Privacy Policy

Last updated: June 11, 2026

1. Who is responsible for your data

The data controller is KODE DIY SL (NIF B21903190), Carrer d'Albuixech 8, Piso 4 Puerta 13, 46019 Valencia, Spain — [email protected].

2. What we process, why, and on what legal basis

• Browsing this store. Our edge provider derives your country from your IP address to show prices in your currency; we keep only the two-letter country code in a cookie for 24 hours. Legal basis: legitimate interest in showing correct prices (Art. 6(1)(f) GDPR). We do not log your IP address in our application.
• Buying. When you click Buy you are taken to our checkout (checkout.kode.diy), operated by Shopify. Shopify collects the data needed to fulfil your order (name, address, email, payment details). Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligations such as invoicing and tax (Art. 6(1)(c)).
• Contacting us. If you email [email protected] we process your address and message to answer you. Legal basis: our legitimate interest in responding (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b)).
• Analytics and marketing cookies (only with your consent). If you accept them in our banner, we use Google Analytics to measure site usage and the Meta Pixel to measure our advertising — each can be accepted or rejected separately. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time. If the banner is not shown, neither is in use. See the Cookies Policy.

3. Who receives your data

• Shopify International Ltd / Shopify Inc. — operates our checkout and order management as our processor under Shopify's Data Processing Addendum. Data may be transferred outside the EEA under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Payment providers — through Shopify's checkout (e.g. card networks, Shop Pay).
• Carriers — name and address, to deliver your order.
• Meta Platforms Ireland Ltd — only if you consented to marketing cookies.
• Google Ireland Ltd — only if you consented to analytics cookies (Google Analytics).

4. How long we keep it

Order and invoicing data: as long as tax and commercial law require (generally 6 years in Spain). Support emails: up to 2 years after the last exchange. The country cookie: 24 hours. Your cookie-consent choice: 12 months.

5. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing, and you may withdraw your consent at any time, by writing to [email protected]. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

6. Automated decisions

We do not make automated decisions or profiling that produce legal effects on you.

7. Changes

We will update this policy when our processing changes and revise the date above.