Privacy Policy

1. Data Controller

Ben Flagmeyer / FanuFacture
C/ Mar Cantábrico 18, Casa 31
38612 El Médano, Tenerife, Spain
Email: contact@fanufacture.shop
Phone: +34 632 811 437

2. Overview of Data Processing

We only process personal data to the extent necessary to provide our online shop and services. Processing is carried out on the basis of the EU General Data Protection Regulation (GDPR) and the Spanish Ley Orgánica 3/2018 (LOPDGDD).

3. Legal Bases

We process your data on the following legal bases:

Art. 6(1)(a) GDPR (Consent): Newsletter subscription, contact inquiries, Meta Pixel (ad measurement — only after you agree in the cookie banner, see section 6.6)
Art. 6(1)(b) GDPR (Contract performance): Order processing, payment, shipping, customer communication
Art. 6(1)(c) GDPR (Legal obligation): Tax retention obligations, invoicing
Art. 6(1)(f) GDPR (Legitimate interest): IT security, fraud prevention, service improvement

4. Collection and Storage of Personal Data

4.1 Server Log Files

When you visit our website, information is automatically transmitted to our server (server log files): IP address, date and time of request, URL accessed, referrer URL, browser and operating system used, amount of data transferred, HTTP status code.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security).
Retention period: 30 days, then automatically deleted.

4.2 Orders

When you place an order, we collect: name, email address, shipping address, order details. Payment processing is handled exclusively by Stripe (see section 6.1) — we do not store any credit card or bank details.

Legal basis: Art. 6(1)(b) GDPR (contract performance).
Retention period: 10 years (statutory retention obligation for business records under Spanish commercial law).

4.3 Newsletter

When you subscribe to our newsletter, we store your email address to send product news and drop notifications. Registration uses a double opt-in process: after entering your email, you receive a confirmation email with an activation link.

You can unsubscribe from the newsletter at any time — an unsubscribe link is included in every newsletter email.

Legal basis: Art. 6(1)(a) GDPR (consent).
Retention period: Until withdrawal of consent (unsubscription).

4.4 Contact Inquiries (WhatsApp, Email)

When you contact us by email or WhatsApp, your details are stored for processing the inquiry. When contacting via WhatsApp, your data is also processed by Meta Platforms Ireland Ltd. (see section 6.4).

Legal basis: Art. 6(1)(a)/(b) GDPR (consent or pre-contractual measures).
Retention period: Until completion of the inquiry, maximum 12 months.

4.5 NFC Products (Customer-Provided Content)

When you order an NFC product with custom linking, you provide us with the desired URL or content to be stored on the NFC chip. This data is used exclusively for the production of the ordered product.

Legal basis: Art. 6(1)(b) GDPR (contract performance).
Retention period: NFC content data is stored together with order data (10 years). You may request deletion of the content data you provided at any time, unless a statutory retention obligation applies.

4.6 File Uploads (Logos, Artwork, Briefings)

When you upload files (logos, artwork, reference images) through the briefing form or the product configurator, those files are stored in our database and linked to the corresponding briefing or order. We need these files to produce your custom merchandise.

Legal basis: Art. 6(1)(b) GDPR (contract performance or pre-contractual measures).
Retention periods:

Orphan uploads (files that were uploaded but never linked to a briefing or order — e.g. because the form was never submitted) are automatically deleted after24 hours.
Briefing attachments are stored with the briefing and automatically deleted after 12 months (shared TTL with the inquiry).
Order attachments (designs tied to actual orders) are archived alongside order data for 10 years in line with Spanish tax-law retention obligations.

You may request deletion of the files you provided at any time, unless a statutory retention obligation applies.

4.7 Pickup (Self-Collection)

If you choose "Pick-up in El Médano" at checkout, we process your name, email address, and optionally your phone number solely to coordinate the pickup appointment. A shipping address is not collected in that case.

Legal basis: Art. 6(1)(b) GDPR (contract performance).
Retention period: Same as shipping orders — order data 10 years (statutory tax retention), pickup-coordination correspondence up to 12 months after pickup.

5. Cookies and Local Storage

By default, this website uses no tracking, marketing or analytics cookies. Without your consent, we only use technically necessary storage technologies. The single exception is the Meta Pixel for ad measurement (section 6.6) — it isonly loaded after you have explicitly agreed in the cookie banner. If you decline or make no choice, the pixel is not loaded and no marketing cookies are set.

Without consent, we only use:

Local browser storage (localStorage): To store your shopping cart and functional preferences (e.g. whether the newsletter popup has been dismissed). This data remains exclusively in your browser, is not transmitted to our servers or third parties, and serves no tracking or analytics purpose.
Session storage (sessionStorage): To count page visits within a session for functional purposes (e.g. newsletter popup timing). This data is automatically deleted when the browser tab is closed and is used solely for UX-timing optimisation — no profiling, no cross-site recognition, no third-party transmission.
Technically necessary cookies: A language preference cookie (ip-lang), session cookies for the admin area (not visible or relevant to regular visitors) and — once you have made a choice in the cookie banner — a consent cookie (ff_consent) that stores nothing but your decision (accept or decline) and its timestamp, so the banner does not reappear on every visit. Retention: 12 months. No cookie is set before you choose.

The storage technologies above are strictly necessary within the meaning of Art. 22.2 LSSI-CE (Ley 34/2002, Spanish e-commerce law) and Art. 5(3) of the ePrivacy Directive (2002/58/EC) — this also applies to the consent cookie that stores a decline. Marketing cookies (Meta Pixel, section 6.6) are set exclusively after your prior, explicit consent via the cookie banner. You can change or withdraw your choice at any time via the"Cookie settings" link in the footer.

6. External Service Providers and Data Transfers

6.1 Stripe (Payment Processing)

We use Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (hereinafter "Stripe") for payment processing. SPEL is authorised as an e-money institution by the Central Bank of Ireland. Stripe engages affiliated sub-processors for technical execution, including Stripe, Inc. (USA).

When placing an order, your payment data is transmitted directly to Stripe and processed there. We only receive confirmation of payment status from Stripe.

Stripe processes your data on the basis of Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR for intra-group transfers to the United States.

Legal basis: Art. 6(1)(b) GDPR (contract performance).
Stripe's privacy policy:https://stripe.com/privacy

6.2 Resend (Email Delivery)

We use Resend, Inc. (USA) to send order confirmations, shipping notifications and newsletter emails. Your email address is transmitted to Resend for this purpose.

Legal basis: Art. 6(1)(b) GDPR (contract performance) or Art. 6(1)(a) GDPR (newsletter).
Resend processes data on the basis of Standard Contractual Clauses (SCC).

6.3 Railway (Hosting)

Our website is hosted by Railway Corp. (USA). Each time our website is accessed, data (see 4.1 Server Log Files) is transmitted to Railway's servers.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable website operation).

6.3a Cloudflare Turnstile (spam protection in forms)

Our forms (briefing, contact, newsletter, sample order) use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to block automated submissions. Turnstile is loaded only after you click "Enable spam protection" — until then no data is sent to Cloudflare.

On loading, your IP address along with browser and device information is transmitted to Cloudflare and evaluated there; cookies may be set in the process. No profiles are built for advertising purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our forms from abuse); for the loading itself additionally your consent under Art. 6(1)(a) GDPR, given by that click. Third-country transfers occur on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
Cloudflare's privacy policy:https://www.cloudflare.com/privacypolicy/

6.4 WhatsApp / Meta

We offer the option to contact us via WhatsApp. WhatsApp is operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. When you contact us via WhatsApp, your data (phone number, message content, timestamps, and any media) is processed by Meta.

Meta processes this data for its own purposes in accordance with the WhatsApp privacy policy. We have no influence over the nature and extent of data processing by Meta and it is not possible to conclude a data processing agreement pursuant to Art. 28 GDPR with Meta. Meta may transfer data to the USA.

WhatsApp privacy policy:https://www.whatsapp.com/legal/privacy-policy

Legal basis: Art. 6(1)(a) GDPR (consent through active contact initiation). You can always contact us by email instead, without your data being transmitted to Meta.

6.5 Instagram

We link to our Instagram profile. When you click the link, you are redirected to Instagram (Meta Platforms Ireland Ltd.). Data collection by Instagram only occurs there. No Instagram data is loaded or tracking pixels embedded on our website.

6.6 Meta Pixel (Ad Measurement — Only With Your Consent)

Only if you choose "Accept" in the cookie banner do we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") on this website. Without that consent, the pixel is not loaded and no data is transmitted to Meta.

Purpose: Measuring the effectiveness of our ads on Meta platforms (Facebook, Instagram) — i.e. whether visitors who saw an ad visit our website and go on to place an order or send an enquiry.

Events transmitted: Every event involves the data technically required (including IP address, browser information, Meta cookie identifiers). Only the following three events are transmitted:

Page view (PageView) — that a page of our website was opened.
Completed purchase (Purchase) — on the order confirmation page after a successful payment: the gross amount actually paid and the currency (EUR). For package deposits this is the deposit amount paid. The event is transmitted only once per order.
Submitted briefing (Lead) — only the fact that a briefing form was successfully submitted. No amount, and none of the form content.

Beyond that we transmit no form inputs, no order line items and no contact or address details to Meta — in particular no names, email addresses, phone numbers or order numbers (so-called "Advanced Matching" is disabled).

Legal basis: Your consent under Art. 6(1)(a) GDPR, given via the cookie banner; the setting and reading of the associated cookies likewise takes place only with your consent pursuant to Art. 22.2 LSSI-CE and Art. 5(3) of the ePrivacy Directive.
Withdrawal: You may withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer of every page (Art. 7(3) GDPR). The pixel will then no longer be loaded.

For the collection and transmission of the event data, we and Meta are joint controllers pursuant to Art. 26 GDPR; the essence of that arrangement is set out in Meta's "Controller Addendum". Meta is solely responsible for the subsequent processing under its own responsibility. Meta may transfer data to the USA; this is based on the adequacy decision for the EU-U.S. Data Privacy Framework (Meta is certified) and, additionally, Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
Meta's privacy policy: https://www.facebook.com/privacy/policy/

6.7 Spotify (Embedded Player)

On the homepage, the workshop page and certain product pages, we embed the Spotify player as an iframe to demonstrate NFC products. Provider: Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. The player is only loaded after your active interaction (click-to-load). Only then is data (including your IP address) transmitted to Spotify. Spotify may set cookies in this context.

Legal basis: Art. 6(1)(a) GDPR (consent through active interaction). You may withdraw your consent at any time by reloading the page and not interacting again.
Spotify's privacy policy:https://www.spotify.com/legal/privacy-policy/

6.8 FacturaDirecta (Invoice Generation)

We use the FacturaDirecta service operated by Conductiva Online Services S.L., C/ de la Llotja, sn, VIT, 08500 Vic, Barcelona, Spain (NIF B65152100, registered in the Mercantile Register of Barcelona, Tomo 41388, Folio 9, Hoja B392505, Inscripción 1) — hereinafter "FacturaDirecta". When you place an order, your billing data (name, address, email, order details) is transmitted to FacturaDirecta to create a proper invoice.

Legal basis: Art. 6(1)(c) GDPR (legal obligation for invoicing). Processing takes place within the EU; no third-country transfer occurs.
FacturaDirecta privacy policy:https://www.facturadirecta.com/legal/

6.9 Data Processing Agreements

Data processing agreements pursuant to Art. 28 GDPR have been concluded with all service providers listed above that process personal data on our behalf — with the exception of WhatsApp/Meta (see section 6.4), as Meta acts as an independent controller and does not offer a data processing agreement, and of the Meta Pixel (section 6.6), for which a joint-controllership arrangement pursuant to Art. 26 GDPR applies.

7. Your Rights

You have the following rights regarding your personal data:

Access (Art. 15 GDPR) — What data we have stored about you
Rectification (Art. 16 GDPR) — Correction of inaccurate data
Erasure (Art. 17 GDPR) — Deletion of your data, provided no retention obligation exists
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR) — Provision of your data in a machine-readable format
Objection (Art. 21 GDPR) — Objection to processing based on legitimate interests
Withdrawal of consent (Art. 7(3) GDPR) — Possible at any time, without giving reasons

To exercise your rights, contact us by email: contact@fanufacture.shop

8. How to Exercise Your Rights (Practical Guide)

You can exercise your data protection rights at any time by sending an informal email tocontact@fanufacture.shop. To help us process your request promptly, please state which right you wish to exercise:

Access: "I would like to know what data you have stored about me." — We will respond within 30 days with a complete overview.
Erasure: "Please delete all my personal data." — We will delete all data not subject to a statutory retention obligation (e.g. invoice data: 10 years).
Rectification: "Please correct the following data: [...]" — We will update your data promptly.
Data portability: "Please send me my data in a machine-readable format." — You will receive your data as a JSON or CSV file.
Withdraw newsletter consent: Simply click the unsubscribe link in any newsletter email, or send us a brief email.

We process all requests free of charge and within the statutory period of 30 days (Art. 12(3) GDPR). For complex requests, the period may be extended by a further 60 days — we will inform you in good time.

9. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan 6, 28001 Madrid, Spain
https://www.aepd.es

Alternatively, you may contact the data protection authority of your country of residence.

10. Obligation to Provide Data

The provision of personal data is neither legally nor contractually required. However, certain data (name, address, email) is necessary for processing an order. Without this data, we cannot fulfil the purchase contract.

Providing an email address for the newsletter is voluntary.

11. Rights Under Spanish Data Protection Law (LOPDGDD)

In addition to your rights under the GDPR, you have the following rights under the Spanish Ley Orgánica 3/2018 (LOPDGDD):

Right to digital legacy (Art. 96 LOPDGDD) — Relatives or heirs of a deceased person may request the deletion or rectification of their personal data, unless the deceased person excluded this during their lifetime.

To exercise these rights, contact us by email: contact@fanufacture.shop

12. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legal requirements or changes to our data processing. The current version published on our website applies.

Last updated: 16 August 2026