Privacy policy

This is an English translation for your convenience. The Spanish version is the one that applies. Read the Spanish version

Controller

The data controller is the owner of this shop:

Owner: Nelson Varas U, trading as “Luliette 3D”.
Tax ID (NIF): 60877371M.
Address: C/Euskadi 1.
Contact email: contacto@blackcalb.es.
Website: dev.luliette.es.
Business: online sale of 3D-printed pieces.

What data we process, what for and on what basis

To prepare, ship and charge your order and tell you how it's going: your name, email, phone and address and, for a gift, the card's message you write us, kept with your details and deleted with them. Basis: the contract (article 6.1.b GDPR).
To issue the invoice and keep the books: the order's details and, if you ask for a full invoice, your tax details. Basis: legal obligation (article 6.1.c GDPR).
To send you your order's link again when you ask: your email. Basis: the contract (article 6.1.b GDPR).
To answer a quote request: what you tell us, the images or 3D models you attach and how to contact you. Basis: the pre-contractual steps you ask us for (article 6.1.b GDPR). Photos can carry data such as where they were taken: if you don't want to share it, remove it before attaching them.
To tell you when a sold-out piece is back, if you ask on its page ("Tell me when it's back"): your email, the piece and the language. Basis: your consent (article 6.1.a GDPR), which you give by confirming the alert from the email we send you; unconfirmed, we don't write again. You can withdraw it at any time with the "Not interested any more" link in each email, which deletes the alert.
For your account, if you create one (it's optional: you can buy without it): your email, which you confirm with a code we send you, and your language; your favourites; the delivery addresses you save (who it goes to, their phone and the address), until you remove them or delete the account; the personal coupons we give you, which work only with your account, and an encrypted fingerprint of your email (not the email) with which the shop finds your account to give you one without seeing any list of customers; your orders, those you place signed in and those you placed before without an account with that same email, which join it; and, while you're signed in, a session in each browser (the kind of device and when you used it). Your account also shows your "Tell me when it's back" alerts made with that email. Basis: the contract for the account you ask us for (article 6.1.b GDPR).
To send you the shop's news and offers, if you subscribe (in the shop's footer or in your account): your email, your language and the record of your consent (the text you accepted, when and from where). Basis: your consent (article 6.1.a GDPR and article 21 of Spanish Law 34/2002), which you give by confirming the subscription from the email we send you or, signed in to your account, by ticking the box. If you don't confirm it within 48 hours, we delete the request. You can withdraw it at any time with the "Unsubscribe" link in each email or from your account; we keep, pseudonymised (without your email), the fact that you unsubscribed and how you had given your consent, as proof. If the shop offers a welcome gift, when you confirm we give you a single-use code, shown on the confirmation page (and in "My coupons" if you have an account) and never emailed; to give it only once we keep that code with a keyed summary of your email (never the email), for up to two years.
So that a discount code valid once (or a few times) per customer works that way: an encrypted summary of your email or your account, never the email, and how many times you used it. Basis: our legitimate interest in applying each promotion as announced (article 6.1.f GDPR).
To prevent abuse, such as repeated attempts: an encrypted summary of the IP address that can't identify you. Basis: our legitimate interest in protecting the shop (article 6.1.f GDPR).

The order's details are needed: without them we can't fulfil it. We don't create profiles or make automated decisions about you, and we only send you news and offers if you subscribe.

How long

An order's shipping and contact details are kept 3 years from delivery, the guarantee's term, then deleted by themselves.
If a payment isn't completed, they are deleted when its time runs out; if you had tried to pay and reached the page that confirms it, we keep them 3 more days, to tell you by email how it ended (and, if the payment arrives late, that we've refunded it).
Invoices and the books are kept 6 years, as article 30 of the Commercial Code requires.
A quote request, with its images and models, is deleted one year after it arrives, whether or not an order came of it (an order keeps its own details); if we turn it down, 30 days after that.
Your account, if you create one, is kept until you delete it from "Your account"; deleting it also deletes your favourites, your saved addresses, your personal coupons, your alerts and your sessions, and your orders and their invoices are kept, no longer linked to any account, only as long as the law requires. Each browser's session closes after 30 days unused and, at most, after 90; a sign-in code works for 10 minutes.
A "Tell me when it's back" alert not confirmed is deleted after 48 hours; a confirmed one is kept until the piece is back and we've told you, or until you withdraw it with "Not interested any more", and is deleted then (also if we delete the piece from the shop). Anything expired stops being used at once and is fully erased within the following days.
How many times you used a code valid once (or a few times) per customer is kept, with an encrypted summary of your email or your account, until 30 days after the promotion ends and, at most, 2 years after the last use. While a payment with that code is pending, its record also keeps that summary, and deletes it when the payment completes or expires (if the amount paid doesn't match, when we review the order).
A subscription to the news not confirmed is deleted after 48 hours; a confirmed one is kept until you unsubscribe, and is deleted then: we only keep, pseudonymised (without your email), the fact that you unsubscribed and how you had given your consent, for 3 years, as proof.
The newsletter's welcome gift, if there is one, is kept with a keyed summary of your email (never the email) for two years, so it is given only once.

Who processes it for us

Amazon Web Services: hosting, signing in to your account and sending emails.
The payment provider, once card payment is switched on.
Our invoicing tool, to issue your order's invoice.
The carrier, to deliver your order.

International transfers

The data is hosted in the European Union. Amazon Web Services belongs to a US group: its contract includes the European Commission's standard contractual clauses, and the company takes part in the EU-US Data Privacy Framework.

Your rights

You can ask for access, rectification, erasure, objection, restriction or portability by writing to the contact email. If you have an account, in "Your account" you can also download your data and delete the account yourself, with a code we send you to confirm it's you. If we don't deal with it properly, you can complain to the Spanish Data Protection Agency (aepd.es).