Privacy policy

This translation is for information only. If there is any discrepancy, the Spanish version prevails.

Here we tell you what data of yours we keep, what for, why we are allowed to, for how long, who else sees it and what you can do. If anything is unclear, ask us.

Who the data controller is

Xpoly is the trading name of Mayra Liendro Almirón, a self-employed trader (autónoma), with NIF Z1696540L and address at Avenida de Finisterre, 192, 11.º izquierda, 15010 A Coruña.
For anything about your data: [email protected], 636 104 026, or at either of our two shops.

Xpoly does not have a data protection officer: given its size and activity, it is not required to appoint one.

Summary

• To browse the website we ask you for nothing. We do not use advertising or analytics cookies.
• You cannot yet buy or pay on the website: you can browse the catalogue and, with an account, reserve pre-orders, which are paid for and collected in the shop. The account is created with your email address and a password, or with your Google account. The rest (name, telephone number, address, date of birth) you give us yourself when it is needed.
• We keep no copy or number of your DNI (if you verify your account, we only note who looked at it and when).
• Our server and our backups are in the European Union. One provider, Cloudflare, is based in the United States, and we explain this below.
• You can see and correct almost everything from ‘Your account’, download your data and delete your account from there too, and ask us for anything else by email.

What data we process and what for

1. Your account

What we keep:

• your email address (which is also your username);
• your password, encrypted in a way that nobody can read it, not even us;
• whether your account is active, when you created it and when you last signed in (so that we know whether you are still using it);
• whatever you add in ‘Your account’: first name, surnames, telephone number, address, postcode, city, province and date of birth (all optional until a reservation —the telephone number— or verification requires them);
• if you wish, a nickname: what people call you in the shop, so that we can find you when serving you. You add it, change it or remove it in ‘Your account’;
• when you accepted this policy and which version;
• if you sign in with Google: your Google account identifier (a number Google gives to each account) and when you linked it. When you sign in, Google also gives us your email address —only if it has confirmed it—, your first name and your surnames: with the email address we record that your email address is confirmed and, if you create your account this way, we put your first name and surnames in your profile, where you can change them whenever you like. We keep nothing else from Google —not even its access keys to your account— and we send Google nothing about you: it is you who signs in to your Google account, and Google confirms to us who you are. If you remove Google from ‘Your account’, or delete your account, the identifier is deleted immediately;
• when a member of our staff changes something in your account from the administration panel, who, when and which field (not the value).

What for: so that you can reserve on the website and see your reservations, and do not have to type in your details each time.
Why we are allowed to: because it is necessary to provide the service you request when you create the account (art. 6.1.b GDPR). Keeping a record of which version of this policy you accepted allows us to show that we informed you (arts. 5.2 and 6.1.c GDPR).
Mandatory: your email address and password, or your Google account; without them there is no account. The rest, only when you need it.
Where it comes from: from you and, if you sign in with Google, from Google, because you ask it to when you click ‘Sign in with Google’.

2. Verification of your account, if you request it

Only if you request verification in order to reserve high-demand items on the website (terms of use, section 4).

What we keep, in addition to your account data:

• when you requested it;
• your date of birth, which is mandatory here (you must be 18), and your complete profile (first name, surnames, telephone number and address);
• when your identity was checked in the shop and which member of our staff checked it. Nothing from the document: no copy, no number, no type;
• when it was verified and by whom, and the three checks that person declares: that you have only one account, that you have no outstanding unpaid amounts or chargebacks with us and that you buy for yourself, not for resale;
• if we refuse or withdraw it: whether it was a refusal or a withdrawal, the reason (always one of the published requirements), when and by whom.

In the shop, to check your identity, our staff look up your account by your full email address or full telephone number.

What for: to check that you meet the published requirements and allow you to reserve high-demand items.
Why we are allowed to: you request it before reserving (art. 6.1.b GDPR, pre-contractual steps taken at your request).
Automated decisions: verification is granted by a person. The system checks only some requirements —being 18, a complete profile, a checked identity— and does not allow verification if any is missing; in ‘Your account’ you can see which one. If you change your first name, surnames, telephone number, address or date of birth, the verification is removed automatically, because it certified those details.

3. The verification history

Each step of the verification is recorded in a history that is not edited or deleted by hand: the request, the identity check, the verification, the refusal or withdrawal, and what the system removes automatically when you change your details.

What we keep for each step: what the step was, when, who took it (a member of our staff, you yourself when requesting it, or nobody if it was the system), the reason if it was a refusal or a withdrawal, the three declarations if it was a verification and, if the step resulted from a change in your details, which field changed, never its new value.

What for: so that we can show that we treat everyone who requests verification equally and that every refusal had a published reason. The equal treatment law prohibits discrimination in access to goods and, if someone reports it with supporting evidence, it is up to us to prove that we did not discriminate.
Why we are allowed to: legitimate interest in being able to defend ourselves against a claim (art. 6.1.f GDPR). It does not keep any contact details, address or document.

4. What you collect in the shop

You cannot yet buy on the website. When you collect a reservation in the shop, the order for that handover is created, and we keep: which items, how many, at what price (with VAT), in which shop, the reservation it comes from and which member of our staff handed it over to you and when. The shop gives you the invoice.

If, when you pay at the shop's till, they select your account, the purchase is recorded in your name, so that you can look it up from your account. If they do not select it, the purchase does not carry your name.

What for: to sell you what you reserved, keep the accounts and handle the guarantee.
Why we are allowed to: to perform the purchase contract (art. 6.1.b GDPR) and, to keep the documents, because tax and commercial law require it (art. 6.1.c GDPR).

5. Your pre-order reservations

You make a reservation yourself on the website, with your account, or our staff make it for you in the shop or by telephone.

What we keep: the product —or, if we do not yet have it in the catalogue, what you asked us for, in your own words—, the units you request, the collection shop, your position in the queue, which version of the terms of pre-order you accepted if you signed up on the website, the status of the reservation and its dates (when you signed up, when a unit was allocated to you, until when you can pay, when we contacted you, when and how you paid, when you collected it or when it was released or cancelled, and why), the order created when you pay for it or when it is handed over to you and, for each allocation, your position at that moment, whether you were allocated a unit or not and which member of our staff made the allocation. If we made the reservation for you, also which member of our staff made it and how (in the shop or by telephone), and who contacted you, who recorded the payment and who handed it over to you. If either of the first two of those entries is undone because it was made by mistake, a record is kept of who undid it, when and why.

In whose name it goes, if we make it for you in the shop or by telephone:

• If you have an account, in the name of your account. To find it, our staff search by your first name and surnames and, of the accounts that match, see only the first name, the surnames and the last three digits of the telephone number: they do not see your email address, your address or your date of birth. They have to type at least two words, and if more than five accounts match they see none. They only see your full telephone number when you need to be called: once your reservation has its unit, the staff of the shop that holds it or where you collect it can see it in order to contact you, until they record that they have done so.
• If you do not have an account, we keep your first name, surnames, telephone number and email address with the reservation. No account is created with them.

What for: to manage the queue, allocate the units, call you when yours arrives and take payment for it in the shop. Keeping a record of who made the allocation and who received a unit also allows us to respond if someone believes the allocation was unfair; and which version of the terms you accepted, to be able to show what we told you before you signed up.
Why we are allowed to: you request it when you sign up (art. 6.1.b GDPR).

6. Notifications

Today we do not send you notifications by email. When your unit arrives, or if we need to tell you something about your reservation, the shop calls you on the telephone number in your account or the one you gave us when signing up. When we start sending notifications by email, this policy will be updated beforehand and we will tell you.

Advertising: we do not send commercial communications. If we ever do, we will ask for your separate permission, with an unticked box, and you will be able to unsubscribe in every message.

7. Website security

What is processed:

• Your IP address, which our network provider, Cloudflare, sees on every visit, and which we use to limit the attempts to sign in and to create accounts: it is stored as the key of a counter that expires automatically after one minute or one hour;
• our server's access log, which for each request records the time, the method, the page path without its parameters, the result, the size, the browser and the connection address;
• server errors: the type, the file and line of code, the path and a message from which email addresses, telephone numbers, DNI and NIE numbers, IBANs and card numbers are masked, as in what the server writes to its log. The data you sent and your headers are not kept.

What for: so that the website works, to stop attacks and abuse, and to fix faults.
Why we are allowed to: legitimate interest in network and service security (art. 6.1.f GDPR and recital 49).

8. If you write to us

If you write to us by email or call us, we process what you tell us and your contact details in order to reply. Email for xpoly.es is stored by our email provider, Hostalia (see below), and we delete it when it is no longer needed to deal with your query. Legal basis: your request and, if it concerns a reservation or a purchase, the contract (art. 6.1.b GDPR).

What we do not do

• We do not sell or pass on your data to anyone for advertising.
• We do not profile you for advertising or personalise prices through automated decisions.
• On the website you cannot yet buy, pay or have anything shipped. When you can, this policy will be updated beforehand, saying who takes the payments and who delivers the parcels.
• We do not keep your browsing history or what you search for.
• We do not ask your age when you create an account (see the clause on minors in the terms of use).
• There is not yet a members' club with points, tournament registration, ticket sales or WhatsApp notifications. When they arrive, this policy will be updated beforehand and we will tell you.

Who else sees your data

Only the providers we need in order to give you the service, under a data processing agreement, and the Spanish Tax Agency (Agencia Tributaria) with the invoices for what you buy in the shop, because the law requires it.

Google is not in the table because it does not work for us and we do not pass your data to it: if you choose to sign in with Google, you sign in to your Google account on its website, and Google confirms to us who you are with the data in section 1. What Google does with your account is explained in its own privacy policy.

Transfers outside the European Union

• Cloudflare, Inc. is in the United States. Transfers are covered by the EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023), under which Cloudflare is certified, and by the Commission's standard contractual clauses, under its data processing addendum (version 6.4, of 3 April 2026), which forms part of the terms under which we have contracted the service: https://www.cloudflare.com/cloudflare-customer-dpa/.

How long we keep your data

Backups hold the same as the database for 24 months at most, encrypted. They are only used to restore the service if something breaks, and if a backup ever has to be restored, anything deleted afterwards does not come back: each deletion is recorded —what was deleted and when, never the data itself— and is applied again to the restored data.

Blocking means that the data is set aside and no longer used for anything, except to make it available to judges, prosecutors or public authorities if they request it during the legal period; after that it is deleted.

Your rights

You can ask us, whenever you like and free of charge, to:

• give you access to your data and tell you what we do with it;
• correct it (you can correct almost everything yourself in ‘Your account’);
• erase it;
• let you object to our using it, or ask us to restrict its use;
• let you take it with you in a machine-readable format (portability).

You exercise three of them yourself, in ‘Your account’, without writing to anyone:

• access and portability: ‘Download my data’ gives you a file (JSON, which can be opened with any text editor) with your account, your profile, your verification and its history. For each step of the history it says whether it was taken by you, by a member of our staff or by the system; not which member of staff, because that is their personal data;
• erasure: ‘Delete my account’, with your password (if you only sign in with Google, you first set one in ‘Your account’). Everything listed under how long we keep your data is deleted immediately, and you will no longer be able to sign in. This cannot be undone.

For anything else —correcting what you cannot correct yourself, objecting or asking us to restrict use—, or if you prefer us to do it, write to us at [email protected] from your account's email address or come to a shop; if we cannot tell that it is you, we will ask you to prove your identity. We reply within one month at most.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), at https://www.aepd.es or through its online office, https://sedeagpd.gob.es.

Minors

Children under 14 may not have their own account: it is created and used by their father, mother or guardian. Between the ages of 14 and 17 you can buy and reserve with your parents' knowledge and authorisation. The full rules are in the terms of use.

How we protect your data

Passwords are stored encrypted in a way that they cannot be read; the session is kept in cookies that the page's code cannot read; sign-in attempts are limited; the server has no port open to the internet and can only be reached through Cloudflare; the keys for external services are stored encrypted; and the logs do not store your data. Every night an encrypted backup is made and stored in the European Union, and every month we test restoring it to make sure it works.

Changes

If we change this policy, we will say so on the website with the date, and if the change affects what we do with your data, we will tell you beforehand. Each account stores which version it accepted.

Version: 2026-10-30.