Legal
Privacy policy
How GiftBasketsSpain collects, uses, and protects your data — in plain language.
What we collect
When you place an order, create an account, or subscribe to our newsletter, we collect the minimum data we need to fulfil your request: your name, email address, phone number, billing address, recipient address, and payment details. We also log basic device information (browser, operating system, coarse location) for security and analytics.
Why we collect it
Your data is used to arrange and deliver your gift, confirm the order, contact you if there is a question about delivery, and (if you opt in) send you occasional emails about new collections or seasonal specials. We do not sell, rent, or trade your personal data. Our lawful bases under the GDPR are performance of your order (contract), your consent (marketing), and our legitimate interest (fraud prevention and analytics).
Payment security
Card and PayPal payments are processed by PCI-DSS-compliant third parties. Your full card number never touches our servers — we only receive a tokenised reference so we can issue refunds if needed. All pages that collect personal data are served over TLS.
Cookies and analytics
We use first-party cookies for cart persistence, login sessions, and your selected currency. We also use Google Analytics 4 (analytics cookies) to understand how visitors use the site. You can opt out of analytics cookies via the banner at the bottom of the page, or via your browser settings.
Who we share with
We share only the data necessary for each task, and only with providers bound by confidentiality:
- Payment processors (PayPal) — to charge your payment method.
- Delivery couriers — the recipient's name, address, phone and delivery window.
- Email delivery (Zepto / ZeptoMail) — your email address for transactional and (opt-in) marketing emails.
- Public authorities — only if legally required by court order or a valid law-enforcement request.
Your rights
Under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law (LOPDGDD), you may request access to the data we hold about you, correct inaccuracies, request erasure or portability, or object to processing. Email [email protected] with proof of identity and we will respond within one month. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
Retention
Order records are retained for the period required by Spanish accounting and tax law. Marketing consents and newsletter subscriptions are retained until you unsubscribe. Abandoned-cart data is purged after 30 days.
Children
GiftBasketsSpain is a retail service intended for customers 18 and older. We do not knowingly collect data from anyone under 18.
Changes to this policy
If we update this policy in a material way, we will post the new version here and email subscribers at least 14 days before it takes effect.
Contact
GiftBasketsSpain S.L. · Spain
[email protected]