Last updated: October 2026.
This translation is for information only. In case of discrepancy, the Spanish version prevails.
In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we explain how we process your personal data.
1. Data controller
- Controller: Asociación Cultural La Chakana
- Tax ID (NIF): G13975362
- Address: Carrer del Torrent de l'Olla, 196, Gràcia, 08012 Barcelona (España)
- Email: hola@tiendalachakana.com
2. What data we process
- Identification and contact data: first name, surname, email, phone, shipping and billing address and, if you buy as a business, company name and tax ID.
- Purchase data: products, amounts, delivery method, order history and invoices.
- Payment data: we do not store your full card details; they are handled directly by the payment provider. We only receive confirmation of the payment.
- Browsing data: IP address, device, browser, pages visited and data obtained through cookies or similar technologies (see the Cookie policy).
- Communications: the content of the enquiries you send us.
3. Purposes and legal basis
- Managing your order, payment, delivery and after-sales service (returns, guarantees). Basis: performance of the contract (Art. 6.1.b GDPR).
- Complying with legal obligations (invoicing, accounting, tax and consumer obligations). Basis: legal obligation (Art. 6.1.c).
- Creating and managing your customer account, if you choose to register. Basis: performance of the contract.
- Answering your enquiries and requests. Basis: your consent or pre-contractual measures (Art. 6.1.a and 6.1.b).
- Sending your discount code when you request it through the Website form. Basis: your consent (Art. 6.1.a).
- Commercial communications about our products and news, only if you have given your express consent, which you can withdraw at any time (Art. 21 LSSI and Art. 6.1.a GDPR).
- Website analytics and improvement, through cookies or measurement tools, only if you accept them. Basis: your consent.
- Website security and fraud prevention. Basis: legitimate interest (Art. 6.1.f).
4. Retention period
We keep your data for as long as the contractual relationship lasts and, afterwards, for the limitation periods of legal obligations (for example, tax and commercial records, up to 6 years). Data processed on the basis of your consent is kept until you withdraw it. Discount codes and associated data are kept until they expire and for the time needed to prove consent. After these periods the data is deleted or blocked as required by law.
5. Recipients
We do not disclose your data to third parties unless legally required. To provide the service, we may share it with providers acting as data processors, under contract, in these categories: web hosting and maintenance, payment gateways and providers, transport and courier companies, email delivery services, analytics tools (only if you accept them) and tax, accounting and legal advisers. We may also disclose data to public authorities, judges and courts where the law requires.
6. International transfers
Some of our providers may process data outside the European Economic Area. In that case we make sure appropriate safeguards are in place (European Commission adequacy decision or standard contractual clauses) in accordance with the GDPR.
7. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, by writing to hola@tiendalachakana.com stating the right you wish to exercise and attaching a document proving your identity. We will reply within one month. If you believe we have not processed your data properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Minors
The Website is not directed at children under 14. If you are under that age, you must not give us personal data without the consent of your parents or guardians.
9. Source of data and whether providing it is required
The data comes from you. Fields marked as required are necessary to handle your order or request; without them we cannot process it.
10. Automated decisions
We do not make decisions based solely on automated processing, nor do we build profiles with legal effects on you.
11. Security
We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration.
12. Changes to this policy
We may update this policy to reflect legal or service changes. The current version is the one published on the Website.
13. Language
This policy is provided in Spanish, Catalan and English. The Catalan and English versions are for information only: in case of discrepancy, the Spanish version prevails.