneticcanarias.es.

We keep each category of data for the period set out below and, in any event, only for as long as there is a legitimate purpose:

• Customer and order data: for the duration of the contractual relationship and afterwards for the retention periods required by applicable accounting and tax rules and the applicable limitation periods for legal claims.
• Sales documents and accounting records: for the statutory retention period laid down by Spanish tax and accounting rules.
• Customer account data: for as long as you keep the account active; if you ask us to delete it, the data is erased except for data we must retain by law.
• Marketing and newsletter data: until you withdraw consent or unsubscribe, and thereafter only the minimum record of the unsubscribe needed to respect your decision.
• Customer support communications: for as long as necessary to resolve the enquiry or incident and, where legal obligations or a potential claim arise from it, for the applicable period.
• Complaints and returns: while they are being handled and for the period during which liability may arise.

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Our payment provider may apply its own automated anti-fraud checks as part of processing the transaction; commercial decisions about your order are always taken by us manually.

Artificial intelligence notice (Article 50 of Regulation (EU) 2024/1689): the shop assistant is an artificial intelligence system. Its answers are generated automatically from our catalogue and shipping information, may contain errors and are not professional advice. It does not take decisions about your order. For any question a person will help you at info@magneticcanarias.es.

You may exercise the following rights at any time:

• Access: to know whether we process your data and to obtain a copy of it.
• Rectification: to correct inaccurate data or complete incomplete data.
• Erasure: to have your data deleted where it is no longer necessary or the processing is not justified.
• Restriction of processing: to ask us to suspend the use of your data in the cases provided for by the GDPR.
• Objection: to object to processing based on our legitimate interests and, at any time, to the sending of commercial messages.
• Portability: to receive the data you provided to us in a structured, commonly used format, or to have it transmitted to another controller where technically feasible.
• Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

Write to info@magneticcanarias.es stating which right you wish to exercise. We may ask you to verify your identity. We will respond within the time limits set by the GDPR.

If you believe your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We are not required to appoint a Data Protection Officer and have not appointed one: you can address any privacy matter to the email above.

This shop only uses strictly necessary technical storage in your browser: local storage keeps your customer account session (Supabase Auth), your shopping cart contents and the language you selected, and session storage temporarily holds your order details during checkout. We set no tracking cookies of our own; the admin area uses one technical cookie to remember whether the side menu is open. These technologies are essential to provide the service you request and, under applicable law, do not require prior consent.

We do not use Google Analytics, Google Tag Manager, the Meta or TikTok pixel, Microsoft Clarity, Hotjar, reCAPTCHA, or any other analytics, advertising, tracking script or social media widget, and we do not build advertising profiles.

We do embed Google content: the site fonts (Google Fonts) and, only on the "Find us" page, a Google Maps map. When these load, your browser connects to Google, which may process your IP address and technical data for security and content delivery purposes. If we introduce non-essential cookies or tracking technologies in the future, we will ask for your prior consent through a notice that lets you accept or refuse them just as easily.

If you subscribe to our newsletter, our newsletter emails contain a small tracking image and redirected links that let us see whether the email was opened and whether a link was clicked. This measurement only applies to newsletter emails you have consented to receive, not to the website itself, and you can stop it at any time by unsubscribing.

You can block or delete cookies in your browser settings; if you disable the strictly necessary ones, the shop may not work correctly.

We apply appropriate technical and organisational measures to protect your data, including encrypted communications, access control to the shop administration and database access rules that limit the information visible to each user.

For any privacy matter: info@magneticcanarias.es · +34 612 437 184 · Calle San Claudio 13, 38631 Las Galletas