PRIVACY.txt

Controller

The controller is NOMBRE DIRECCION, S.L.U., tax ID B75534164, registered office at Travesía Luxemburgo, n.º 27, 30392 Cartagena (Murcia), España. Privacy contact: hola@subsuelofs.com.

Data we process and its source

We may process identification and contact details, billing information, purchased products, transaction amount and status, downloads, enquiries, communication preferences, and basic connection, device and security data. Data comes from the user and from services used to process the order, payment and delivery.

UTM parameters accompanying a visit are stored locally for up to 30 days so campaign origin can be retained across pages and tabs. They are not sent to an analytics service on this domain; when Payhip is opened, they are added to the outbound link so that the visit or purchase can be attributed there.

Complete card details are handled by the enabled payment provider. The store receives payment confirmation and the transaction details needed to manage the order. Fields marked as required are needed to enter into the contract; without them, we cannot process the purchase.

Customer account and purchase access

No account is required to buy. Payhip asks for an email address so it can send the receipt and download link. Buyers may optionally create a customer account to keep purchases together in a library; an earlier purchase can be linked from its receipt or download page.

This website stores no passwords and provides no sign-in system of its own. Access and download issues are handled at hola@subsuelofs.com.

Purposes and legal bases

Consent is not requested for processing that is necessary to fulfil an order.

• Purchase, payment, invoice, delivery and related support: performance of the contract or pre-contractual steps.
• Tax, accounting and consumer obligations: compliance with legal duties.
• Security, fraud prevention and defence of claims: legitimate interest in protecting the store and its users.
• Marketing updates and non-essential technologies: consent, which may be withdrawn at any time.

Marketing communications

Purchasing and marketing are separate. Checkout asks every buyer for permission through an unticked box, regardless of country. Refusing does not prevent a purchase or delivery. Consent can be withdrawn through the unsubscribe link in each message or by writing to the privacy contact.

Providers and international transfers

GitHub Pages (GitHub, Inc.) hosts the static website. OVHcloud registers the domain, manages DNS and provides Zimbra email. Payhip Limited (United Kingdom) provides checkout, the optional customer library, receipts and digital delivery. Stripe processes the data needed to collect payment, prevent fraud and confirm the transaction. We do not sell or rent personal data.

Data may be disclosed to professional advisers and public authorities where required by law. If a provider or sub-processor accesses data outside the European Economic Area, an adequacy decision, standard contractual clauses or another valid safeguard will apply. Checkout links to Payhip's and the payment provider's own privacy information.

Retention

Orders, invoices and accounting records are retained for six years, without prejudice to other applicable legal periods. Contract and consent evidence retains the order identifier, date, language and accepted-text version for as long as needed to prove the transaction and address liabilities. Enquiries are kept until resolved and then for up to two years unless they form part of a contractual record. Marketing data is processed until consent is withdrawn; the minimum information needed to honour an opt-out is retained.

Your rights

You may request access, correction, deletion, restriction, objection or portability, and withdraw consent, by writing to hola@subsuelofs.com. We will respond within one month of receipt. Where the request is complex or numerous, that period may be extended by a further two months and you will be informed within the first month. We may request additional information where needed to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency at https://www.aepd.es.

Automated decisions

NOMBRE DIRECCION, S.L.U. does not make solely automated decisions that produce legal or similarly significant effects on a buyer. Platform or payment tools may generate risk indicators to review transaction security under their own policies.