This Privacy Policy explains how GM COMMERCE processes the personal data of visitors to gmcommerce.es and of customers, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: Marco Greco, trading as GM COMMERCE
- Tax ID (NIF): Y6825275Q
- Address: CR Menores – Taucho, 87, Finca El Conejo, 38677 Adeje, Santa Cruz de Tenerife, Spain
- Data protection contact: info@gmcommerce.es
No Data Protection Officer has been appointed, as none of the circumstances in Article 37 GDPR or Article 34 LOPDGDD apply.
2. Data processed, purposes and legal bases
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Order management, shipping, invoicing and after-sales support | Name, shipping and billing address, phone, e-mail, order details | Performance of the contract (Art. 6(1)(b) GDPR) | For the contractual relationship and thereafter, blocked, for the applicable limitation periods: 4 years for tax and 6 years for accounting (Art. 30 Spanish Commercial Code) |
| Customs clearance and importation into the EU | Name, full address, phone, e-mail, description and value of the goods | Legal obligation (Art. 6(1)(c) GDPR) | Periods required by customs law |
| User account | Registration data and order history | Performance of the contract (Art. 6(1)(b) GDPR) | Until the user requests deletion |
| Marketing communications | Name and e-mail | Consent (Art. 6(1)(a) GDPR) or legitimate interest for similar products already purchased (Art. 21.2 LSSI) | Until consent is withdrawn or the user unsubscribes |
| Handling enquiries by form or e-mail | Name, e-mail and message content | Consent or pre-contractual steps (Art. 6(1)(a) and (b) GDPR) | 1 year from the last communication |
| Analytics and audience measurement | Cookie identifiers, IP address, browsing data | Consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI) | As set out in the Cookie Policy |
| Payment fraud prevention | Transaction data, IP address, device | Legitimate interest (Art. 6(1)(f) GDPR) | Applicable limitation periods |
GM COMMERCE does not process special categories of data and does not take automated decisions producing legal effects on users, beyond the standard anti-fraud filters applied by payment providers.
3. Source of the data
All data is provided by the data subject. No data is obtained from third-party sources and no databases are purchased.
4. Recipients
- Suppliers and warehouses that prepare and dispatch the order.
- Carriers and logistics operators, for delivery and tracking.
- Customs representatives and agents, for import clearance into the European Union.
- Payment service providers, which process payment data as independent controllers.
- Hosting, e-mail, analytics and IT support providers, acting as processors.
- Public authorities and courts, where there is a legal obligation.
5. International transfers
Because the goods are dispatched from outside the European Union, certain shipping data is disclosed to suppliers and carriers located in third countries, mainly in the People’s Republic of China. These transfers rely on Article 49(1)(b) GDPR, being necessary for the performance of the contract with the data subject and, where possible, on standard contractual clauses approved by the European Commission. Further information on the safeguards applied can be requested at info@gmcommerce.es.
6. Your rights
You may exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as the right not to be subject to automated individual decisions. You may withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise them, send a request to info@gmcommerce.es or by post to the address above, proving your identity. A reply will be provided within one month, extendable by two further months in complex cases.
If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country of residence.
7. Security
GM COMMERCE applies appropriate technical and organisational measures: TLS encryption across the site, access control to systems and regular backups.
8. Minors
The site is not directed at children under 14. Data of minors is not knowingly collected without the consent of those holding parental responsibility.
9. Changes
This policy may be updated. The version in force is always the one published on this page.