ORLOZDigital

1. Data Controller
ORLOZDigital is operated by ORLOZ TECHNOLOGIES SOCIEDAD LIMITADA, a company registered in Spain (NIF B05663885), at Av. Alcalde José María Blanc, 80, 02008 Albacete, Spain.
We are responsible for the personal data we process in connection with operating our Etsy shop, independently of Etsy's own data processing activities.

2. Information We Collect
When you purchase a product or contact us, we may receive information from Etsy or directly from you, including your name, Etsy username, email address, billing details where needed, order details, transaction references and messages. Support requests may include technical details and screenshots you provide. Please use fictional examples and remove personal information from support files; do not send completed private inventories or other sensitive records.
We do not directly collect or store your payment card information. Payments are processed through Etsy Payments.

3. How We Use Your Information
We use order and contact information to fulfil purchases and provide related support (GDPR Article 6(1)(b)); billing and transaction records to meet applicable accounting and tax obligations (Article 6(1)(c)); and proportionate information to prevent fraud, secure our systems and establish, exercise or defend claims (Article 6(1)(f), our legitimate interests in protecting the business and resolving disputes). We process rights requests to meet our data protection obligations (Article 6(1)(c)).
Order and billing details required to fulfil the contract or meet legal obligations are necessary for those purposes; without them we may be unable to complete the transaction or the relevant request.
We do not sell buyers' personal information or use Etsy purchase information for unsolicited marketing.

4. Recipients and Service Providers
We disclose information only where necessary for these purposes or a legal requirement. This may include Etsy, accounting and tax advisers, and competent public authorities. Etsy operates its marketplace and payment services under its own privacy policy: https://www.etsy.com/legal/privacy/ . Etsy is not our processor for those independent activities.
We use Google Workspace for corporate email, including etsy@orloz.es, an alias of peio@orloz.es. Google processes customer email content on our behalf under its Cloud Data Processing Addendum, accepted on 18 October 2026. Google also has its own responsibilities for data it processes for its own purposes under the applicable terms.

5. Data Retention
We retain information for as long as needed for the relevant purpose and applicable obligations. Support information is reviewed after the case closes; we retain what is needed for outstanding support, disputes or legal duties. Business books, correspondence and supporting records covered by Article 30 of the Spanish Commercial Code are generally retained for six years from the last entry; tax retention also depends on applicable limitation periods, interruptions and special rules. These rules do not require keeping every support attachment for six years.
Unnecessary information is deleted or anonymised where we control it, subject to legally required retention or restricted retention for liabilities. Etsy independently determines retention within its own services; requests to us do not automatically delete Etsy's records.

6. Your Rights
Depending on applicable law, you may request access, rectification, erasure, restriction, portability or object to processing based on legitimate interests. Contact us through Etsy Messages or etsy@orloz.es. Identify your request and the relevant transaction; we will request only information reasonably needed to verify your identity if necessary.
We respond without undue delay and normally within one month of receipt. Where legally permitted, this may be extended by two further months for complexity or number of requests; we will explain the extension within the first month. Erasure and other rights are subject to applicable legal exceptions.
You may lodge a complaint with the Spanish Data Protection Agency (AEPD), https://www.aepd.es/ , or another competent supervisory authority.

7. Data Security
We use access controls and multi-factor authentication for our Etsy, corporate email and domain administration accounts. Email authentication includes SPF, DKIM and DMARC; these measures reduce risks but cannot guarantee absolute security.

8. International Data Transfers
Etsy operates internationally under its own privacy policy. Google and its subprocessors may process Workspace data outside the European Economic Area; we do not claim exclusive European storage. Google's Cloud Data Processing Addendum provides applicable transfer safeguards, including standard contractual clauses where required and subject to its terms: https://cloud.google.com/terms/data-processing-addendum/ . You may contact us for information about safeguards relevant to our processing and how to obtain a copy, subject to lawful redactions.

9. Contact
Our main customer support channel is Etsy Messages. The complementary corporate contact is etsy@orloz.es. Privacy requests may be submitted through either channel.
Updated: 18 October 2026.