Privacy Policy

This policy explains how we handle your personal data when you use repkaarts.com, in line with the EU General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 (LOPDGDD).

1. Who is responsible for your data

The data controller is Marino Pernía (NIF Z0784863Q), Calle Río Gargáligas 17, 29002 Málaga, Spain. You can reach us at any time at hello@repkaarts.com.

2. What we collect, why, and our legal basis

• Orders — your name, email, shipping and billing address, and the items you bought. We use this to fulfil your order and to meet our tax and accounting obligations. Legal basis: performance of a contract, and legal obligation. Your card details are handled directly by Stripe — we never see or store them.
• Contact form — your name, email and message, used only to answer you. Legal basis: steps taken at your request / your consent.
• Newsletter — your email, to send you studio news if you opt in. You can unsubscribe at any time. Legal basis: consent.
• Saved items and your account page — a device identifier and, if you use the sign-in link, your email, so your saves and orders follow you across devices. Legal basis: our legitimate interest in providing the feature / your consent.
• Spam protection — our forms use Cloudflare Turnstile, which processes limited technical data to tell humans from bots. Legal basis: legitimate interest in security.
• Usage analytics — aggregate, privacy-friendly statistics about how the site is used (see Cookies below). Legal basis: legitimate interest.

3. Who we share it with

We do not sell your data. We rely on trusted service providers who process data on our behalf under a data-processing agreement:

• Stripe — payment processing
• Supabase — database (orders, saved items)
• Resend — transactional emails (confirmations, shipping, sign-in links)
• Brevo — newsletter and waitlist mailing
• Cloudflare — bot protection (Turnstile)
• Vercel — website hosting and usage analytics
• Sanity — content management
• Mux — video hosting

Some of these providers are based outside the European Economic Area (for example, in the United States). Where that is the case, the transfer is protected by an adequacy decision or by the European Commission’s Standard Contractual Clauses.

4. How long we keep it

• Order and billing data: for as long as Spanish tax and commercial law require (generally up to 6 years).
• Newsletter: until you unsubscribe.
• Contact messages: for as long as needed to deal with your enquiry.
• Saved items: until you clear them or the device identifier expires.

5. Cookies and similar technologies

We use a small number of strictly necessary cookies to run the site (for example, to keep your cart and your sign-in session). We only set non-essential cookies — such as any that support analytics — where you have given consent through our cookie banner, which you can change at any time. A dedicated Cookie Policy accompanies that banner.

6. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw consent at any time. To exercise any of these, email hello@repkaarts.com. If you believe we have not handled your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.