Privacy policy

## 1. Data controller


The controller of your personal data is:


- **Owner:** `Jorge Hernández Rodríguez` (hereinafter, "Maridatge", "we")
- **Tax ID (NIF/CIF):** `79064110T`
- **Address:** Carrer del Pirineu, 1-1er, 17004 Girona, Girona, Spain
- **Email:** hdez.rguez.jorge@gmail.com `[or privacy@maridatge.com]`
- **Phone:** `[CONTACT PHONE]`
- **Website:** https://maridatge.com


Maridatge operates this store and this website, including the data, content, features, tools, products and services (the "Services"). The Services are powered by **Shopify**, which acts as the platform provider. This Privacy Policy describes how we collect, use, retain and disclose your personal information when you visit, use or make a purchase through the Services, or when you communicate with us.


This Policy is governed by **Regulation (EU) 2016/679 (GDPR)** and by **Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD)**. In the event of a conflict between our Terms of Service and this Privacy Policy, the latter prevails in matters relating to the processing of personal data.


Please read it carefully. By accessing and using the Services, you acknowledge that you have read and understood how we handle your information.


## 2. Personal information we collect


By "personal information" we mean any data that identifies you or can reasonably be linked to you. Data collected anonymously or in de-identified form is not considered personal data. Depending on how you interact with the Services, we may process the following categories:


- **Contact details:** first name, surname, postal address, billing address, shipping address, phone and email.
- **Payment data:** transaction details, payment method and payment confirmation. **Full card numbers are processed directly by the payment gateway (Shopify Payments or another) and Maridatge does not store them.**
- **Account data:** username, password (encrypted), preferences and settings.
- **Transaction data:** items viewed, added to cart, saved or purchased; returns, exchanges and cancellations; order history.
- **Communications:** information you provide when contacting customer service, booking a tasting or sending an enquiry.
- **Age confirmation:** a declaration that you are over 18, required for the sale of alcoholic beverages (see section 11).
- **Device and usage data:** IP address, browser and device type, unique identifiers and information about your interaction with the Services, collected through cookies and similar technologies (see section 7).


We do not request or process special categories of data (health, beliefs, etc.). Please do not send us this type of information.


## 3. Sources of information


We collect data from the following sources:


- **Directly from you:** when creating an account, placing an order, booking a tasting or contacting us.
- **Automatically:** through cookies and similar technologies when you browse the Services (with prior consent for non-essential ones).
- **From our providers:** when they process data on our behalf (for example, Shopify, the payment gateway, carriers).
- **From partners or third parties:** for example, advertising platforms, where the law permits.


## 4. Purposes and legal basis for processing


We process your data only for the purposes described, each with its legal basis under art. 6 GDPR:


| Purpose | Legal basis (GDPR) |
|---|---|
| Managing your account, processing and shipping orders, handling returns, exchanges and tasting bookings | Performance of a contract (art. 6.1.b) |
| Issuing invoices and meeting accounting, tax and commercial obligations | Legal obligation (art. 6.1.c) |
| Verifying legal age for the sale of alcohol | Legal obligation (art. 6.1.c) |
| Customer service and handling enquiries and complaints | Performance of a contract / legitimate interest (art. 6.1.b / 6.1.f) |
| Security, authentication and fraud prevention | Legitimate interest (art. 6.1.f) |
| Sending you marketing communications and the newsletter by email | Consent (art. 6.1.a) |
| Personalised advertising and non-essential cookies | Consent (art. 6.1.a) |
| Publishing reviews and personalised recommendations | Consent / legitimate interest (art. 6.1.a / 6.1.f) |


Where the basis is **legitimate interest**, we have assessed that your rights and freedoms do not override it; you may object at any time (section 10). Where the basis is **consent**, you may withdraw it at any time without affecting the lawfulness of prior processing.


## 5. Marketing and commercial communications


We will only send you marketing communications by email, SMS or other electronic means **if you have given us your prior express consent** (for example, by ticking an unchecked box when subscribing or at checkout), in accordance with **art. 21 of the Spanish LSSI-CE**. Alternatively, we may send you information about products or services similar to those you have already purchased, unless you object.


You can unsubscribe at any time using the cancellation link included in every message or by writing to us. Even if you unsubscribe from marketing, we will continue to send you non-promotional communications relating to your account or your orders.


## 6. Disclosure of data to third parties


We may disclose your data to third parties for legitimate reasons and in accordance with this Policy:


- **Providers who deliver services on our behalf (data processors):** Shopify (platform and hosting), payment gateway, transport and logistics companies, analytics and customer service tools, cloud storage. These providers only process your data on our instructions and under a data processing agreement (art. 28 GDPR).
- **Marketing and advertising partners:** only with your consent, to show you personalised advertising. You can withdraw this consent at any time.
- **When you request or authorise it:** for example, social media integrations or third-party sign-in.
- **For legal reasons:** to comply with applicable law, respond to requests from authorities or courts, or defend our rights.
- **Corporate transactions:** in the context of a merger, acquisition or insolvency, respecting this Policy.


## 7. Cookies and similar technologies


We use cookies and similar technologies. **Technical or necessary cookies** are essential for the site to work and do not require consent. **Analytics, personalisation and advertising cookies** are only installed **with your prior consent**, which you can give, refuse or configure granularly through the cookie banner when you access the site, and change at any time.


Details of the cookies used, their purpose and duration are described in our **Cookie Policy** `[link Cookie Policy]`.


## 8. Relationship with Shopify


The Services are hosted on **Shopify**, which collects and processes information about your access and use in order to provide and improve the platform for us. The information you submit may be transmitted to Shopify and to third parties who may be located outside your country. For certain advanced features, Shopify may act as an independent controller of certain data arising from your interactions with our store, with other stores and with its platform.


For more information on how Shopify handles your data and on your rights in relation to Shopify, see the [Shopify consumer Privacy Policy](https://www.shopify.com/legal/privacy/app-users) and the [Shopify privacy portal](https://privacy.shopify.com/en).


## 9. Data retention


We keep your personal data only for as long as necessary for the purposes described and to meet legal obligations:


- **Account data:** while the account remains active; deleted or anonymised after a reasonable period of inactivity or at your request.
- **Order and invoicing data:** for **6 years** under accounting and commercial obligations (art. 30 of the Spanish Commercial Code) and **4 years** under tax obligations (General Tax Law).
- **Marketing data:** until you withdraw consent or unsubscribe.
- **Enquiries and complaints:** for the duration of handling and thereafter for the limitation periods of any actions that may arise.


Once these periods have elapsed, your data is securely deleted or anonymised.


## 10. Your rights


Under the GDPR and the LOPDGDD, you may exercise the following rights:


- **Access** to your personal data.
- **Rectification** of inaccurate data.
- **Erasure** ("right to be forgotten").
- **Portability** of data to another controller.
- **Objection** to processing, including advertising.
- **Restriction** of processing.
- **Withdrawal of consent** at any time, without retroactive effect.
- **Managing your communication preferences** via the unsubscribe link in our emails.


You can exercise them by writing to hdez.rguez.jorge@gmail.com `[or privacy@maridatge.com]` or to our postal address, stating the right you are exercising and attaching a copy of a document proving your identity. We will respond within **one month** (extendable in complex cases). We will not discriminate against you for exercising your rights.


If you believe we have not handled your request properly, you have the right to lodge a complaint with the competent supervisory authority. In Spain this is the **Spanish Data Protection Agency (AEPD)**, C/ Jorge Juan 6, 28001 Madrid — [www.aepd.es](https://www.aepd.es).


## 11. Age verification (sale of alcohol)


The sale of alcoholic beverages to under-18s is prohibited. When placing an order for products containing alcohol, **you declare and warrant that you are over 18**. Maridatge may request age verification and **refuse or cancel any order** where there is reasonable doubt about the age of the buyer or recipient. Proof of identity may be required on delivery.


## 12. Minors


The Services are not directed at children under 14 and we do not knowingly collect data from children of that age without the consent of a parent or guardian, in accordance with **art. 7 of the LOPDGDD**. Regardless of the above, purchasing products containing alcohol requires being over 18 (section 11). If you are a parent or guardian and believe a minor has provided us with data, contact us to have it deleted.


## 13. Information security


We apply reasonable technical and organisational measures to protect your data. However, no measure is infallible and we cannot guarantee absolute security, particularly during transmission. We recommend that you do not send us sensitive information through insecure channels and that you keep your access credentials confidential.


## 14. International transfers


We may transfer, store and process your data outside your country of residence. When we transfer data outside the European Economic Area (EEA) or the United Kingdom, we use recognised transfer mechanisms, such as the European Commission's **Standard Contractual Clauses** or an equivalent contract, unless the destination country benefits from an adequacy decision.


## 15. Links to third-party sites


The Services may contain links to third-party sites that we do not control. We are not responsible for their privacy practices; we recommend reviewing their policies before providing them with data.


## 16. Changes to this Policy


We may update this Policy from time to time for operational, legal or regulatory reasons. We will publish the updated version on this site with a new "Last updated" date and, where the law requires it, we will notify you.


## 17. Contact


For any privacy matter or to exercise your rights:


- **Email:** hdez.rguez.jorge@gmail.com `[or privacy@maridatge.com]`
- **Phone:** `[CONTACT PHONE]`
- **Address:** Carrer del Pirineu, 1-1er, 17004 Girona, Girona, Spain


For the purposes of data protection law, `Jorge Hernández Rodríguez` is the controller of your personal information.