Gramps Mask

Privacy policy

Last updated: 29 September 2026

This Privacy Policy explains how Gramps Mask ("we", "us") collects and uses your personal data when you visit or buy from our store, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Max Ernst Huisman Gutiérrez (NIF 21765728T), trading as Gramps Mask, Carrer de Ganduxer 118, 2º 1ª, 08022 Barcelona, Spain. Email: hello@grampsmask.store.

2. Data we collect

Contact and order data: name, email, phone, billing and shipping address, products purchased.
Payment data: processed securely by our payment providers. We do not store full card numbers.
Communications: messages, photos and documents you send us (for example for a return or claim).
Device and usage data: IP address, browser, device identifiers, pages visited, collected through cookies and similar technologies (see section 8).

3. Why we use your data and legal basis

To process and deliver your order and handle returns and claims – performance of a contract (Art. 6.1.b GDPR).
To comply with tax, accounting and consumer law – legal obligation (Art. 6.1.c GDPR).
To answer your questions and provide customer service – performance of a contract or our legitimate interest.
To prevent fraud, verify orders and defend payment disputes (chargebacks) – our legitimate interest (Art. 6.1.f GDPR). This includes automated risk scoring by Shopify and our payment providers; if an order is refused because of a fraud alert, you can contact us to request a manual review.
To send marketing emails – only with your consent (Art. 6.1.a GDPR). You can unsubscribe at any time.
Analytics and advertising cookies – only with your consent.

4. Who we share your data with

We only share your data with service providers that help us run the store: Shopify (e-commerce platform and fraud analysis), payment processors (Shopify Payments, PayPal, Apple Pay, Google Pay, Shop Pay), our product supplier and shipping carriers (name, address and phone, to deliver your order), email tools and, if you consent, advertising partners such as Meta and TikTok. In the event of a payment dispute we may provide order, delivery and device data as evidence to the payment providers, card networks and banks involved, and to the authorities where required by law. We never sell your personal data.

5. International transfers

Some providers (for example Shopify, our supplier and carriers) process data outside the European Economic Area, including in the United States and Asia. Transfers are protected by adequacy decisions, the European Commission's Standard Contractual Clauses or, for delivery data, the necessity to perform your contract.

6. How long we keep your data

Order data is kept for as long as required by tax and commercial law (generally 6 years). Data related to claims, disputes, chargebacks and fraud prevention is kept for as long as needed to resolve and document the matter (up to 5 years). Marketing data is kept until you withdraw your consent. Other data is kept only as long as necessary for the purpose it was collected for.

7. Your rights

You can request access, rectification, erasure, restriction, objection and data portability, and withdraw your consent at any time, by emailing hello@grampsmask.store. You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es). If you are in the United States or Canada, you may also have rights under your local privacy laws, which you can exercise by contacting us at the same email.

8. Cookies

We use strictly necessary cookies to make the store work (for example, to keep items in your cart, process checkout and prevent fraud). With your consent, we also use analytics cookies to understand how the store is used and marketing cookies to show you relevant ads. When you first visit, a cookie banner lets you accept, reject or customise non-essential cookies. You can change your choice at any time via the Cookie preferences link in the footer, or by deleting cookies in your browser settings.