RootRafter

PRIVACY POLICY — VENACTIS
venactis.etsy.com | Last updated: June 2026

1. DATA CONTROLLER

Full legal name: Cristina Coello Páez
Trading as: Venactis
Status: Sole trader (autónoma)
Country: Spain (European Union)
Contact: dealflowaiproton.me@proton.me

This policy applies in accordance with:
- GDPR (EU) 2016/679
- Spanish LOPDGDD (Law 3/2018, de Protección de Datos
y Garantía de los Derechos Digitales)

2. WHAT THIS POLICY COVERS

This policy applies when you:
- Purchase digital downloads from this Etsy shop
- Contact us for customer support related to your order
- Use any shop communications via Etsy messages

This shop sells ONLY digital products. No physical
shipping takes place. Files are delivered automatically
via Etsy's platform upon purchase confirmation.

Etsy Ireland Unlimited Company (Dublin, Ireland) acts as
platform operator and payment processor, and is an
independent data controller for your data on the Etsy
platform, under Etsy's Privacy Policy (etsy.com/legal/privacy).

As seller, Venactis receives ONLY the order information
provided by Etsy (name and email) strictly to fulfil your
order and provide related customer support.

3. WHAT PERSONAL DATA WE COLLECT AND WHY

Data received from Etsy as seller:

- Name: to confirm and fulfil your digital download purchase
- Email address: to send order confirmation via Etsy
- Order ID and product info: to identify your purchase
and provide customer support

We do NOT receive:
- Payment details (card number, bank account, etc.)
- Full delivery address

Is providing this data mandatory?
Yes. Name and email are required by Etsy to complete
your purchase. Without them, the order cannot be fulfilled.
This is a contractual requirement under Art. 6(1)(b) GDPR.

4. COOKIES

Venactis does not use cookies directly.
Cookies used on the Etsy platform are controlled by Etsy,
as described in Etsy's Privacy Policy (etsy.com/legal/privacy).
We do not track your behaviour on other websites, do not
use analytics tools, and do not run advertising campaigns
through this shop.

5. LEGAL BASIS FOR PROCESSING

- Fulfilment of your digital purchase: Art. 6(1)(b) GDPR
- Customer support related to your order: Art. 6(1)(b) GDPR
- Tax record-keeping (Spanish tax law): Art. 6(1)(c) GDPR

6. DATA SHARING AND RECIPIENTS

We do not sell, rent, or share your personal data with
third parties beyond what is strictly necessary.

Recipients:

1. Etsy Ireland Unlimited Company — platform operator
and payment processor (independent controller).
See: etsy.com/legal/privacy

2. Spanish tax authorities — when required by law.
Legal basis: Art. 6(1)(c) GDPR.

We do not transfer your data outside the EU.

7. DATA RETENTION

- Order details (name, email): minimum 5 years from
transaction date — Ley 58/2003 General Tributaria, Art. 66
- Customer support messages: as long as necessary to
resolve the issue, then up to 5 years
- Payment data: NOT stored by Venactis — handled
entirely by Etsy

After the retention period, data is deleted or anonymised.

8. AUTOMATED DECISION-MAKING

Venactis does not use automated decision-making or
profiling in relation to your personal data.

9. SECURITY

We implement appropriate technical and organisational
measures to protect your data against unauthorised access,
loss, or alteration (GDPR Art. 32). Because we only
receive limited data from Etsy (name and email), the
risk to your data is low. Etsy secures payment data
under its own security measures.

10. YOUR RIGHTS UNDER GDPR AND LOPDGDD

Under GDPR (EU) 2016/679 and Spanish LOPDGDD (Law 3/2018)
you have the right to:

- Access your personal data (Art. 15 GDPR)
- Rectify inaccurate or incomplete data (Art. 16 GDPR)
- Request erasure — right to be forgotten (Art. 17 GDPR)
- Restrict processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Not be subject to automated decision-making (Art. 22 GDPR)

To exercise your rights:
Email: dealflowaiproton.me@proton.me

We will respond without undue delay and within one month
of receiving your request (GDPR Art. 12). In complex or
numerous cases, this period may be extended by two further
months, and you will be informed within the first month.

We may ask for additional information to verify your
identity before processing your request.

11. RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with the Spanish
supervisory authority:

AEPD — Agencia Española de Protección de Datos
Website: www.aepd.es
Address: Calle de Jorge Juan 10, 28001 Madrid, España

You may also contact the supervisory authority in your
country of residence within the EU.

12. UPDATES TO THIS POLICY

This policy was last updated: June 2026.
For material changes, buyers will be informed via shop
announcement on Etsy and, where appropriate, by direct
message related to your order.