Privacy policy

PRIVACY POLICY

kumera.es

This is a translation of the original Spanish text. In the event of any discrepancy, the Spanish version shall prevail.

1. DATA CONTROLLER

  • Controller: Juan Manuel Calderón
  • Address: Calle Diego de Alcántara, 2, Bloque 3, 41500 Alcalá de Guadaíra, Seville, Spain
  • Email: hola@kumera.es
  • Website: https://kumera.es

 

2. DATA WE COLLECT

We collect the following personal data:

 

2.1 Data you provide to us

  • When you make a purchase: first name, surname, shipping and billing address, email address, telephone number and payment details (handled by the payment processor).
  • When you buy a gift card: the recipient’s name and email address, provided by the buyer so that the card can be sent.
  • When you subscribe to the newsletter: your email address.
  • When you contact us: your name and email address.

 

2.2 Data collected automatically

  • Browsing data: IP address, browser type, pages visited and time spent on them.
  • Technical cookies required for the shop to work (WooCommerce).

 

3. PURPOSES OF PROCESSING

We process your personal data for the following purposes:

  • Order management and contractual relationship: processing, shipping and tracking your purchases.
  • Invoicing and legal obligations: issuing invoices and complying with tax obligations.
  • Commercial communications: sending the newsletter, only if you have given your express consent.
  • Service improvement: analysing browsing to improve the user experience.
  • Sending gift cards: using the recipient’s name and email address, provided by the buyer, solely to deliver the gift card purchased.

 

4. LEGAL BASIS FOR PROCESSING

  • Performance of a contract: for order management (Art. 6(1)(b) GDPR).
  • Legal obligation: to comply with tax and accounting obligations (Art. 6(1)(c) GDPR).
  • Consent: for sending commercial communications and using non-essential cookies (Art. 6(1)(a) GDPR).
  • Legitimate interest: for website security and fraud prevention (Art. 6(1)(f) GDPR).

 

5. DATA RETENTION

  • Order and billing data: for as long as the contractual relationship lasts and, afterwards, for the periods required by law (at least 5 years under Spanish tax law).
  • Newsletter subscription data: until you withdraw your consent.
  • Browsing data: as set out in our Cookie Policy.

 

6. RECIPIENTS OF THE DATA

Your data may be disclosed to:

  • Transport and logistics companies: to deliver orders.
  • Payment processors (SumUp): to handle transactions. These services have their own privacy policies.
  • Brevo (Sendinblue SAS, France): to manage the newsletter. A provider based in the EU with adequate data protection safeguards.
  • Competent authorities: where there is a legal obligation to disclose the data.

We do not transfer data outside the European Economic Area, except to providers that offer adequate safeguards under the GDPR.

 

7. YOUR RIGHTS

Under the GDPR and Spanish Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD), you have the right to:

  • Access: find out which of your personal data we process.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: request the deletion of your data when it is no longer needed.
  • Restriction: request that processing be restricted in certain circumstances.
  • Portability: receive your data in a structured, machine-readable format.
  • Objection: object to the processing of your data, including processing for direct marketing.
  • Withdrawal of consent: withdraw your consent at any time, without affecting the lawfulness of any processing carried out before.

 

To exercise these rights, you can contact us at: hola@kumera.es

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of the country where you live, if you consider that the processing of your data does not comply with the regulations in force.

 

8. SECURITY

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. Payments are processed through certified providers using SSL encryption.

 

9. MINORS

This website is not aimed at anyone under 16. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with data without the consent of their parents or guardians, please contact us so that we can delete it.

 

10. CHANGES

We reserve the right to update this Privacy Policy to reflect changes in legislation or in our services. We will notify you of any significant changes through the Website.

 

Last updated: 9 October 2026