1. Data Controller Identification

The personal data provided by users is processed by María Garcia Castillejo, operating under the commercial name “Bobbin Circular”, with NIF 22598315X and registered address at C/ de Pere III el Gran, 24 L'eixample, 46005 València, España.

For any matter related to personal data, you may contact us at info@bobbin.es.

2. Categories of Data We Collect

We may collect and process the following categories of personal data:

a) Identification and Contact Data

• Name and surname
• Valid identification document (DNI, NIE, or passport)
• Telephone number
• Email address
• Postal address (only when necessary for contractual or legal purposes)

b) Consignor Account Data

• Identification data
• EU IBAN only (for payout transfers)
• Information about items delivered, pricing, sales, and payout history
• Internal notes required to manage the consignment relationship
• Communications related to consignment (WhatsApp, email, website forms)

c) Transactional and Accounting Data

• Sales and payout records
• Item identification (brand, description, SKU, size, price)
• Commission calculations
• Accounting records required under Spanish tax law

d) Communications Data

• Messages sent via WhatsApp, email, or website contact forms
• Customer service interactions and requests

e) Newsletter and Communication Preferences

• Email address
• Consent preferences (“Announcements” and/or “Offers”)
• Users may modify or withdraw these preferences at any time

f) Visual and Media Data

• Photographs or videos taken only with prior explicit consent, for promotional or community purposes

g) Website and Technical Data

• Aggregated technical information about website usage (e.g. page visits, traffic patterns, device type)
• Collected through Google Analytics, a web analytics service provided by Google LLC
• Used solely to understand how visitors use the website and to help improve our services and website experience
• Data is processed in aggregated form and is not used to personally identify individual users

h) Social Media

• We do not collect or store personal data from social media platforms
• Interactions remain within the platform and are governed by its own privacy policies

Data Minimisation Statement

Bobbin Circular does not collect personal data for commercial exploitation, advertising profiles, or resale. All data processing is strictly limited to: (i) managing the consignment contract, (ii) complying with Spanish legal obligations, or (iii) sending communications only when the user has explicitly requested them. We do not process personal data for purposes unrelated to our services.

3. How We Collect the Data

a) Directly from the User

• When entering into a consignment agreement
• When presenting identification and EU IBAN details
• When contacting us via WhatsApp, email, phone, or website forms
• When subscribing to the newsletter
• When providing consent for photography
• When requesting information or services

b) Automatically Through the Website

• Aggregated usage data collected through Google Analytics, subject to user consent via the cookie banner
• Technical data required for website security, functionality, and performance
• Analytics cookies are activated only if the user provides consent through the cookie preferences

4. Purpose of Processing

Personal data is processed exclusively for the following purposes:

a) Management of the Consignment Service

• Accepting items
• Setting prices
• Tracking sales
• Calculating payouts
• Managing returns or donations
• Communicating with consignors

b) Contractual Relationship

• Establishing, managing, and fulfilling the consignment agreement

c) Customer Service

• Responding to inquiries, requests, and communications

d) Newsletter and Communications (With Consent)

• Sending store announcements and/or offers selected by the user

e) Photography and Media (With Consent)

• Using images solely for agreed promotional or community purposes

f) Website Operation and Improvement

• Understanding aggregated website usage and visitor behaviour
• Improving website structure, performance, and user experience
• Measuring general traffic patterns through Google Analytics, only when consent has been provided

g) Legal and Accounting Compliance

• Meeting obligations under Spanish tax, accounting, and commercial law

5. Legal Basis for Processing

Processing is carried out based on:

a) Contract Execution

• Art. 6(1)(b) GDPR

b) Legal Obligations

• Art. 6(1)(c) GDPR

c) User Consent

• Art. 6(1)(a) GDPR

d) Legitimate Interest

• Art. 6(1)(f) GDPR
• Limited to customer service, website security, and operational needs

e) Pre-contractual Measures

• Art. 6(1)(b) GDPR

6. Data Retention

Personal data is retained only for as long as necessary:

a) Consignor and Accounting Data

• 5–6 years (legal requirement)

b) Communications

• 12–24 months, unless legally required longer

c) Newsletter Data

• Until consent is withdrawn

d) Photographs

• Until consent is withdrawn

e) Aggregated Analytics Data

• Retained only for statistical purposes
• Does not allow user identification

f) GDPR Rights Requests

• Up to 3 years

7. Sharing of Data and Third Parties

We do not sell personal data.

Data may be shared only when strictly necessary and under GDPR-compliant agreements with:

a) Accounting and Administrative Professionals

b) Financial Institutions

• For EU IBAN payout transfers only

c) Website and Technical Service Providers

• Operating within the European Union

d) Communication and Newsletter Service Providers

e) Public Authorities

• Only when legally required

8. International Data Transfers

a) Analytics

• The website uses Google Analytics, which may process limited technical data through Google infrastructure
• Some processing may occur outside the European Economic Area (EEA)
• Such transfers rely on appropriate safeguards under GDPR, including Standard Contractual Clauses approved by the European Commission

b) Exceptional Cases

• If any limited technical data is processed outside the EEA, appropriate safeguards will apply

9. User Rights

Users have the right to:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Objection
• Withdraw consent at any time

Users may also lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

Requests can be sent to info@bobbin.es.
Proof of identity may be required.

10. Cookies

• Our website uses cookies and similar technologies to ensure proper functionality and to understand how visitors use the site
• Some cookies are strictly necessary for the website to function and do not require consent
• Analytics cookies (Google Analytics) are used only to measure website traffic and improve the user experience
• These cookies are activated only after the user provides consent through the cookie banner
• Users can modify or withdraw their consent at any time through the website’s cookie settings

11. Security Measures

We apply appropriate technical and organisational measures, including:

• Restricted access to data
• Secure digital storage
• Encrypted communications where supported
• Regular system updates
• Secure handling and disposal of documents
• GDPR-compliant agreements with service providers

12. Updates to This Privacy Policy

This Privacy Policy may be updated to reflect changes in legal requirements or our practices.
The latest version will always be available on www.bobbin.es.