Privacy policy
Last updated: 18/08/2026
1. Data controller
Controller: Rita Plana Aldoma Tax ID (NIF): 48091208W Address: Via Augusta 119, 08006 Barcelona, Spain Privacy contact email: jarss.collection@gmail.com
2. Data processed
We may process identification and contact data, shipping and billing data, order-related data, customer service communications, technical browsing information, and, where applicable, data necessary to prevent fraud. We do not store full card details or the CVV security code.
3. Purposes, legal bases, and retention
• Managing the purchase, payment, delivery, returns, warranty, and after-sales support. Legal basis: performance of the contract. Retention: for the duration of the contractual relationship and, afterwards, for the applicable statutory limitation periods. • Complying with tax, accounting, consumer, and other legal obligations. Legal basis: compliance with a legal obligation. Retention: for the legally required periods. • Preventing fraud, ensuring website security, and defending against potential claims. Legal basis: legitimate interest and, where applicable, contract performance or legal obligation. Retention: for as long as necessary for this purpose and the applicable limitation periods. • Responding to enquiries submitted by email, form, or phone. Legal basis: consent of the data subject or the application of pre-contractual measures, as applicable. Retention: until the enquiry is resolved and for the applicable liability periods.
4. Recipients
Data may be shared with providers necessary to deliver the service, acting as processors or independent controllers as applicable: hosting (Vercel), the shipping carrier, the email provider (Resend), our accountant, and the payment provider. We use Stripe to manage payments. Stripe processes the data necessary to authorize, process, and manage payments, refunds, authentication, fraud prevention, and compliance with applicable obligations. Please refer to Stripe's current privacy information and terms for details of its own processing activities and, where applicable, international transfers. We may also share data with public authorities, financial institutions, law enforcement, courts, and tribunals where there is a legal obligation to do so or where necessary to establish, exercise, or defend legal claims.
5. International transfers
Some technology providers may process data outside the European Economic Area. Where an international transfer takes place, the safeguards required by law will apply, such as an adequacy decision, standard contractual clauses, or another valid mechanism. You may request additional information about the safeguards applied by writing to jarss.collection@gmail.com.
6. Rights
You may request access, rectification, erasure, objection, restriction of processing, and portability, and you may withdraw your consent at any time where processing is based on it. To do so, write to jarss.collection@gmail.com, stating which right you wish to exercise and enclosing sufficient information to verify your identity where necessary. If you believe that the processing does not comply with the applicable regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD).
7. Mandatory data
Fields marked as mandatory are necessary to process the order or handle the request. If they are not provided, it may not be possible to provide the requested service.
8. Automated decisions
We do not make automated decisions with legal or similarly significant effects on users. Payment or fraud-prevention providers may apply their own assessment systems in accordance with their own terms and the applicable regulations.
9. Security
We apply reasonable technical and organizational measures to protect personal data. However, no system is completely invulnerable; users should therefore use strong passwords and report any suspected unauthorized use.