Privacy Policy (Digital Products)
Last updated: 9 August 2025
Controller: MandalaRoom — Inta Vanaga, Av. Valenciana 7, 2C, 03590 Altea, Alicante, Spain
Contact: mandalaroom.contact@gmail.com
What this policy covers
This policy explains how we collect, use, share, and safeguard your personal data when you browse our website, purchase our digital downloads, or subscribe to our newsletter.
Data we collect
- Order data: name, email, billing details, purchase history, download logs.
- Account/support: your messages and any info you provide when contacting us.
- Newsletter (optional): email address and subscription preferences.
- Device & usage: IP address, browser type, pages viewed, and cookie identifiers (see Cookie Notice).
Why we use your data (legal bases)
- To fulfil your order and provide downloads/support (contract, GDPR Art. 6(1)(b)).
- To meet legal obligations (tax, accounting, fraud prevention) (legal obligation, Art. 6(1)(c)).
- To send the newsletter only if you consent; you can withdraw anytime (consent, Art. 6(1)(a)).
- To secure our services and prevent abuse (legitimate interests, Art. 6(1)(f)).
How long we keep data
- Orders/invoices: kept 6 years for accounting and audit purposes (Commercial Code, Spain).
- Support emails: up to 12 months after resolution.
- Newsletter: until you unsubscribe or ask us to delete your data.
- Cookie/analytics data: per the lifespan listed in our Cookie Notice.
Who we share data with
We share data only with trusted service providers to operate our store:
- Payments: Stripe (processor under its DPA) and/or PayPal (usually an independent controller; see PayPal’s privacy notice).
- Email/newsletters: e.g., MailPoet or similar provider.
- Hosting/website & analytics: web host, security/CDN, and analytics tools.
These providers process data under contracts that comply with GDPR.
International transfers
If any provider is located outside the EEA, we rely on Standard Contractual Clauses (SCCs) and complementary measures where needed. You can contact us for a copy of the relevant safeguards.
Your rights
You have the right to access, rectify, erase, restrict, object, and port your data, and to withdraw consent at any time (this does not affect processing before withdrawal).
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid, Spain — www.aepd.es.
Children’s privacy
Our services are aimed at general audiences. In Spain, if consent is the legal basis, minors under 14 require parental/guardian consent.
Security
We use technical and organisational measures (TLS encryption in transit, access controls, least-privilege accounts, regular updates) to protect your data.
Cookie Notice (summary)
We use essential cookies to run the site and optional analytics/marketing cookies only with your consent. On your first visit you can choose Accept all / Reject all / Manage settings. You can change your choices anytime via Cookie Settings. For details, see our Cookie Policy (purposes, vendors, lifespans).
Email marketing
If you opt in to our newsletter, we will send periodic updates. You can unsubscribe via the link in every email or by writing to mandalaroom.contact@gmail.com.
Changes
We may update this policy from time to time. We will post the new version with an updated date.
Contact
For any request regarding your personal data: mandalaroom.contact@gmail.com or the postal address above.