Privacy Policy

At Private Plug, we look after your data with the same rigour we apply to verifying every piece. This policy explains what data we process, why, on what legal basis, for how long and what rights you have. It complies with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Data controller

• Controller: David Martín Juberías (trading name: Private Plug)
• Tax ID (NIF): 21756093W
• Address: Barcelona 08019, Barcelona, España
• Email: hola@privateplug.es
• Telephone: —
• Website: https://privateplug.es We have not appointed a data protection officer, as this is not mandatory for our activity. For any privacy matter, email us at hola@privateplug.es.

What data we process

Depending on how you interact with us, we may process:

• Identification and contact data: first name, surname(s), email, telephone, and shipping and billing address.
• Purchase data: products, sizes, amounts, order history and related communications.
• Payment data: only the outcome of the transaction and limited data provided to us by the payment gateway (for example, the last digits or the brand of the card). We never see or store your full card number.
• Tax data: tax ID (NIF) or equivalent document, if you request a full invoice.
• Private order data: the pieces you are looking for, sizes, preferences and approximate budget.
• Browsing data: only what is strictly necessary and, if you accept it, analytics data (see the Cookie Policy). The data marked as mandatory on each form is necessary to deal with your request. If you do not provide it, we will not be able to process your request. When you send us data relating to third parties (for example, the recipient of a gift), you guarantee that you have permission to do so.

Purposes, legal bases and retention periods

Order management and invoicing

• Purpose: to process your purchase, collect payment, prepare and ship the order, keep you informed of its status, handle returns, exchanges, guarantees and incidents, and issue the invoice.
• Legal basis: performance of the sales contract (Art. 6.1.b GDPR) and, for invoicing and accounting, compliance with legal obligations (Art. 6.1.c GDPR).
• Retention: for as long as the contractual relationship lasts and, afterwards, for the statutory periods: 6 years for accounting and commercial records (Art. 30 of the Spanish Commercial Code) and 4 years for tax purposes (Law 58/2003, General Tax Law). The longest applicable period always applies. We may also retain the data, blocked, for as long as any liability may arise (for example, during the legal guarantee period).

Private orders and contact forms

• Purpose: to answer your enquiries and, if you request a private order, to source the piece, send you a quote and follow up.
• Legal basis: taking pre-contractual steps at your request (Art. 6.1.b GDPR) when you request a private order or a quote, and our legitimate interest in responding to the enquiries you send us (Art. 6.1.f GDPR).
• Retention: for as long as necessary to resolve your enquiry or private order. If no purchase is made, we will delete the data no later than 12 months after the last contact, unless you ask us to keep the search open.

“VIP drop access” newsletter

• Purpose: to send you news, releases, available pieces and marketing communications from Private Plug by email.
• Legal basis: your consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE).
• Retention: until you unsubscribe. You can do so at any time using the link included in every email or by writing to hola@privateplug.es.

Size and availability alerts

• Purpose: to let you know when a product or size you are interested in becomes available again.
• Legal basis: your consent (Art. 6.1.a GDPR).
• Retention: until we send you the alert or you withdraw your consent and, at most, 12 months from your request.

Web analytics

• Purpose: to understand in aggregate how the website is used in order to improve it.
• Legal basis: your consent, collected through the cookie panel (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). It is not activated without your consent.
• Retention: in accordance with the periods set out in the Cookie Policy.

WhatsApp customer service

• Purpose: to handle the enquiries, orders or private orders you send us via WhatsApp when you choose that channel and message us.
• Legal basis: your consent when you start the conversation and, where it relates to an order or private order, the performance of the contract or of pre-contractual measures (Art. 6.1.a and 6.1.b GDPR).
• Retention: for as long as necessary to deal with your request and, if it leads to a purchase, the periods indicated for orders. You can ask us to delete the conversation whenever you wish.

Identity verification for high-value orders

• Purpose: to prevent fraud and unauthorised payments on high-value orders, such as luxury watches. In such cases, we may ask you to confirm your identity or certain order details before dispatch or on delivery. We will only request the information that is strictly necessary and will explain why we need it.
• Legal basis: our legitimate interest in preventing fraud (Art. 6.1.f GDPR and Recital 47).
• Retention: for as long as necessary to complete the verification and, where applicable, for the duration of the order and the periods for possible claims. We do not keep copies of identity documents beyond what is strictly necessary.

Automated decision-making and profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you. The payment gateway applies its own fraud prevention systems to the transaction, in accordance with its privacy policy. If you have signed up to the newsletter, we may tailor our communications to the interests you have told us about (for example, sizes or brands), without creating profiles beyond what is described here.

Recipients and data processors

We do not sell your data. We only disclose it to third parties when necessary to provide you with the service or when required by law:

• Stripe Payments Europe, Ltd. (Ireland): payment processing and fraud prevention.
• Hosting provider: [HOSTING PROVIDER], hosting of the website and its database.
• Email provider: [EMAIL PROVIDER], sending of transactional emails and, if you subscribe, the newsletter.
• Transport and courier companies: delivery of your orders (name, address, telephone and, where applicable, email).
• Tax and accounting advisers: management of accounting and tax obligations.
• Public authorities, courts and tribunals: where there is a legal obligation to do so (for example, the Spanish Tax Agency).
• Google Ireland Limited (Google Analytics): only if you accept analytics cookies.
• WhatsApp Ireland Limited (Meta group): only if you choose that channel to talk to us. Providers acting as data processors do so under contract and following our instructions, in accordance with Article 28 GDPR.

International transfers

Some providers, such as Stripe and Google, may process data in the United States through their group entities. For certified entities, these transfers are based on the EU-U.S. Data Privacy Framework (DPF), covered by the European Commission's adequacy decision of 10 July 2023, and on the standard contractual clauses approved by the European Commission. The same applies to WhatsApp (Meta) when you use that channel.

Minors

This website is not aimed at children under 14 and we do not knowingly collect their data. If you are a parent or guardian and become aware that a minor has provided us with data, email us at hola@privateplug.es and we will delete it. You must be of legal age to make a purchase.

Your rights

You may exercise the following rights at any time:

• Access: to know whether we process your data and obtain a copy.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data when it is no longer necessary, among other cases.
• Objection: to object to processing based on our legitimate interest or carried out for direct marketing purposes.
• Restriction of processing: to ask us to keep your data only for the purposes of claims, in the cases provided for by law.
• Portability: to receive the data you provided to us in a structured and commonly used format, or to have it transmitted to another controller.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out beforehand.

How to exercise them

Email us at hola@privateplug.es or send a letter to Barcelona 08019, Barcelona, España, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month, which may be extended by two further months in complex cases, in which case we will let you know.

Complaints to the supervisory authority

If you believe we have not properly addressed your rights, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid. We would be grateful if you contacted us first so that we can try to resolve the matter.

Security

We apply technical and organisational measures appropriate to the risk, including:

• Encrypted HTTPS connection across the entire website.
• Payments processed by Stripe, which complies with the PCI DSS standard. Private Plug does not store your card details.
• Access to data restricted to authorised persons, with individual credentials.
• Passwords stored in encrypted form using secure hash functions.
• Regular backups and system updates. No system is infallible. In the event of a security breach posing a risk to your rights, we will act in accordance with the GDPR and, where appropriate, inform you.

Changes to this policy

We may update this policy to adapt it to changes in the law or in our services. We will always publish the current version on this page, together with the date it was last updated. If the changes are significant, we will notify you by appropriate means. Last updated: 1 October 2026. This English version is provided for convenience. In the event of any discrepancy, the Spanish version shall prevail.