Privacy policy

Last updated: October 2026.

This page explains what personal data we process when you visit or shop at flyandcotarifa.com, what we use it for and what your rights are. We apply the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.

1. Data controller

• Controller: Macarena B. Sánchez (Fly+co Tarifa).
• Tax ID (NIF): 28799652H.
• Address: C/ Sancho IV el Bravo 28, 11380 Tarifa (Cádiz), Spain.
• Email: flyandcotarifa@gmail.com
• Phone: 856 107 620

2. What data we process and why

When you place an order

You don’t need an account to shop. We ask for your name, email, phone number, billing and delivery address (or the SEUR pickup point you choose) and, if you like, a note about your order. We use them to handle your purchase: take payment, prepare and ship it, email you about its status, issue the invoice and deal with returns and warranty claims.

Legal basis: performance of the purchase contract (art. 6.1.b GDPR) and compliance with our tax and accounting obligations (art. 6.1.c GDPR). Without this data we cannot process your order.

Your card or other payment details go directly to the payment provider: we never see or store them.

When you sign up for “10% off your first order”

We use your email to send you the discount code and our news and collections. Legal basis: your consent (art. 6.1.a GDPR), given by ticking the box. You can unsubscribe at any time by writing to us or replying to any of our emails. We also check that the code is used only once per email address.

When you contact us

If you write to us by email, through the contact form or on WhatsApp, we use your data to reply. Legal basis: your consent when contacting us and, if your question is about a purchase, the performance of the contract.

Website security

We log some technical data, such as your IP address, to protect the website against unauthorised access and fraud. Legal basis: our legitimate interest in keeping the website secure (art. 6.1.f GDPR).

Cookies

Cookies and similar technologies are explained in our Cookie policy.

3. How long we keep your data

• Orders and invoices: for as long as the business relationship lasts and then for the periods required by law (six years for accounting records under the Spanish Commercial Code, plus the periods set by tax law) and, in any case, for as long as the warranty on the garments lasts.
• Newsletter: until you unsubscribe.
• Enquiries: up to 12 months after we reply, unless they lead to an order.
• Security data: for as long as needed for that purpose.

4. Who we share your data with

We do not sell or give away your data. We only share it with those who need it to provide the service:

• SEUR, the courier, to deliver your order: name, address or pickup point, phone number and email.
• The payment provider (bank or payment gateway).
• Service providers acting on our behalf and following our instructions: website hosting, email (Google) and the agency that maintains the website.
• Our tax and accounting advisers, and public authorities when required by law (for example, the Spanish Tax Agency).
• If you write to us on WhatsApp, your messages go through WhatsApp (Meta).

5. Transfers outside the European Economic Area

Some of these providers, such as Google, Meta or payment gateways, may process data outside the European Economic Area. When they do, they use the safeguards required by the GDPR: the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

6. Your rights

You can ask us at any time to:

• Access your data.
• Correct it if it is inaccurate.
• Delete it.
• Object to its processing or ask us to restrict its use.
• Receive it in a format you can take to another provider (portability).
• Withdraw your consent, without affecting anything done before.

Write to us at flyandcotarifa@gmail.com saying which right you want to exercise. We will only ask for an ID document if we have reasonable doubts about who you are. We will reply within one month at the latest.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

7. Minors

The shop is intended for adults. We do not knowingly process data of children under 14.

8. Automated decisions

We do not make automated decisions or create profiles with your data.

9. Changes to this policy

If we change this policy, we will publish the new version here with its date.