Legal

Privacy policy

This policy explains which personal data we process when you use merch.pekata.be, for what purpose, for how long and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

1. Data controller

  • Company name: Reloting, S.L. (trading name: Pekata)
  • NIF: B19932771
  • Registered office: C/ Casanova 270, Ático 1ª, 08021 Barcelona (Spain)
  • E-mail: [email protected]
  • Domain name: merch.pekata.be

Reloting, S.L. is not required to appoint a Data Protection Officer under Article 37 of the GDPR. For any question relating to this policy you can write to the e-mail address given above.

2. What data we process and why

a) Quote request

  • Data collected: first name and surname, company, e-mail address, telephone (optional), delivery country and postcode, intra-Community VAT number (optional, for European Union companies outside Spain), desired delivery date, comments and the products, quantities and branding you have chosen.
  • Purpose: to prepare and send you the quote, answer your questions about it and manage the order if you accept it.
  • Legal basis: the application of pre-contractual measures at your request (Art. 6(1)(b) GDPR). The subsequent commercial follow-up of your request is based on our legitimate interest in attending to those who have asked us for a quote (Art. 6(1)(f) GDPR); you can object to it at any time.

b) Logo

  • Data processed: the file containing your logo, if you decide to send it to us after requesting the quote.
  • Purpose: to prepare the branding mock-up and, if you accept the quote, to produce the order.
  • Legal basis: pre-contractual measures at your request (Art. 6(1)(b) GDPR).

c) VAT number verification

If you provide us with an intra-Community VAT number, we check it in the European Commission's VIES system in order to apply the correct tax treatment to your quote. The check is an automated query to the European Union's public service and is based on compliance with our tax obligations (Art. 6(1)(c) GDPR).

d) Browsing the site

The servers record technical data for each request (IP address, date and time, page requested and browser) for the sole purpose of ensuring the security of the service and detecting abuse, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

In addition, if you accept them in the cookie notice, we use Google analytics and advertising cookies (Google Analytics 4 and Google Ads, loaded through Google Tag Manager) to measure the use of the site and the effectiveness of our campaigns. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time; if you do not give it, they are not installed. You will find details of these cookies and of the rest of the storage your browser uses in the Cookie policy.

e) Ordering and paying for samples and purchases by card

  • Data collected: first name and surname, e-mail address, telephone (optional), company, VAT number, billing and delivery addresses, the samples or products you order and the outcome of the payment. Card details are processed directly by Stripe: we neither see nor store them, only the card brand and its last four digits.
  • Purpose: to handle your sample request or your purchase, charge for it, prepare it and ship it through our suppliers, issue the invoice and link it to your quote. Before payment we check, with Cloudflare Turnstile, that the person paying is a human.
  • Legal basis: the performance of the contract for the purchase of the samples or products (Art. 6.1.b GDPR), compliance with our tax and accounting obligations (Art. 6.1.c GDPR) and our legitimate interest in preventing payment fraud (Art. 6.1.f GDPR).
  • Retention: for the duration of the business relationship and, afterwards, for the periods required by commercial and tax legislation.

3. Retention periods

We keep the data from your request while the quote is being handled and, if it becomes an order, for the duration of the commercial relationship and the periods required by commercial and tax legislation. A quote that does not become an order is kept for a maximum of two years from the last contact. The servers' technical logs are kept for a maximum of twelve months. Once these periods have elapsed, or your request for erasure has been dealt with, the data will be blocked — available exclusively to judges, courts and public authorities — for the limitation periods of any potential liabilities (Art. 32 LOPDGDD) and destroyed thereafter.

4. Recipients and data processors

We do not disclose your data to third parties, except where legally required. To provide the service we rely on data processors with whom we have signed the contracts required by Article 28 GDPR:

  • Hetzner Online GmbH (Germany): hosting of the site and of our platform, within the European Economic Area.
  • ActiveCampaign, LLC (Postmark) (United States): sending of transactional e-mails, such as the confirmation of your quote request.
  • Google Ireland Limited (Ireland): web analytics and advertising tags (Google Analytics 4 and Google Ads, through Google Tag Manager), subject to your acceptance of cookies.
  • Stripe Payments Europe, Limited (Ireland): card payment for samples and purchases and fraud prevention. For part of that processing, such as fraud prevention, Stripe acts as an independent controller.
  • Cloudflare, Inc. (United States): the Turnstile security check before samples and purchases are paid for.

If the quote becomes an order, we will pass on to the manufacturers and suppliers who produce and brand the products, all of them established in the European Union, the data strictly necessary to manufacture and deliver it: the logo, the contact details and the delivery address.

If you order samples, the supplier that prepares and ships them receives the data strictly necessary to deliver them: the name of the recipient, the delivery address and, if they carry your logo, the design.

5. International transfers

If you pay by card for samples or a purchase, Stripe and Cloudflare may process data in the United States (Stripe, Inc. and Cloudflare, Inc.), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which both are certified, and, in the alternative, by the standard contractual clauses.

If advertising cookies are accepted, we also use the Meta pixel (Meta Platforms Ireland Limited, Ireland) to measure the effectiveness of our campaigns on Facebook and Instagram. This may involve transfers of data to Meta Platforms, Inc. (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Meta is certified. The details are in the Cookie Policy.

Sending transactional e-mails through Postmark may involve a transfer of data to the United States. This transfer is covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which the provider is certified, and, in the alternative, by the standard contractual clauses approved by the European Commission. If you accept the analytics and advertising cookies, Google's services may also involve transfers to Google LLC (United States), covered by the same adequacy decision, under which Google is certified. No other transfers outside the European Economic Area are envisaged.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time. Simply write to [email protected] stating the right you wish to exercise; we may ask you for additional information to confirm your identity.

If you consider that we have not handled your rights properly, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

7. Security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, protecting the data against unauthorised access, loss, destruction or accidental damage.