Privacy policy

The controller of your personal data is [RAZÓN SOCIAL], with tax identification number (NIF) [NIF] and registered address at [DOMICILIO]. For any matter relating to your data you can write to us at [EMAIL] or call us on [TELÉFONO].

We process your data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Act 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). We are a small family business: we only ask for the data we need, and we neither sell it nor pass it on for advertising purposes.

Data you give us: your first name and surname, delivery and billing address, e-mail address, telephone number, the content of your orders and subscriptions, and the messages you send us through the contact form or by e-mail. If you tell us, also the odd detail about your animals that helps us to advise you.

Payment data: if you pay by card, you enter your card details directly in Stripe’s secure environment; we never see or store them, and we only receive confirmation of the payment and a transaction identifier. If you pay by bank transfer or Bizum, we will see the payer’s name and the payment reference.

Browsing data: our analytics are our own and use no cookies. They record, in aggregate form, the pages visited, the language, the type of device, the referring domain and a random session identifier that is erased when you close the tab. We do not store your IP address in those statistics, nor do we link them to your identity.

Managing your orders and subscriptions, taking payment for them, delivering them, sending you the related e-mails (confirmation, tracking, advance notice of each subscription delivery) and handling returns and guarantees: the legal basis is the performance of the contract of sale (Art. 6(1)(b) GDPR). Issuing invoices and keeping accounting and tax records: compliance with legal obligations (Art. 6(1)(c) GDPR).

Answering your enquiries: taking steps at your request prior to entering into a contract, or our legitimate interest in replying to anyone who writes to us (Art. 6(1)(b) and 6(1)(f) GDPR). Producing anonymous usage statistics, keeping the site secure and preventing fraud: our legitimate interest (Art. 6(1)(f) GDPR).

Sending you occasional news about our hay: only if you have given us your consent (Art. 6(1)(a) GDPR) or, if you are already a customer, about products similar to those you bought, in accordance with Article 21.2 of the LSSI-CE. You can unsubscribe at any time using the link in each e-mail or by writing to us. We do not take automated decisions or carry out profiling that produces effects concerning you.

To provide the service we rely on suppliers that act as data processors, with each of which we have signed the corresponding agreement: Vercel (website hosting), Neon (the Postgres database in which orders are stored), Stripe (card payment processing) and Resend (e-mail delivery). Stripe also acts as an independent controller in order to meet its own obligations regarding fraud prevention and financial regulation.

We give the carrier the data that is strictly necessary for delivery (name, address, telephone number and e-mail address). Our bank, our tax and accounting advisers, and public authorities and courts where there is a legal obligation may also have access to your data. We do not disclose your data to any other third party.

Some of our suppliers (Vercel, Neon, Stripe and Resend) have their parent company in the United States or may process data outside the European Economic Area. In those cases the transfer is covered by the adequacy decision for the EU-US Data Privacy Framework, where the supplier is certified, or by the standard contractual clauses approved by the European Commission, together with any additional safeguards that may be necessary.

You can ask us for more information about these safeguards by writing to [EMAIL].

Order, invoice and payment data is kept for the periods required by commercial and tax law (as a general rule, six years). Subscription data is kept for as long as the subscription is active and, once it has been cancelled, for the limitation periods applicable to any possible liabilities.

Enquiries that do not lead to an order are deleted no later than one year after they have been resolved. Data used to send you news is kept until you unsubscribe or withdraw your consent. Browsing statistics are stored in aggregate form, without any data that could identify you.

Once these periods have elapsed, the data is deleted or irreversibly anonymised.

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given, without affecting the lawfulness of earlier processing. Simply write to [EMAIL] telling us which right you wish to exercise; if we have reasonable doubts about your identity, we may ask you to prove it.

We will reply within one month at the latest, and exercising your rights is free of charge. If you feel we have not dealt with your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es), or with the supervisory authority of your country of residence.

We apply appropriate technical and organisational measures to protect your data: encrypted connections, restricted access to the shop’s administration area, suppliers with recognised security standards, and backups. No system is infallible; should a security breach occur that might affect you, we would notify you and the supervisory authority as required by law.

The shop is intended for people aged 18 or over. We do not knowingly collect data from minors; if you are a parent or guardian and believe that a minor has given us their data, please write to us and we will delete it.

We may update this policy to reflect changes in the law or in the way we process data. We will always publish the current version on this page, with the date of the update, and, if the changes are significant and we have your e-mail address, we will let you know before they take effect.