Privacy policy
Privacy Policy
Last updated: 12 September 2026
Who is responsible for your data
Ludosati Sociedad Limitada sells physical leather products, including personalised items, through Shopify. We are the data controller responsible for the personal data we process when you visit Ludosati.com, shop with us, contact us or submit a review. Our registered address is Calle De Valverde 17, 3c, 28004, Madrid, Spain.
For privacy questions or requests, contact Jonas B. through our contact page. You can also write to our registered address.
Information we use and why
Orders and delivery: your name, contact details, billing and delivery addresses, products, personalisation instructions, order history and payment status. We use these to fulfil your purchase, arrange delivery, communicate about your order and handle returns or statutory remedies. The legal basis is performing our contract or taking steps you request before a purchase.
Payments: Shopify Payments and PayPal process payment information. We use the transaction information available to us to confirm payments, issue refunds and resolve payment disputes. Processing needed for payment is based on the purchase contract; financial recordkeeping is based on legal obligations.
Messages and support: your contact information and what you send us. Order-related support is based on the contract. For other enquiries, our legitimate interest is responding to people who contact the business and keeping an appropriate record of the response.
Reviews: your review, reviewer name and optional photographs or videos, together with information needed to associate a review with a product or purchase. Our legitimate interest is providing useful customer feedback and administering authentic reviews. Submission is voluntary. Reviews and media are used only in the website review section, not on social media or in advertising.
Store operation and legal responsibilities: technical information such as IP address, browser and device information, and records of website or transaction activity. Our legitimate interests are operating the store, identifying faults, preventing fraud and handling legal claims. We also process records to comply with tax, accounting and other legal duties. Optional analytics and advertising tracking rely on consent, as explained below.
We receive information directly from you, automatically through your interaction with the store, and from providers involved in your order, such as payment and delivery services. If someone orders a gift for you, we receive the delivery information they provide.
We need the information necessary for payment and delivery to complete an order. Without it, we may be unable to fulfil your purchase. Reviews and their photographs or videos are optional.
Shopify holds customer and order records needed to operate the shop and provides a customer portal for viewing orders and submitting eligible return or cancellation requests. You can sign in using your email address and a verification code, without a password. We use the email address and authentication information needed to provide this access as part of administering your purchase. We do not currently send newsletters.
If you select the optional email-marketing checkbox when signing in, Shopify records your email address and marketing choice. We process that choice on the basis of your consent to manage your marketing preference. You can withdraw it by contacting us; marketing consent is not required to access your orders or request a return.
Who receives information
We use Shopify to host the store and manage checkout and orders, Shopify Payments and PayPal for payments, delivery providers for fulfilment, and Judge.me to collect and display reviews. They receive information relevant to those services. People viewing the website can see published reviews, their displayed reviewer names and any attached media.
Google Ads and Pinterest are configured for advertising measurement. UpPromote is our affiliate software provider and can access customer details, order information and device or browsing information through its Shopify integration. Its referral tracking is covered by the cookie and tracking choices below. There are currently no active affiliates.
Information may also be disclosed where necessary to meet a legal obligation, respond to a lawful request from an authority or establish, exercise or defend legal claims.
Providers processing information on our behalf act under their service and data-processing arrangements. Some providers, including Shopify, payment services and advertising platforms, also process information for their own purposes and are responsible for that processing. Their notices explain those uses:
Shopify privacy information and PayPal privacy information.
How Google uses information from partner sites.
Pinterest privacy information.
UpPromote privacy information.
Cookies and other tracking
Cookies store small amounts of information in your browser. Pixels and similar technologies can transmit information about page visits, devices and purchases. Some information can also be sent between servers, rather than directly from your browser.
Strictly necessary technologies support functions such as the cart, checkout, security and recording your privacy choices. They do not require cookie consent where they are necessary to provide a service you request.
Optional analytics help understand how people use the store. Advertising technologies, including Google Ads and Pinterest, can connect visits or purchases with advertising, measure results and support relevant advertising. Depending on the service and your choices, information can include online identifiers, IP address, device details, page activity and purchase events. Advertising providers may link it with information they already hold about you. UpPromote supports referral attribution. These optional tracking purposes require your consent.
TinyCookie provides the store's cookie choices. You can accept or reject optional cookies, choose categories and change or withdraw your choice through the website's cookie controls. Rejecting optional tracking does not prevent you from making a purchase. Consent is separate from accepting our terms, and continuing to browse is not consent.
You can also block or delete cookies through your browser settings, although blocking necessary cookies may affect checkout. Browser controls do not necessarily stop information sent between servers. For questions or help exercising your choices, contact us.
International processing
Our providers operate internationally, so information can be processed outside Spain and the European Economic Area, including in Canada and the United States. UpPromote states that it processes and stores personal information on servers in the United States.
International transfers must have a lawful basis under data protection law. Shopify's Data Processing Addendum describes its transfer arrangements, including binding corporate rules for certain transfers within its group and standard contractual clauses where applicable. These mechanisms impose data protection obligations on recipients; they are distinct from consent to cookies.
Contact us for information about the arrangements relevant to your data and how to obtain a copy of applicable safeguards.
Security
Shopify uses Transport Layer Security (TLS) to encrypt connections to our online store. This protects information in transit between your browser and Shopify. If you suspect unauthorised access to your order information, please contact us.
How long information is kept
Order information is needed to fulfil your purchase and administer returns, legal guarantees and related claims. Spanish commercial law requires relevant business books and supporting records to be retained for six years from the last entry in the books. Records may need to be kept longer where a specific legal obligation or an unresolved proceeding requires it. This does not mean every piece of browsing or review data must be kept for six years.
Support information is kept as needed to resolve the enquiry and deal with related obligations or claims. Reviews and optional media are kept for their publication in the review section, subject to removal requests and any limited retention needed for a legal dispute. Technical and tracking information is retained according to its operational purpose, the relevant technology's lifetime and applicable consent choices.
Marketing preference records are kept while needed to administer your choice. If you withdraw consent, limited records may remain where necessary to respect that withdrawal or establish the consent history for a legal claim.
When information is no longer needed, it must be deleted or anonymised, except where the law requires restricted retention. Spanish data protection law can require information to be blocked for the applicable liability period before final deletion.
Your rights and choices
Subject to the conditions in applicable data protection law, you can ask for access to your personal data, correction of inaccurate or incomplete information, deletion, or restriction of processing. Where automated processing is based on consent or a contract, you can receive the data you provided in a portable format and, where technically feasible, have it transmitted to another controller.
You can object to processing based on legitimate interests because of your particular situation. You can object to direct marketing and related profiling at any time. You can also withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
You also have protections against decisions based solely on automated processing that produce legal or similarly significant effects, subject to the exceptions provided by law. Where applicable, these include the right to human intervention, to express your point of view and to challenge the decision.
Contact us to exercise your rights or request removal of a review or its media. You can also write to our registered address. You do not need to sign in to the customer portal to make a privacy request. We may ask for information proportionate to verifying your identity. Requests are normally free. We will respond within one month; if a permitted extension of up to two further months is necessary because of complexity or the number of requests, we will explain this within the first month.
You can complain directly to the Spanish Data Protection Agency (AEPD), or another competent supervisory authority, including one in the EU country where you live or work. In the UK, you can contact the Information Commissioner's Office. You do not need to complain to us first. Any additional rights available under applicable local law remain unaffected.
Children's information
If you are a parent or guardian and believe a child has provided personal information to us without any legally required permission, please contact us. We will assess the request and take the steps required by applicable data protection law, including deletion where appropriate.
Changes to this policy
We will update this policy when relevant processing changes and revise the date above. Where a change requires information to be provided directly or fresh consent, updating this page alone will not replace that requirement.