Privacy Policy

1. Data Controller

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (“LOPDGDD”), users are informed that the data controller responsible for processing their personal data is:

Company name: ASTRAL ROOFTOP CLUB, S.L.
Tax Identification Number (N.I.F.): B19936004
Registered office: C/ Núñez de Balboa, 120, 28006 Madrid, Spain
Email: info@by-astral.com

Hereinafter, “ASTRAL”.

This Privacy Policy explains how ASTRAL collects, uses, stores and protects personal data when users browse this website, make a purchase, create an account, contact us or otherwise interact with the services offered through the website.

2. What Personal Data Do We Process?

Depending on the relationship between the user and ASTRAL and the services used, we may process the following categories of personal data:

Identification and Contact Data

Such as:

• name and surname;
• postal address;
• email address;
• telephone number.

Order and Purchase Data

Such as:

• products purchased;
• order amount;
• purchase date;
• billing address;
• delivery address;
• returns and refunds;
• order-related incidents;
• communications regarding purchases.

Payment and Financial Data

Certain payment information may be processed where necessary to complete transactions.

Payments may be processed directly by third-party payment service providers. As a result, ASTRAL may not have access to complete bank card details or other sensitive payment credentials.

Customer Account Data

Where the user creates an account, we may process information required to create, maintain and manage that account.

Information Provided Through Forms or Communications

This includes any personal information voluntarily provided by the user when contacting ASTRAL through email, contact forms, customer service channels or other communication methods.

Marketing Data

This may include:

• email address;
• marketing preferences;
• consent status;
• interaction with newsletters and promotional communications.

Technical and Browsing Data

Depending on the user’s privacy preferences and cookie consent, we may process information such as:

• IP address;
• device type;
• operating system;
• browser;
• online identifiers;
• website interactions;
• pages visited;
• traffic source;
• purchase or conversion events.

3. Why Do We Process Personal Data?

Managing Orders and Purchases

We process personal data to:

• process and manage purchases;
• manage payments and billing;
• prepare and deliver orders;
• provide order status information;
• manage returns, refunds and exchanges;
• handle incidents and claims;
• provide customer support.

The legal basis for this processing is the performance of a contract with the user or taking steps at the user’s request prior to entering into a contract.

Responding to Enquiries and Requests

Where a user contacts ASTRAL, we may process their personal data in order to:

• respond to enquiries;
• manage requests;
• provide information;
• resolve incidents;
• provide customer support.

Depending on the nature of the request, the legal basis may be the performance of a contract, pre-contractual measures, legitimate interests or the user’s consent.

Customer Account Management

Where users create a customer account, we may process personal data in order to:

• create and maintain the account;
• authenticate the user;
• allow access to previous orders;
• simplify future purchases.

The legal basis is the performance of the contractual or pre-contractual relationship requested by the user.

Compliance with Legal Obligations

ASTRAL may process and retain personal data where necessary to comply with:

• tax obligations;
• accounting obligations;
• invoicing requirements;
• consumer protection regulations;
• fraud prevention requirements;
• legal or regulatory obligations.

The legal basis for such processing is compliance with a legal obligation.

Commercial Communications

Where the user has provided consent, ASTRAL may use their contact details to send information relating to:

• products;
• promotions;
• launches;
• events;
• offers;
• news;
• other commercial communications relating to ASTRAL.

Users may withdraw their consent at any time by using the unsubscribe option included in the communication or by contacting:

info@by-astral.com

Where there is an existing customer relationship, ASTRAL may also send communications regarding its own products or services that are similar to those previously purchased, where permitted by applicable law.

Users will always have the ability to object to receiving such communications.

Website Analytics and Improvement

Where the user has provided the necessary consent, ASTRAL may process browsing and usage information for purposes such as:

• analysing website performance;
• understanding how users interact with the website;
• measuring traffic;
• identifying technical issues;
• improving the user experience;
• evaluating commercial performance.

Third-party services such as Shopify, Google or other analytics providers may be used for these purposes.

Where consent is legally required, the legal basis for such processing will be the user’s consent.

Advertising and Marketing Measurement

Where authorised by the user, ASTRAL may process information relating to website interaction for purposes including:

• measuring advertising campaign performance;
• measuring conversions;
• creating advertising audiences;
• personalising advertising;
• limiting advertisement frequency;
• understanding advertising attribution.

These services may involve technology providers such as:

• Meta Platforms, including Facebook and Instagram advertising services;
• Google, including Google Ads and analytics or measurement services;
• Shopify;
• other marketing or advertising platforms integrated into the website.

Where required by law, the legal basis for this processing will be the user’s consent.

Further details are available in the website’s Cookie Policy.

4. Commercial Communications

ASTRAL will only send electronic commercial communications where there is an appropriate legal basis for doing so.

As a general rule, communications will be sent where the user has expressly requested them or has provided consent.

Where there is an existing contractual relationship, ASTRAL may also send commercial communications regarding its own products or services that are similar to those previously purchased, where permitted by law.

Users may unsubscribe at any time and free of charge by:

• using the unsubscribe link included in marketing emails; or
• contacting info@by-astral.com.

5. How Long Do We Keep Personal Data?

Personal data will only be retained for as long as necessary to fulfil the purpose for which it was collected.

In particular:

Order and contractual data may be retained for the duration of the contractual relationship and subsequently for the periods required under applicable tax, accounting, consumer protection or civil legislation.

Customer service and enquiry data will be retained for as long as necessary to respond to and manage the request and thereafter for any period required to address potential legal responsibilities.

Marketing data will be retained until the user withdraws consent or objects to receiving further communications.

Cookie and browsing data will be retained for the periods described in the Cookie Policy and according to the preferences selected by the user.

Once the relevant retention period has expired, personal data may remain blocked for the statutory limitation periods applicable to potential legal claims or obligations.

6. Who May Receive Personal Data?

ASTRAL does not sell customers’ personal data.

However, certain information may be shared with or accessed by third-party service providers where necessary to operate the website, process purchases or provide services.

These providers may include:

• e-commerce and hosting providers;
• payment processors;
• logistics and delivery companies;
• technology providers;
• website maintenance and security providers;
• accounting and invoicing services;
• customer support providers;
• email marketing platforms;
• analytics services;
• digital advertising providers;
• legal, tax, accounting or administrative advisers.

This website operates through Shopify, and Shopify may therefore process certain personal data required to provide its e-commerce infrastructure and associated services.

Service providers will only have access to personal data to the extent necessary to perform their functions and will be subject to the corresponding legal and contractual data protection obligations.

ASTRAL may also disclose personal data to public authorities, courts, regulators or other competent bodies where required by law.

7. International Data Transfers

Some technology providers used by ASTRAL may process personal data in countries outside the European Economic Area.

Where an international transfer of personal data takes place, ASTRAL will ensure that the transfer is carried out using the safeguards required under applicable data protection legislation.

Such safeguards may include:

• adequacy decisions adopted by the European Commission;
• Standard Contractual Clauses;
• other legally recognised transfer mechanisms.

Users may obtain further information regarding the processing carried out by individual service providers by consulting their respective privacy policies.

8. Cookies and Tracking Technologies

This website uses cookies and similar technologies.

Strictly necessary cookies may be used where required for the proper functioning of the website.

Analytics, advertising, personalisation or tracking technologies that require consent will only be used in accordance with the user’s cookie preferences.

Users may obtain further information and manage their choices through the website’s Cookie Policy and Cookie Preferences settings.

9. Users’ Data Protection Rights

Users may exercise the rights granted to them under applicable data protection legislation.

Depending on the circumstances, these may include:

Right of access
To obtain confirmation as to whether ASTRAL processes personal data relating to the user and to receive information about such processing.

Right to rectification
To request correction of inaccurate or incomplete personal data.

Right to erasure
To request deletion of personal data where the applicable legal requirements are met.

Right to object
To object to certain processing activities, including certain processing based on legitimate interests or direct marketing.

Right to restriction of processing
To request that the processing of personal data be restricted in the cases provided by law.

Right to data portability
Where applicable, to receive personal data in a structured, commonly used and machine-readable format or request that it be transmitted to another controller.

Right to withdraw consent
Where processing is based on consent, users may withdraw that consent at any time.

Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise these rights, users may contact:

ASTRAL ROOFTOP CLUB, S.L.
C/ Núñez de Balboa, 120
28006 Madrid, Spain
Email: info@by-astral.com

The request should identify the right the user wishes to exercise and include sufficient information to enable ASTRAL to identify the requester.

Where there are reasonable doubts regarding the identity of the person making the request, ASTRAL may request additional information necessary to verify their identity.

10. Right to Lodge a Complaint

If a user considers that ASTRAL has processed their personal data in breach of applicable data protection legislation, they may contact us at:

info@by-astral.com

Users also have the right to lodge a complaint with the competent supervisory authority.

In Spain, the competent authority is:

Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD)
C/ Jorge Juan, 6
28001 Madrid
Spain

11. Security of Personal Data

ASTRAL applies appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful disclosure;
• alteration;
• loss;
• destruction;
• accidental or unlawful processing.

The level of security implemented will be appropriate to the risks associated with the processing and the nature of the personal data involved.

However, no online system can guarantee absolute security, and users are also responsible for appropriately protecting their devices, credentials and passwords.

12. Personal Data Obtained from Third Parties

As a general rule, ASTRAL obtains personal data directly from users.

However, in certain circumstances, personal data may be received from third parties such as:

• payment service providers;
• shipping companies;
• Shopify;
• advertising platforms;
• technology providers;
• customer service providers.

Such information will only be processed where there is a valid legal basis and for the purposes described in this Privacy Policy.

13. Automated Decision-Making and Profiling

ASTRAL may use analytics and advertising technologies that allow audiences to be segmented or advertising campaigns to be personalised, subject to the user’s consent where required.

As a general rule, ASTRAL does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them.

14. Changes to this Privacy Policy

ASTRAL may update this Privacy Policy where necessary due to:

• changes in applicable legislation;
• regulatory developments;
• changes in the services offered;
• changes in technology providers;
• new website features;
• modifications to advertising, analytics or marketing tools.

The applicable version will always be the version published on this website.

Where changes materially affect users’ privacy rights or the purposes for which their personal data is processed, ASTRAL will take the appropriate measures to inform users and, where required, obtain new consent.

15. Contact

For any question regarding this Privacy Policy or the processing of personal data, users may contact:

ASTRAL ROOFTOP CLUB, S.L.
Tax Identification Number (N.I.F.): B19936004
C/ Núñez de Balboa, 120
28006 Madrid, Spain
Email: info@by-astral.com