Privacy Policy of spaceneon.shop
At Space Neon we are committed to protecting the privacy of the people who write to us, order from us and send us their designs. This policy explains which personal data we process, for which purposes and on which legal basis, how long we keep it, and which rights you have as a data subject under the General Data Protection Regulation (GDPR).
1. Data Controller
The data controller within the meaning of Article 4(7) GDPR is:
Croma Ideas SL
C/ Romero 3
06207 Aceuchal (Badajoz)
Spain
VAT no.: ESB22498083
Email: [email protected]
Website: https://spaceneon.shop
Space Neon is a brand of Croma Ideas SL. This privacy policy applies to the spaceneon.shop website and to the online shop operated there.
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”), and, as the national law applicable to the data controller, Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (“LOPDGDD”). We apply appropriate technical and organisational measures to prevent unauthorised access, alteration, loss, or processing of personal data.
If you are located in the United Kingdom, references to the GDPR in this policy also include the UK GDPR (as retained in UK law under the European Union (Withdrawal) Act 2018) and the Data Protection Act 2018, which grant you equivalent rights.
2. Visiting our website (server log files)
When you visit our website, the browser on your device automatically sends data to the server of our hosting provider, where it is stored in what are known as log files: IP address, date and time of access, page requested, volume of data transferred, referrer URL, browser type and operating system.
The purpose of this processing is the technical operation, stability and security of our website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in operating the site securely and without disruption. The data is deleted as soon as it is no longer required for that purpose.
3. Orders and performance of the contract
When you place an order with us, we process the data required to fulfil it: first and last name, billing and delivery address, email address, telephone number where provided and, for business customers, company name and VAT identification number. For personalised items we additionally process the content you send us (the text you want, dimensions, colours, uploaded files and design drafts).
The legal basis is Article 6(1)(b) GDPR (performance of the sales contract and pre-contractual steps). Where we store data in order to comply with commercial and tax record-keeping obligations, the legal basis is Article 6(1)(c) GDPR.
4. Payment processing
Payment is always made in advance, by credit or debit card, by PayPal or by bank transfer. The payment data required for this is transmitted to the relevant payment service provider, which processes it under its own responsibility; we do not store full card details ourselves. The legal basis is Article 6(1)(b) GDPR.
If you enter a VAT identification number during checkout, it is transmitted to the European Commission’s VIES system in order to verify whether the conditions for a tax-exempt intra-Community supply are met. The legal basis is Article 6(1)(c) GDPR in conjunction with our VAT record-keeping obligations.
5. Shipping
In order to deliver your order, we pass your name, the delivery address and — where required for delivery notifications — your email address and telephone number to the transport company we use (SEUR). The legal basis is Article 6(1)(b) GDPR. Details of delivery areas and delivery times can be found on our payment and shipping page.
6. Customer account
You can create a customer account in our shop. In that case we process the data you provide so that you can access your orders, invoices and addresses. The legal basis is Article 6(1)(b) GDPR. You can ask us to delete your customer account at any time; statutory record-keeping obligations remain unaffected.
7. Contacting us, enquiries and quote requests
If you contact us through a contact form, by email, through the chat on our website or through a messaging service, we process the data you send us (as a rule your name, contact details and the content of your enquiry) in order to answer it. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to the preparation or performance of a contract, and otherwise Article 6(1)(f) GDPR (our legitimate interest in responding to enquiries).
If you request an individual quote for a custom sign, we process the details you give us about your project in order to prepare that quote and to contact you about it.
8. Marketing emails
We only send marketing emails where you have expressly consented to receive them (Article 6(1)(a) GDPR) or where this is otherwise permitted by law. You can withdraw your consent at any time with effect for the future — using the unsubscribe link in every email, or simply by writing to [email protected]. Withdrawing your consent does not affect the lawfulness of the processing carried out before then.
9. Cookies and consent management
We use cookies and similar technologies. Cookies that are strictly necessary for the operation of the shop (for example the shopping basket and session management) are used on the basis of Article 6(1)(f) GDPR; our legitimate interest lies in providing a shop that works.
All other cookies — in particular for statistics, convenience features and marketing — are only used after you have given your consent through our cookie banner (Article 6(1)(a) GDPR). You can change or withdraw your choice at any time in the cookie settings on our website.
10. Recipients of your data
We only disclose personal data where this is necessary to perform the contract, where you have consented, or where we are legally obliged to do so. The categories of recipients are:
- IT and hosting providers that operate our website and our systems (processors under Article 28 GDPR);
- payment service providers (card payments, PayPal) and our bank;
- the transport company we use for delivery (SEUR);
- our tax advisers and public authorities, where required by law.
11. Transfers to third countries
Your data is only transferred to countries outside the European Union or the European Economic Area where the conditions of Articles 44 et seq. GDPR are met — in particular on the basis of an adequacy decision of the European Commission or of the EU Standard Contractual Clauses.
12. Retention periods
We only keep personal data for as long as it is necessary for the purposes described above. Beyond that, we retain data from completed orders for as long as the commercial and tax retention periods that apply to us require (under Spanish law, as a rule six years for commercial records and four years for tax records). Data that we process on the basis of your consent is deleted once you withdraw that consent.
13. Your rights as a data subject
You have the following rights in relation to your personal data:
- right of access (Article 15 GDPR);
- right to rectification (Article 16 GDPR);
- right to erasure (Article 17 GDPR);
- right to restriction of processing (Article 18 GDPR);
- right to data portability (Article 20 GDPR);
- right to object (Article 21 GDPR);
- right to withdraw consent you have given (Article 7(3) GDPR).
To exercise your rights, a message to [email protected] is enough. Please tell us which data your request concerns (for example your full name and the email address you used on our site) so that we can identify your records. We answer requests within the statutory deadlines and inform you of the measures taken.
Right to object under Article 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR. Where your data is processed for direct marketing purposes, you may object at any time without giving any reason.
Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. Our data protection supervisory authority, as the authority competent for the data controller, is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD — www.aepd.es).
If you are located in the United Kingdom, you may also lodge a complaint with the Information Commissioner’s Office (ICO — ico.org.uk).
14. Provision of your data
You are not under any statutory obligation to provide us with your personal data. However, we do need certain details in order to conclude and perform a sales contract (in particular your name, address and email address). Without them we cannot process your order.
15. Intellectual property
The content of this website — in particular graphics, images, texts and software tools — is protected by intellectual property law and belongs to Croma Ideas SL or to its licensors. Any use outside the cases permitted by law requires our prior consent.
By submitting a custom design through our platform, you grant Space Neon a non-exclusive, royalty-free, worldwide licence to use, reproduce, and display that design — or images of the finished product — for promotional purposes, including our website, catalogue, social media, and marketing materials. This licence does not transfer ownership of your design to us, and you remain free to use it elsewhere. If you do not want your design used in this way, you may opt out at any time by writing to [email protected], either before placing your order or afterwards; we will stop any further promotional use of your design once we receive your request. You are solely responsible for ensuring that you own, or have the right to use, any elements included in your design (including logos, trademarks, or third-party content), and we accept no liability for infringing content submitted by customers.
16. Changes to this privacy policy
We update this privacy policy when the legal situation, our services or the way we process data change. The version published on this page is the one that applies.
17. Applicable law and jurisdiction
This policy is governed by Spanish law, without prejudice to any mandatory consumer-protection provisions of the law of the country in which you, as a consumer, have your habitual residence, where such provisions grant you a higher level of protection. If you are a consumer resident in the European Union, in accordance with Regulation (EU) No 1215/2012 (Brussels I bis Regulation), you may bring proceedings against us either before the courts of Spain or before the courts of the EU Member State in which you are domiciled; we may only bring proceedings against you before the courts of the Member State in which you are domiciled.
