Privacy Policy
Last updated: July 27, 2026
Data Controller
Legal Name / Owner: IOTA BESS, S.R.L.
Tax ID (NIF/CIF): 53821600
Contact email: info@g-artisans.com
Data Protection Officer (DPO): For any privacy-related inquiry, please contact: info@g-artisans.com
Legal Basis for Processing
The processing of your personal data is based on the following lawful conditions (Art. 6 GDPR):
- Performance of a Contract: Processing is strictly necessary to perform the Terms and Conditions the User accepts upon registration, to enable the purchase and sale of handcrafted goods between Buyers and Sellers, and to manage support for the Platform.
- Consent: Users consent through a clear affirmative statement or action (opt-in) on forms for specific purposes, such as receiving direct commercial communications, newsletters, or the installation of non-exempt cookies (analytics and advertising). Consent may be withdrawn at any time in a simple manner.
- Legitimate Interest (Art. 6.1.f GDPR): Ensuring security, fraud prevention (including verifying the fully manual/handcrafted nature of products and detecting fake accounts), and the technical and operational improvement of our services.
- Legal Obligation (Art. 6.1.c GDPR): Tax, accounting, and legal compliance in accordance with European Union legislation and applicable national regulations for the Data Controller.
Purposes of Data Processing
We process your personal data solely and exclusively to:
- Manage, create, verify, and administer user accounts and profiles (both Buyers and Sellers).
- Process commercial transactions, billing, service fees, and facilitate physical delivery of products through the technical transfer of data between Buyer and Seller.
- Send direct marketing and informational communications (only with prior, express consent).
- Analyze web usage and performance via Google Analytics (subject to user consent via the cookie banner).
- Improve the service, fix bugs, and maintain the technical security and integrity of the Platform.
Recipients of Personal Data
Your data may be shared with:
- Marketplace Sellers or Buyers: Only essential, necessary data (such as name and physical delivery address) will be transferred so the Seller can ship the purchased handcrafted product or handle returns. The Seller processes this data as an independent controller, contractually bound to comply with the GDPR.
- Supabase, Inc. (Data Processor): Database storage, CRM, and user authentication.
- Resend, Inc. (Data Processor): Provider for sending transactional and service emails.
- Vercel, Inc. (Data Processor): Technical infrastructure and hosting provider for the Platform.
- Google Ireland Limited (Data Processor): Provider of the Google Analytics web analytics service (used with IP anonymization enabled).
- Legal authorities, law enforcement, and courts: When required by a legal obligation or binding court order.
Retention Periods
| Data Type | Retention | Legal Justification for Retention |
|---|---|---|
| Account data | Until account deletion + the legal statute of limitations for contractual liability. | To handle contractual claims or post-sale disputes. |
| Email / Marketing communications | 2 years | Or until the user withdraws consent. |
| Analytics data | 26 months (GA4 default) | For platform improvement purposes (aggregated/anonymized data). |
| Transaction and billing records | 6 to 10 years | Mandatory legal obligation to retain accounting and tax records (depending on the company's jurisdiction of incorporation). |
Your Rights
Under the GDPR, you have the following rights, completely free of charge:
- Access: Request confirmation of whether we process your data and obtain a copy of it.
- Rectification: Request correction of inaccurate, incomplete, or outdated data.
- Erasure (Right to be forgotten): Request deletion of your data when, among other reasons, it is no longer necessary for the purposes it was collected for and no legal retention obligation prevents it.
- Portability: Receive your data in a structured, commonly used, machine-readable format, or request its direct transmission to another controller.
- Objection: Object to the processing of your data, particularly regarding direct marketing or profiling.
- Restriction: Request limitation of the processing of your data under certain circumstances set out in Article 18 GDPR.
- Right not to be subject to automated decisions: The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you.
Channel for exercising your rights: Send a formal email detailing your request to: info@g-artisans.com. To ensure account security, we may require you to verify your identity (for example, via a copy of an official ID document or confirmation from your registered email) before processing your request. We respond to all requests within a maximum of 20 business days from receipt (extendable by an additional two months in exceptionally complex cases, with prior notice to the data subject).
Cookies and Tracking Technologies
We use cookies to ensure functionality and improve the user experience:
- Technical / Essential: Session management and login. As they are strictly necessary for the website to function, they do not require your consent.
- Analytics: Google Analytics, only if the user actively accepts them in our settings panel.
- Marketing and Retargeting: Advertising pixels, which are only activated after the user's explicit, active consent.
You have the right to change your preferences or withdraw your consent regarding cookies at any time via the "Cookie Settings" link in the website footer.
Supervisory Authority and Complaints
If you believe the processing of your personal data infringes European data protection regulations, you have the right to lodge a complaint with:
- The Data Protection Authority of your habitual residence or place of work within the European Union.
- Or, the supervisory authority of the country where g-artisans' registered office is located. (If incorporated in Spain, the Spanish Data Protection Agency - AEPD | www.aepd.es).