Privacy policy

Who is responsible for processing your data?

• Controller: Sergi Palau Popis
• Address: Barcelona, Spain
• Email: sergi@sergipopis.com
• The owner also acts as Data Protection Officer, to whom any questions about the processing of your personal data may be addressed.

What personal information do we collect?

• Through the contact form: name, email address and the message you send us.
• If you create a user account: email address and password or, if you sign in with Google, the basic details of your Google account (name, email address and profile picture). Also the details you complete in your profile: first name, last name, date of birth, communication language, photo and your preference regarding commercial communications.
• If you buy from the shop: name, email address, product purchased, amount and date of purchase, and a record of your downloads.
• Basic navigation data (IP address, browser type, pages visited) that may be recorded in server logs for technical and security reasons.
• We do not collect or store credit card data: payments are entered and processed directly on the Stripe platform. We do not process sensitive data either.
• Personal data processed by sergipopis.com comes directly from the data subject or, if you sign in with Google, from your Google account with your authorisation.

What do we use your personal data for?

• Responding to your enquiry: managing messages received through the contact form.
• Managing your user account and your shop purchases: sign-up and sign-in, payment processing, delivery of downloadable products, sending account and purchase emails, and issuing the corresponding documentation.
• Sending you commercial communications about new products, only if you have expressly accepted this in your profile.
• Responding to the exercise of your privacy rights and handling queries, requests and complaints.
• Prevention, detection and control of fraudulent or abusive use of the website.

How long do we keep your personal data?

Contact form data will be kept for as long as needed to handle your enquiry and for no more than 12 months after the last contact. Your user account data will be kept for as long as your account remains active; you can request its deletion at any time. Purchase data will be kept for the periods required by applicable tax and commercial law. After these periods, data will be blocked and subsequently deleted from all systems, unless there is a legal obligation to retain it.

What is the legal basis for processing your data?

• Consent of the data subject (Art. 6.1.a GDPR): managing the enquiry submitted through the contact form and sending commercial communications if you have accepted them. You may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Performance of a contract (Art. 6.1.b GDPR): creating and managing your user account and the purchases you make in the shop. Without this data it is not possible to complete the purchase or provide your downloads.
• Compliance with a legal obligation (Art. 6.1.c GDPR): invoicing and responding to privacy rights requests.
• Legitimate interest (Art. 6.1.f GDPR): prevention and detection of fraud and abusive use of the site.

Who do we share your data with?

• Public authorities and bodies when required by tax, labour or other applicable law.
• Supabase (supabase.com): data processor providing the database and the authentication system for user accounts.
• Stripe (stripe.com): payment processor for the shop. Your card details are entered directly on Stripe and never reach this website.
• Google (google.com): only if you choose to sign in with your Google account.
• Resend (resend.com): data processor for sending emails (contact form, welcome and purchase confirmations). Processes data in compliance with the GDPR.
• Vercel (vercel.com): website hosting provider. May log basic access data for technical purposes.
• Where an international data transfer is necessary, the parties involved will have previously demonstrated the adoption of appropriate safeguards.
• sergipopis never sells your personal data to third parties.

How does sergipopis protect your data?

• The website uses encrypted HTTPS (TLS) connections for all communications.
• Emails are sent via Resend with encrypted connections.
• User account passwords are stored in hashed form by the authentication provider and are never visible to the owner.
• Access to systems processing personal data is restricted to the owner.
• All necessary technical and organisational measures have been adopted to ensure security, confidentiality and integrity of data.

What are your privacy rights?

• Right of access: obtain confirmation of whether we are processing your personal data and access it.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure (right to be forgotten): request deletion of your data when it is no longer necessary for the purposes for which it was collected.
• Right to restriction: request restriction of processing in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interest or for direct marketing purposes.
• Automated individual decision-making: not to be subject to decisions based solely on automated processing that produce significant legal effects.
• Right to lodge a complaint: with the Spanish Data Protection Agency (aepd.es) if you believe processing does not comply with the GDPR.

How to exercise your rights

You may exercise any of these rights by emailing sergi@sergipopis.com stating the right you wish to exercise and identifying yourself. We will respond within one month of receiving your request.

Amendments to this privacy policy

Should we modify the content of this policy, we will notify you through the website or by email when changes significantly affect your privacy, so that you can review them and, if appropriate, exercise your rights.