Controller
Nevinu S.L. (Grasshall), C/ Areeira 13, Alongos, 32940 Toén, Ourense, Spain. CIF B75643114.
For anything about privacy, email hola@grasshall.com.
What data we process and why
- Orders: your name, email, phone number, delivery address, the products and the amount. We use them to take payment, pack and deliver your order, send the confirmation and issue the invoice. Legal basis: performance of the contract and compliance with legal duties, such as tax.
- Payment: your card or payment method details are received and processed by Stripe. We do not see them.
- Customer service: what you write to us and our replies. Legal basis: performance of the contract or our legitimate interest in answering you.
- Age confirmation: stored only in your browser, with the date you gave it. It never reaches us. See the cookie policy.
- Visit statistics: we use Vercel Web Analytics and Ahrefs Web Analytics. They use no cookies and only show us totals, such as page views, country, device type and the site you came from. Legal basis: our legitimate interest in knowing how the site is used.
- Technical data: to serve pages, our hosting provider processes your IP address and technical connection data so the site works and stays secure. Legal basis: legitimate interest.
We make no automated decisions about you and do no profiling. We do not sell your data.
Who receives your data
Only the providers we need to run the shop, under a data processing agreement where they act on our behalf:
- Stripe: processes payments and prevents fraud.
- Vercel: hosts the site and gives us cookieless visit statistics.
- Ahrefs: cookieless visit statistics.
- Brevo: sends the order emails.
- The carrier that delivers your order receives your name, address and phone number. We use parcel companies that operate in Spain and the European Union; which one carries your order depends on the destination.
We also share data with public authorities when the law requires it, for example the tax authority.
Transfers outside the European Economic Area
Some providers process data outside the European Economic Area. When they do, they use the safeguards of the General Data Protection Regulation: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Orders and invoices: 6 years, as the Spanish Commercial Code requires.
- Customer service emails: while your query is open and then for as long as claims can arise or guarantee periods run.
- Age confirmation: in your browser, until you delete it.
Your rights
You can ask for access to your data, its correction or erasure, restriction of processing and portability, and you can object to processing based on legitimate interest.
Email hola@grasshall.com with the subject "Privacy". We answer within one month at the latest.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
Minors
Grasshall is for adults 18 and over only. We do not knowingly process data of minors.
Changes
If we change this policy, we publish the new version here with its date.
