Privacy policy

 

This Privacy Policy describes how personal information is collected, used, disclosed, retained and protected in connection with importadoragranmundox.shop. It is intended to reflect the UK General Data Protection Regulation, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and amendments made by the Data (Use and Access) Act 2025.

1. Controller and privacy contact

The controller is the legal operator trading as Importadora Gran Mundo X. Privacy requests and complaints may be sent to info@importadoragranmundox.shop. The controller’s complete legal name and geographical business address must be added before publication because they were not supplied and cannot be inferred safely from the domain.

2. Scope

This policy applies when a person visits the shop, creates or uses an account, places or attempts to place an order, receives a delivery, requests support, submits a review, subscribes to marketing, interacts with advertising, uses a privacy control or otherwise communicates with us. A third-party site linked from our shop has its own controller and notice.

3. Information provided directly

• identity information, including name and account identifier;
• contact information, including email, telephone number and billing or delivery address;
• order information, including selected products, variants, quantities, discounts, instructions and gift details;
• support information, including messages, attachments, photographs, returns and complaint history;
• marketing choices, review content, survey responses and other voluntary submissions;
• verification information reasonably required for fraud prevention, rights requests or account recovery.

4. Information collected automatically

When the shop is accessed, systems may record IP address, browser, device type, operating system, language, approximate location, referral source, pages and products viewed, searches, basket activity, session identifiers, timestamps, error logs, security events and interaction with communications. Collection depends on consent choices, applicable exemptions and the technologies used.

5. Transaction and payment information

Payment providers process card, bank, wallet or authentication credentials needed to complete a transaction. We generally receive a transaction token or reference, payment method category, billing result, risk response and limited details needed for reconciliation, refunds and disputes rather than complete card credentials. Payment providers may act as independent controllers for regulated, fraud-prevention and compliance functions.

6. Sources

Information may come from the individual, their device, a person ordering on their behalf, commerce and payment providers, fraud-prevention services, fulfilment partners, warehouses, carriers, marketing platforms, customer-support services, public sources and professional advisers. We do not treat information from another source as automatically accurate.

7. Contract purposes

Where processing is necessary to enter into or perform a contract, we use information to operate the basket and checkout, verify availability, take payment, confirm an order, prevent duplicate fulfilment, prepare and deliver goods, provide tracking, communicate service messages, process cancellation, administer returns and refunds, and resolve warranty or conformity issues.

8. Legal-obligation purposes

Information is used where necessary to comply with tax, accounting, product-safety, recall, consumer-protection, sanctions, court, regulatory and lawful authority obligations. The precise retention and disclosure depend on the obligation that applies to the operator and transaction.

9. Legitimate interests

Subject to a balancing assessment, legitimate interests may support shop security, fraud and abuse prevention, network and error monitoring, service improvement, demand forecasting, claim management, record integrity, suppression of unwanted marketing, business continuity, corporate transactions and defence of legal rights. Direct marketing can be a legitimate interest under current UK law, but PECR consent rules and the right to object still apply.

10. Consent

Consent may be used for non-exempt storage or access technologies, electronic marketing where required, and optional features that reasonably depend on a choice. Consent is specific, informed and capable of withdrawal. Withdrawal does not affect processing already lawful before withdrawal.

11. Cookies and storage or access technologies

Necessary technologies may provide a requested service, maintain a basket, authenticate a session, secure checkout, balance traffic and remember privacy choices. UK law may permit additional limited uses without consent when every condition of a statutory exemption is met, including certain statistical or functionality purposes with appropriate transparency and choice. Advertising, cross-site tracking and other non-exempt uses require consent before storage or access.

The live cookie interface should identify the relevant categories, purposes, providers and durations. Refusal must be as straightforward as acceptance where consent is required. Changing a browser setting may not withdraw server-side marketing choices, so the shop’s privacy controls should also be used.

12. Analytics and service improvement

Analytics may be used to understand traffic, navigation, device performance, conversion, error rates and aggregate demand. Wherever practical, data is minimised, aggregated or pseudonymised. Analytics is not described as anonymous if a provider or identifier can still relate it to a person or device.

13. Personalisation and advertising

With a valid legal basis, information may be used to select relevant products, limit repeated advertising, measure campaign performance or create audiences. We do not represent inferred interests as facts about a person. Individuals can withdraw consent or object to direct marketing, and applicable provider controls may also be available.

14. Electronic marketing

Email or text marketing is sent only where PECR permits it, such as with valid consent or the limited existing-customer exception when all conditions are satisfied. Every message provides a clear opt-out. Service communications about an order, security, recall or requested support are not marketing merely because they use email.

15. Reviews and user content

A review may be published with the display name and content chosen by the contributor. Customers should not include addresses, order numbers or sensitive information. Internal records may connect a review to an order for authenticity and moderation. Reviews may be retained to preserve an accurate publication record, subject to legal rights and moderation needs.

16. Fraud prevention and security

Identity, contact, transaction, device and behavioural signals may be assessed to prevent payment fraud, account takeover, abusive orders and automated attacks. A high-risk result may lead to additional verification, delayed acceptance or refusal of an order. Where a solely automated decision would produce a legal or similarly significant effect, applicable safeguards and information will be provided.

17. Recipients

Information may be disclosed only as reasonably necessary to commerce hosting providers, payment services, banks, fraud-prevention providers, fulfilment partners, warehouses, carriers, customer-support tools, communications providers, analytics and advertising providers used lawfully, IT and security providers, insurers, auditors, lawyers, accountants, prospective business transferees and public authorities. Processors are contractually restricted. Independent controllers are responsible for their own notices and legal bases.

18. International transfers

Recipients may process information outside the United Kingdom. A restricted transfer is made using a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another permitted safeguard. Transfer-risk and supplementary measures are considered where required. Information about a relevant safeguard may be requested.

19. Retention framework

Retention is determined by purpose, legal obligation, claim periods, risk, sensitivity and whether the information can be deleted or anonymised. Order, invoice and tax information may be retained for applicable UK accounting and tax periods. Support and complaint records are kept long enough to resolve the matter and protect legal rights. Account data is retained while the account is active and for a proportionate closure period. Security logs have shorter operational periods unless needed for an incident. Marketing data is retained until opt-out or withdrawal, with a minimal suppression record retained to honour the choice.

20. Security measures

Appropriate technical and organisational measures may include access control, authentication, encryption in transit, payment tokenisation, logging, backups, supplier diligence, staff confidentiality and incident procedures. Measures are reviewed according to risk. No online system is completely secure, and customers should use unique passwords and report suspicious account activity.

21. Data incidents

Suspected incidents are assessed, contained, documented and remediated. Where a personal-data breach is likely to create a risk requiring notification, the Information Commissioner’s Office is notified within the applicable period. Affected individuals are informed where the legal threshold is met, using clear information about the likely impact and protective steps.

22. Individual rights

Subject to legal conditions and exemptions, individuals may request access, correction, erasure, restriction and portability. They may object to direct marketing at any time and may object to processing based on legitimate interests for reasons relating to their situation. They may withdraw consent and may have rights concerning significant automated decisions. Rights are free unless a request is manifestly unfounded or excessive and the law permits a fee or refusal.

23. Rights-request procedure

Send a request to info@importadoragranmundox.shop and identify the right and relevant account or order. We may request proportionate information to confirm identity and prevent unauthorised disclosure. A request is answered without undue delay and within the statutory period, subject to a lawful extension for complexity or volume. If a request is refused or limited, reasons and complaint rights will be explained.

24. Complaints

Data-protection complaints may be submitted electronically to the same email address. We will acknowledge, investigate and respond in accordance with current UK complaint-handling requirements. Individuals may complain to the Information Commissioner’s Office through ico.org.uk and may also have a judicial remedy.

25. Children

The shop is not directed to children and is intended for persons able to enter a purchase contract. We do not knowingly solicit independent orders from young children. If an online service is likely to be accessed by children, their needs, best interests and the Age Appropriate Design Code are considered in the design and use of information.

26. Business changes

Information may be disclosed under appropriate confidentiality and legal safeguards during financing, reorganisation, sale or transfer of all or part of the business. A new controller will provide required information and cannot rely on a transaction to disregard existing rights.

27. Policy updates

This policy may change to reflect law, guidance, providers, technology or business operations. The revision date identifies the current version. Material changes are communicated where required; a new purpose that is incompatible with the original purpose will not be introduced without an appropriate legal basis and transparency.