Privacy Policy

Privacy Policy

In compliance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD, Spanish data protection law).

1. Data controller

  • Controller: Llorenç Jiménez Peinado
  • NIF (Tax ID): 47111802M
  • Address: Carrer de Girona, 41, 1-2, 08700 Igualada (Barcelona), Spain
  • Email: admin@oryx3d.es
  • Telephone: 621 62 13 21

2. Personal data we process

  • Identification and contact data: first name, surname, shipping and billing address, telephone number, email address.
  • Purchase data: products purchased, personalisations requested, order history.
  • Payment data: processed directly by the payment gateway (Shopify Payments); we do not store your full card details.
  • Browsing data: IP address, browser type, pages visited, collected through cookies (see our Cookie Policy).

Note: We do not process special categories of data (Art. 9 GDPR) or knowingly collect data from minors.

3. Purposes and legal basis

Purpose Legal basis (GDPR)
Managing your purchase, payment and delivery Art. 6(1)(b) — Performance of a contract
Responding to enquiries and after-sales support Art. 6(1)(b) — Pre-contractual measures
Compliance with tax and accounting obligations Art. 6(1)(c) — Legal obligation
Sending newsletters and marketing communications Art. 6(1)(a) — Consent
Defence against claims Art. 6(1)(f) — Legitimate interest

4. Retention periods

  • Order data: for the duration of the business relationship and, thereafter, 6 years (commercial and tax obligations).
  • Enquiries without a purchase: 1 year from the last interaction.
  • Marketing communications: until you withdraw your consent.

5. Recipients of the data

Your data may be disclosed to the following recipients, strictly where necessary to provide the service:

  • Shopify (Shopify International Limited, Ireland), as the hosting and management platform for the online shop. The shop's data is hosted in the European Union.
  • Transport companies, to handle deliveries.
  • Payment gateways (Shopify Payments), to process payments.
  • Public authorities, where there is a legal obligation.

International transfers: some data may be processed in Canada or the United States by Shopify group companies and their sub-processors, and the providers of the integrated apps may process technical data outside the European Economic Area. These transfers are covered by the safeguards of the GDPR (European Commission adequacy decisions or standard contractual clauses).

6. Data subject rights

Access
Find out what data we hold about you.
Rectification
Correct inaccurate data.
Erasure
Request the deletion of your data.
Objection
Object to the processing.
Restriction
Restrict the processing.
Portability
Receive your data in a structured format.

To exercise your rights, write to admin@oryx3d.es, enclosing a copy of your national ID card (DNI) or equivalent document.

If you believe that the processing infringes data protection legislation, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

7. Security measures

Appropriate technical and organisational measures have been adopted to ensure the security of personal data in accordance with Article 32 of the GDPR, including an encrypted HTTPS/SSL connection and the security measures of Shopify's own infrastructure.

Last updated: 12 October 2026