Last updated: 2026-05-27
IMAGO DEI SL respects your privacy and processes your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
1. Data Controller
Controller: IMAGO DEI SL
Tax ID (CIF): B70729330
Registered office: Calle San Felipe Neri, 4 — 28014 Madrid, Spain
Email: [email protected]
Telephone: +34 660 746 423
If, in the future, a Data Protection Officer (DPO) is designated, their contact details will be published here.
2. Categories of data we collect
Depending on your interaction with the website, we may collect:
- Identification and contact data: name, surname, postal address, email address, telephone number.
- Billing and transactional data: billing address, order history, payment confirmation (we do not store full card numbers; these are processed directly by our payment provider, Stripe).
- Account data: username and password (where you create an account), wishlist, addresses saved.
- Browsing data: IP address, browser type and version, pages visited, time spent on pages, referring URL, device identifiers. Collected through cookies and similar technologies; see our Cookie Policy.
- Communications data: content of your messages to us through contact forms, email, telephone, WhatsApp or chat.
- Marketing data: subscription status to our newsletter and interaction with our communications, where you have given your consent.
We do not knowingly collect personal data from minors under 14 years of age. Some content on the website may be unsuitable for minors and is intended for an adult audience.
3. Purposes and legal bases for processing
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Managing and executing your order (registration, payment, shipping, after-sales) | Performance of a contract (Art. 6.1.b) |
| Managing your customer account | Performance of a contract (Art. 6.1.b) |
| Responding to inquiries received through contact forms, email, phone or chat | Performance of pre-contractual measures or our legitimate interest (Art. 6.1.b / 6.1.f) |
| Issuing invoices and complying with tax, accounting and commercial obligations | Compliance with a legal obligation (Art. 6.1.c) |
| Sending the newsletter and commercial communications about new acquisitions, exhibitions and curated releases | Consent (Art. 6.1.a) |
| Improving the website, statistical analysis, prevention of fraud and security | Legitimate interest (Art. 6.1.f) |
| Cookies that are not strictly necessary | Consent (Art. 6.1.a) |
You may withdraw your consent at any time without this affecting the lawfulness of processing carried out beforehand.
4. Recipients of the data
We do not sell or rent your personal data. We may share data with the following categories of recipients, only to the extent necessary:
- Payment service providers: Stripe Payments Europe Ltd., Apple, Google.
- Shipping and logistics providers: courier and specialised art transport companies, both in Spain and abroad.
- Cloud hosting and IT providers for the website, email and CRM.
- Email marketing platform for the newsletter (only if you have subscribed).
- Professional advisors: accountants, lawyers and auditors bound by confidentiality duties.
- Public administrations, courts and competent authorities when required by law (for example, the Spanish Tax Agency for VAT obligations, customs authorities for international shipments, or the Ministry of Culture in case of cultural-property export procedures).
All providers acting as data processors have signed (or will sign before processing begins) a data processing agreement that meets the requirements of Article 28 GDPR.
5. International data transfers
Some of our providers may be located outside the European Economic Area (EEA). When this happens, we ensure that adequate safeguards are in place, such as:
- Transfers to countries declared by the European Commission as offering an adequate level of protection.
- Standard Contractual Clauses approved by the European Commission.
- Other appropriate safeguards under Articles 46 and 49 GDPR.
You may request a copy of the safeguards in place by writing to [email protected].
6. Retention periods
We retain your personal data only for the time strictly necessary for the purposes described above:
- Order and billing data: for the duration of the commercial relationship and, after that, for the legally required retention periods (in general, six (6) years for accounting and tax purposes under Spanish law, ten (10) years for anti-money-laundering obligations where applicable).
- Customer account data: until you delete your account or request its deletion.
- Inquiries through contact forms or email: for the period necessary to manage the inquiry and, after that, up to three (3) years.
- Newsletter subscription data: until you unsubscribe.
- Browsing data and cookies: as specified in the Cookie Policy.
Once retention periods expire, your data will be deleted or anonymised.
7. Your rights
As a data subject, you have the right to:
- Access your personal data and obtain a copy.
- Rectify inaccurate or incomplete data.
- Erasure of your data when no longer necessary for the purposes for which they were collected.
- Restrict processing in certain situations.
- Data portability in a structured, commonly used and machine-readable format.
- Object to processing based on our legitimate interest.
- Withdraw consent at any time, without this affecting the lawfulness of previous processing.
- Not to be subject to decisions based solely on automated processing producing legal effects on you (we do not currently carry out such processing).
You may exercise these rights free of charge by writing to [email protected] or by post to Calle San Felipe Neri, 4 — 28014 Madrid, Spain. We may ask you to prove your identity to protect your data.
If you consider that your rights have been infringed, you also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan, 6, 28001 Madrid, or through www.aepd.es.
8. Security
IMAGO DEI SL applies appropriate technical and organisational measures to ensure the security of personal data, including pseudonymisation where applicable, access control, encrypted connections (HTTPS) and regular reviews of its providers.
However, no transmission of data over the Internet is completely secure, and we cannot guarantee absolute security against unauthorised access.
9. Changes to this Privacy Policy
This Privacy Policy may be updated to reflect changes in our processing activities or in applicable law. Any material change will be communicated through the website and, where appropriate, by email. The “Last updated” date at the top of this document reflects the latest version.
10. Contact
IMAGO DEI SL
Calle San Felipe Neri, 4 — 28014 Madrid, Spain
Email: [email protected]
Phone: +34 660 746 423
No products in the cart.