Browsing data: IP address, browser type, technical and analytical cookies (see Cookie Policy).<\/li><\/ul>3. PURPOSES AND LEGAL BASIS FOR PROCESSING<\/h2>
Personal data are processed for the following purposes:<\/p>
a) Order management and sales contracts<\/strong><\/p>Legal basis: performance of a contract (Article 6(1)(b) GDPR). Required for the placement, management, fulfilment, shipping and invoicing of orders placed through the online store.<\/p>
b) Customer service and enquiry management<\/strong><\/p>Legal basis: legitimate interests of the controller (Article 6(1)(f) GDPR). Used to respond to communications received via the contact form or email.<\/p>
c) Compliance with legal obligations<\/strong><\/p>Legal basis: legal obligation (Article 6(1)(c) GDPR). Includes the issuance of invoices, tax filings and document retention in accordance with Spanish commercial and tax law.<\/p>
d) Commercial communications and newsletter<\/strong><\/p>Legal basis: the user’s explicit consent (Article 6(1)(a) GDPR). Users may withdraw their consent at any time by writing to info@palauantiguitats.com or by clicking the unsubscribe link in any communication received.<\/p>
4. RECIPIENTS AND DATA DISCLOSURES<\/h2>
Personal data may be shared with the following third parties, only to the extent necessary:<\/p>
- Shipping and logistics companies: for the fulfilment and delivery of orders.<\/li>\n\n
- Financial institutions and payment gateways: for the processing of transactions.<\/li>\n\n
- Public authorities: when required by applicable law (e.g. Spanish Tax Agency \u2014 Agencia Tributaria).<\/li>\n\n
- Technology service providers (hosting, CRM, email marketing): acting as data processors under a signed Data Processing Agreement (DPA).<\/li><\/ul>
No personal data will be sold or transferred to third parties for commercial purposes without the user’s prior consent.<\/p>
5. INTERNATIONAL DATA TRANSFERS<\/h2>
Where service providers are located outside the European Economic Area (EEA), the owner ensures that such transfers are subject to appropriate safeguards as provided under Chapter V of the GDPR (adequacy decisions, Standard Contractual Clauses or other recognised mechanisms). In particular, tools such as Google Analytics or email marketing services rely on Standard Contractual Clauses approved by the European Commission.<\/p>