Privacy Policy

1. Data controller

The controller responsible for processing personal data collected through this website is:

Data controller: Jesús Adrián Murillo Lorenzo
Contact email: info@costasign.es
Trading name: CostaSign
Registered contact address and tax details: available in the Legal notice.

2. Personal data we may process

Through this website, we may process personal data provided by the user when making an enquiry, requesting a quotation, creating an account, placing an order or contacting CostaSign.

This data may include first name, surname, email address, telephone number, billing address, shipping address, order details, information required to personalise the product and any data voluntarily included in forms or communications.

3. Purposes and legal bases

Enquiries and quotations. The data provided through forms, email, WhatsApp or other contact channels is used to answer the enquiry, assess the requested project and prepare or manage a quotation. The legal basis is the application of pre-contractual measures when the request is aimed at a possible purchase and, for general enquiries, CostaSign's legitimate interest in handling communications related to its business.

Orders, personalisation, payment, invoicing and shipping. Identification, contact, billing, shipping, order and personalisation data is processed to handle the purchase, manufacture the requested product, manage payment, delivery, incidents and after-sales service. The legal basis is the performance of the contract and, for the associated tax, accounting or legal obligations, compliance with legal obligations.

Customer account. When a user creates or uses an account, their data is processed to manage access, history and functions associated with the commercial relationship. The legal basis is the performance of the contractual relationship or the user's own request.

Security, abuse prevention and technical diagnostics. Certain technical data, such as IP addresses, browser information, security events or errors, may be processed to protect the website, prevent misuse and diagnose incidents. The legal basis is CostaSign's legitimate interest in maintaining the security and stability of its systems.

Cookies and non-essential technologies. Where analytics cookies, non-essential preference cookies or third-party cookies requiring consent are used, processing will be based on the user's consent, which the user may accept, refuse or withdraw through the cookie management system.

CostaSign will not use the data for purposes incompatible with those for which it was obtained without first informing the data subject and, where necessary, obtaining a new valid legal basis.

4. Proactive commercial outreach to businesses (B2B contact)

This purpose applies only to company contact details published on the company's own official website (for example an information, reception or commercial mailbox) and used to present CostaSign's products and services to that company. No personal data is processed for this purpose.

The legal basis is CostaSign's legitimate interest in making its products known to companies that may need them, under Article 6(1)(f) of Regulation (EU) 2016/679 (GDPR). Processing is limited to the contact details strictly necessary to identify the recipient and its company: the company's trading name and corporate email address. The retention period is two years from the last email, after which the address is deleted unless a commercial relationship or legitimate interest justifies keeping it.

In accordance with Article 14 of the GDPR, recipients are informed that their data does not come from them but from their public website, of the retention period, of the legal basis and of their right to object, rectify or erase. Outreach is sent only to corporate mailboxes, clearly identifies the sender and offers a simple way to opt out of further communications.

To exercise the rights of access, rectification, erasure, restriction or objection, write to info@costasign.es stating the reason for the objection.

5. Data retention

Consultation and quotation data will be kept for as long as necessary to handle the request and, afterwards, for the reasonable period during which liabilities may arise from the relationship. Data linked to orders, invoicing and tax or accounting obligations will be kept for the periods required by applicable law. Account data will be kept while the account remains active and, afterwards, for the periods necessary to meet obligations or liabilities. Technical and security data will be kept only for as long as necessary for the security, diagnostic or prevention purpose that justifies its processing.

6. Recipients, processors and necessary services

To provide the service, certain data may be processed by providers acting as data processors or necessary recipients, including the web hosting provider, email and technical support services, payment providers chosen at checkout, Packlink PRO and the carriers involved in delivery, as well as technical tools necessary for the security, diagnostics and operation of WordPress and WooCommerce.

Each provider will only be given the data necessary for the function it must perform. Data may also be disclosed to public authorities, courts, law enforcement agencies or other third parties where there is a legal obligation.

7. International transfers

Some technology providers may provide services from countries outside the European Economic Area or use international infrastructure. Where personal data is transferred internationally, CostaSign must use a valid mechanism under the GDPR, such as a European Commission adequacy decision, standard contractual clauses or another legally recognised safeguard. Specific information on the providers carrying out international transfers will be kept under review according to the services actually in use.

8. Rights of individuals

The data subject may request access to their data, its rectification or erasure, restriction of processing, object where applicable and exercise the right to data portability in the cases provided for by law. Where processing is based on consent, the data subject may withdraw it at any time without affecting the lawfulness of the processing carried out previously.

To exercise these rights, you can write to info@costasign.es, stating the right you wish to exercise and providing the information necessary to verify your identity where reasonably necessary.

The data subject may also lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their data does not comply with applicable regulations.

9. Data security

CostaSign applies reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse.

10. Cookies

This website may use technical cookies necessary for its operation and, where applicable, analytics or third-party cookies. Further information is available in the Cookie Policy.

11. Minors

CostaSign's services are not specifically aimed at minors. Where data processing is based on the consent of a minor, the applicable legal rules will apply: in Spain, the minor's own consent may serve as a basis from the age of 14, unless the law requires assistance for the act or transaction concerned; below that age, the consent of the holder of parental authority or guardianship will be required where the processing is based on consent.

12. Changes to the privacy policy

CostaSign may update this privacy policy to adapt it to legal, technical or operational changes to the website. The version published on this page will be the one applicable at any given time.