1. Who is the controller
- Controller
- Exposiciones Tesoros del Ayer, C.B. (Tesoros del Ayer)
- Tax ID (NIF)
- E82220260
- Address
- C/ Sangenjo, 9, 28034 Madrid (Spain)
- Contact
- [email protected] · +34 914 780 661
We have not appointed a data protection officer because the regulations do not require it. For any privacy matter, write to the e-mail address above.
2. What data we process, why and on what legal basis
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Create and manage your user account | First name, surname, e-mail, password, address, phone and ID number (the ones marked as optional are optional) | Performance of a contract or pre-contractual measures at your request (Art. 6.1.b GDPR) | While you keep the account. Afterwards, blocked for the legal limitation periods. |
| Process your orders: preparation, shipping, payment and invoicing | Account data, lots purchased, amount, payment method and delivery address | Performance of the contract (Art. 6.1.b) and compliance with tax and accounting obligations (Art. 6.1.c) | The periods required by tax and commercial law (up to 6 years). |
| Handle your enquiries, offers and messages (help form, questions and offers about a lot) | Name, e-mail and the content of your message | Your consent when sending the message (Art. 6.1.a) and pre-contractual measures (Art. 6.1.b) | As long as needed to assist you and, afterwards, during the limitation periods for possible liabilities. |
| Send a lot’s information to a friend, at your request | Your friend’s name and e-mail, and your message | Your request (Art. 6.1.a). You guarantee that the other person agrees. | Used only for that sending; we do not keep them for other purposes. |
| Publish ratings and comments about sellers | Rating and comment text | Your consent (Art. 6.1.a) | Until you ask for its deletion. |
| Security and abuse prevention (for example, stopping robots from mass-submitting forms) | IP address and technical browser data, through Cloudflare Turnstile | Legitimate interest in the security of the site (Art. 6.1.f) | As determined by the provider for this verification; we do not store them. |
The data marked as mandatory in each form are necessary to provide the service; if you do not provide them, we will not be able to process your request. We do not profile you or take automated decisions that affect you. We do not send commercial communications unless you have expressly requested or consented to them.
3. Who we share your data with
We do not sell or transfer your data. We may only disclose it to:
- Providers that supply services to us (web hosting, e-mail, anti-robot verification) and act as processors under contract.
- Transport and courier companies, and financial or payment institutions, to the extent necessary to deliver and collect payment for your order.
- Public authorities, judges and courts when required by law.
4. International transfers
The anti-robot verification of the forms is provided by Cloudflare, Inc. (United States). The transfer is covered by the safeguards of the EU-US Data Privacy Framework or, failing that, by the European Commission’s standard contractual clauses. If other providers outside the European Economic Area are used in the future, we will state it here.
If you accept automatic translation on the English or French pages, your browser connects to Google LLC (United States), which receives your IP address, technical browser data and the text of the lots being translated. The legal basis is your consent, which you can withdraw at any time under Cookie settings.
5. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting what has already been done. Write to [email protected] stating the right you want to exercise and attaching a copy of your ID (to check it is you). We will reply within one month at most.
You can change your account data at any time from My account. If you believe we have not processed your data properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.
6. Minors
This website is intended for people over 18, who are the ones who can buy. We do not knowingly collect data from children under 14; if you know that we have done so, let us know so that we can delete it.
7. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration, in proportion to the risk. If a security breach seriously affecting you occurred, we would notify you as required by law.
8. Cookies
We only use the technical cookies necessary for the website to work. Everything is explained in the cookie policy.
9. Changes to this policy
We may update this policy to adapt it to legal or operational changes. The date of the last update appears at the top of the page.