Privacy Policy

Last updated: 16 Feb 2026

1. Data controller

Controller: Mayesta Design, S.L.

Tax ID (CIF): B93602514

Address: Calle Atajate, 15, 29006 Málaga, Málaga Province (Spain)

Email: info@tapiceriasparis.es

Website: https://www.tapiceriasparis.es/

Data Protection Officer (DPO): No DPO has been appointed.

2.  Personal data we process

Depending on how you use the website, we may process:

• Identification and contact details: first and last name, email, phone.
• Shipping and billing details: address, postcode, city, province, country.
• Purchase data: products, amounts, date, order status, invoices.
• Communications: messages sent via forms/email and our replies.
• Technical and usage data (analytics): cookie/measurement identifiers, IP address and browsing data when the user accepts analytics cookies.

3. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases:

A) Handling enquiries and requests (forms / email)

• Purpose: to respond to and manage the request.
• Legal basis: consent and/or pre-contractual steps (as applicable).

B) Order management and contractual relationship (online store)

• Purpose: to manage purchases, shipping, customer support and invoicing.
• Legal basis: performance of a contract.

C) Compliance with legal obligations

• Purpose: accounting, tax and record-keeping obligations.
• Legal basis: legal obligation.

D) Website security and fraud prevention

• Purpose: to maintain website security and prevent malicious use and fraud.
• Legal basis: legitimate interest in protecting the service and website integrity.

E) Analytics (Google Analytics)

• Purpose: to measure website usage (visited pages, aggregated behaviour) to improve the website.
• Legal basis: user consent via the cookie banner/settings.

4. Data recipients

We do not sell your data.

We may share data with:

• Transport companies (to deliver orders).
• Payment providers (card/PayPal) and banks (transfers) to process payments.
• Accounting/tax advisors (if applicable) for tax and accounting obligations.
• Technology providers (hosting, website maintenance, email, etc.) acting as data processors.
• Google (only if you accept analytics cookies) for the provision of analytics services (Google Analytics).

5. International data transfers

Using Google Analytics may involve processing/transfers of data outside the EEA.

Where transfers to the United States occur, they may rely on an adequacy decision (EU–US Data Privacy Framework) for participating/certified companies, or on other appropriate safeguards if necessary.

6. Data retention

We keep personal data only for as long as necessary for each purpose and to meet legal obligations.

• Enquiries: for the time needed to handle them and afterwards for the minimum necessary to address potential liabilities.
• Orders and invoicing: for the time required to manage the contractual relationship and, additionally, for the statutory periods for keeping business/accounting records.

– As a general rule, Spanish business law requires keeping business documentation for 6 years from the last accounting entry.

– This period may not match the tax limitation period (commonly 4 years).

• Analytics (cookies): as set out in the Cookie Policy and the user's consent settings.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and data portability, and also the right not to be subject to individual automated decisions where applicable.

• How to exercise them: email info@tapiceriasparis.es, stating the right you wish to exercise and providing enough information to identify yourself.
• Response time: generally 1 month (extendable in certain cases).
• Complaint: if you believe your request has not been properly addressed, you may lodge a complaint with the Spanish Data Protection Authority (AEPD).

8. Security

We apply reasonable technical and organisational measures to protect data and prevent unauthorised access, loss or alteration.

9. Minors

The website and online store are not specifically directed at minors.

10) Changes to this policy

We may update this Privacy Policy to reflect legal or technical changes. The current version will always be the one published on the website.