Privacy policy

1. Data controller

In compliance with Regulation (EU) 2016/679 and Organic Law 3/2018, the user is informed that the data controller is Jaume Artigues Perelló (Posters House), with NIF 39851640T, domiciled at Berguedà 9, 08328 Alella, Barcelona, Spain, and contact email postershouse61@gmail.com.

2. What personal data we process

Depending on your use of the website, we may process the following categories of data: identification data (first name and surname); contact data (email address, telephone number); postal and billing data; customer account data (user identifier, encrypted credentials or authentication mechanisms, preferences and account status); data relating to orders, returns and incidents; communications with customer service; and data necessary to manage payments through Stripe.

Card data is not stored directly by Posters House if the payment is processed through the external payment gateway enabled for this purpose, without prejudice to the minimum transactional information that we must retain for administrative, accounting and anti-fraud purposes.

3. Purposes and legal basis of processing

• a) Managing purchases, payments, shipping, returns and after-sales support. Legal basis: performance of the purchase agreement.
• b) Creating and maintaining the customer area, enabling login, password recovery, access to order history and account management. Legal basis: performance of the contractual relationship or implementation of pre-contractual measures at the request of the data subject.
• c) Handling enquiries or requests submitted by email or through forms. Legal basis: consent of the data subject or, as applicable, pre-contractual measures.
• d) Complying with legal obligations in tax, accounting, consumer protection, fraud prevention or cooperation with competent authorities. Legal basis: compliance with legal obligations.
• e) Ensuring website security, preventing misuse and managing technical incidents. Legal basis: legitimate interest in protecting the integrity of the platform and transactions carried out.
• f) Sending commercial communications by electronic means, newsletters or promotions, when this feature is enabled. Legal basis: prior consent of the user, except in cases permitted by applicable regulations for existing customers regarding similar products, with a simple and free option to opt out in each communication.

4. Mandatory nature of data

Data requested and marked as mandatory in purchase or registration forms is necessary to process the order, provide the service or maintain the user account. If such data is not provided, it may not be possible to complete the purchase, manage the shipment or enable certain features of the customer area.

5. Data retention period

Data will be retained for the time necessary to fulfil the purpose for which it was collected and, subsequently, for the legally required periods. In particular:

• Account data: for as long as the account remains active and, thereafter, for the time necessary to address any potential liabilities.
• Order, billing and payment data: for the periods required by tax, accounting and consumer protection regulations.
• Enquiries or requests: for the time necessary to handle them and carry out reasonable follow-up.
• Commercial communications: until the user withdraws consent or objects to receiving them.

6. Recipients and data processors

Your data may be disclosed or made available to third parties when necessary for the provision of the service, including: transport companies for order delivery; Stripe as a payment service provider; hosting, infrastructure, transactional email, technical support, maintenance and website security providers; and public authorities, courts or tribunals when there is a legal obligation. Personal data will not be sold to third parties.

7. International transfers

As a general rule, we will endeavour to ensure that the providers used offer adequate data protection guarantees. However, some technology or payment providers may process data outside the European Economic Area. In such cases, Posters House will adopt the safeguards required by applicable regulations, such as adequacy decisions or standard contractual clauses and equivalent mechanisms that are valid at any given time.

8. Rights of users

The data subject may exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw consent at any time when processing is based on consent, without affecting the lawfulness of prior processing. To do so, you may write to postershouse61@gmail.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you consider that the processing does not comply with current regulations.

9. Security

Posters House adopts reasonable technical and organisational measures to protect personal data and reduce the risks of unauthorised access, loss, alteration or improper disclosure. However, the user should be aware that no security measure on the Internet is absolutely infallible.

10. Commercial communications

If the sending of newsletters or promotions is enabled, a specific mechanism will be provided to obtain consent when required and a simple procedure to unsubscribe in each communication. Pre-ticked boxes should not be used, nor should commercial consent be combined with acceptance of the terms of purchase.

11. Changes to this policy

Posters House may update this Privacy Policy to adapt it to regulatory, technical or operational changes. When modifications are significant, users will be informed through reasonable means.