1 · Who is responsible
The controller of your personal data is:
FLOFUM, S.L.
Calle Parcerisa 13, Local 1, 08014 Barcelona, Spain
CIF B75621250
support@tooly-kit.com
Processing is carried out under Regulation (EU) 2016/679 (the GDPR) and the national data protection law of Spain.
No data protection officer has been appointed; our processing does not meet the Article 37 thresholds. Privacy questions go to the address above.
2 · What we hold
| Category | Specifically | Source |
|---|---|---|
| Identity & contact | Name, delivery address, email, telephone | You, when ordering or writing to us |
| Order | Items, quantity, price, reference, delivery status, sum collected | Created when you order |
| Refund | IBAN and account holder — only where a refund is due | You, when claiming |
| Correspondence | Emails, form messages, notes of order calls | You |
| Technical | IP address, browser, device, operating system, referrer | Our web server, automatically |
| Usage | Pages seen, time on page, navigation path | Analytics cookies — only with consent |
No payment card data is collected, because none exists to collect. Our only payment method is cash to a courier, so no card number, CVV or banking credential ever touches this website.
We do not knowingly gather data from children under 16. Tell us if you believe we have and it will be deleted.
3 · Why, and on what legal basis
| Purpose | Data | Article 6 basis |
|---|---|---|
| Taking, confirming and delivering your order | Identity, contact, order | Contract — 6(1)(b) |
| Calling or emailing you about that order | Identity, contact, order | Contract — 6(1)(b) |
| Returns, refunds and warranty claims | Order, refund, correspondence | Contract — 6(1)(b) |
| Answering an enquiry | Contact, correspondence | Legitimate interests — 6(1)(f) |
| Accounting and tax records | Identity, order | Legal obligation — 6(1)(c) |
| Security, fraud and abuse detection | Technical | Legitimate interests — 6(1)(f) |
| Understanding how the site is used | Usage, technical | Consent — 6(1)(a) |
| Marketing email | Contact | Consent — 6(1)(a) |
Where we rely on legitimate interests we have weighed them against your rights and freedoms and concluded ours do not override yours. You can object at any time — see section 7.
4 · Who else sees it
We do not sell your data and we do not share it for anyone else's marketing. It goes only to:
- Couriers and logistics partners — name, address, phone, so the parcel arrives and the cash is collected
- Our host and IT suppliers — who store the site and its data on our instructions
- Accountants and tax advisers — for invoicing and statutory filing
- Analytics providers — only where you consented to analytics cookies
- Public authorities — where a valid legal obligation requires disclosure
Suppliers act as processors under written contracts binding them to our instructions and to appropriate security.
5 · Leaving the EEA
We keep data inside the European Economic Area wherever we can. Where a supplier processes it outside, an appropriate Chapter V safeguard applies — a Commission adequacy decision or Standard Contractual Clauses. Ask us and we will tell you which applies to a given transfer.
6 · How long we keep it
| Data | Retained |
|---|---|
| Orders and invoices | 6 years, as Spanish commercial law requires |
| Refund bank details | Deleted once the transfer clears and the entry is closed |
| Enquiries that led nowhere | 24 months from last contact |
| Server and security logs | 12 months |
| Analytics | 14 months |
| Marketing consent records | Until withdrawn, plus 3 years as evidence it was given |
At the end of the period data is deleted or irreversibly anonymised.
7 · What you can demand
The GDPR gives you the right to:
- Access — confirmation of whether we process your data, and a copy
- Rectification — correction of anything inaccurate or incomplete
- Erasure — deletion where an Article 17 ground applies
- Restriction — processing limited in the Article 18 circumstances
- Portability — what you gave us, in a structured machine-readable form, transmitted onward if you ask
- Objection — to legitimate-interests processing, and to direct marketing at any time
- Withdrawal of consent — whenever you like, without affecting what was done beforehand
Email support@tooly-kit.com. We answer within one month, extendable by two further months for genuinely complex requests, in which case we tell you inside the first month. Exercising these rights is free; we may charge or refuse only where a request is manifestly unfounded or excessive.
We may ask you to prove who you are first, so we do not hand your data to somebody else.
8 · Complaining
If you think we have handled your data unlawfully you may complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, aepd.es), or to the authority in your own EU country of residence or place of work. A complaint to us first is welcome but not required.
9 · Keeping it safe
We apply appropriate technical and organisational measures: HTTPS across the site, access limited to staff who need it for their role, and regular platform updates.
No internet transmission is perfectly secure and we cannot promise absolute safety. Where a breach is likely to result in a high risk to your rights, we will notify you and the supervisory authority as Articles 33 and 34 require.
10 · No automated decisions
We carry out no automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.
11 · Cookies
Covered separately in the Cookie Policy, including how to change your mind.
12 · Other people's websites
Links to third-party sites are not covered by this policy and we are not responsible for how those sites behave. Read their notices before handing over anything.
13 · Changes
This policy is updated when our processing or the law changes. The current version always sits here with its effective date, and material changes are flagged on the site.