Privacy Policy
This policy explains what personal data ATLAS Trade Group collects, why we collect it, how we use it and what rights you have. We process your data in compliance with the EU General Data Protection Regulation (GDPR) and Spanish data protection law.
We are a data controller established in Spain (EU). Your data is processed under GDPR 2016/679, Spanish LOPDGDD 3/2018, and the EU ePrivacy Directive. We do not sell personal data to third parties.
Who is responsible for your data
The data controller — the entity that determines how and why your personal data is processed — is:
Data Controller
ATLAS Trade Group
Málaga, Andalucía, Spain — European Union
Email: info@atlas-trade-group.com
Phone: +34 623 629 963
Website: atlas-trade-group.com
For all privacy-related requests — access, correction, deletion or complaints — contact us at the email above. We respond to all data rights requests within 30 days as required by GDPR Article 12.
The personal data we process
We collect only the data that is necessary for the purpose described. The categories of personal data we may process are:
| Category | Data types | Who it applies to |
|---|---|---|
| Identity data | First name, last name, company name (B2B) | All customers |
| Contact data | Email address, phone number, delivery address, billing address | All customers |
| Transaction data | Order history, items purchased, order values, returns and refunds | All customers |
| Payment data | Payment confirmation and last 4 digits of card (Stripe). We never see or store full card numbers. | All customers |
| Account data | Username, hashed password, account preferences, wishlist | Registered users |
| Technical data | IP address, browser type, device type, pages visited, time on site (via cookies) | All site visitors |
| Communication data | Emails, enquiries, support tickets, return requests you send us | All who contact us |
| B2B data | Company registration details, VAT number, trade references | Wholesale accounts |
What we do not collect
- Full payment card numbers (processed exclusively by Stripe)
- Special category data (health, ethnicity, religion, biometrics) — we have no reason to collect this
- Data about children under 16 — our services are not directed at minors
- Location data beyond the delivery address you provide
Why we process your data and on what legal basis
Under GDPR, every processing activity must have a valid legal basis. We process your data under the following:
| Purpose | Legal basis (GDPR Art. 6) | Detail |
|---|---|---|
| Processing your order | Contract performance (6.1.b) | Necessary to fulfil the purchase contract |
| Payment processing | Contract performance (6.1.b) | Required to complete the transaction via Stripe |
| Delivery & logistics | Contract performance (6.1.b) | Passing address to courier to deliver your order |
| Customer support & returns | Contract performance (6.1.b) | Handling enquiries, returns and after-sales |
| Legal & tax compliance | Legal obligation (6.1.c) | Spanish tax law requires invoice retention for 5+ years |
| Fraud prevention | Legitimate interest (6.1.f) | Protecting our business and customers from fraud |
| Site analytics | Legitimate interest (6.1.f) | Understanding how the site is used to improve it |
| Marketing emails | Consent (6.1.a) | Only if you have opted in. Withdrawable at any time. |
| B2B account management | Contract performance (6.1.b) | Managing trade accounts, credit terms, ordering history |
Third parties who may receive your data
We do not sell, rent or trade your personal data. We share it only with the service providers listed below, who are contractually bound to process it only on our instructions and in compliance with GDPR:
| Third party | Purpose | Location |
|---|---|---|
| Stripe Inc. | Payment processing. Stripe is PCI DSS Level 1 certified. | USA (EU SCC in place) |
| Delivery / courier partners | Shipping your order. Only name and delivery address are shared. | EU / Spain |
| Email service provider | Sending order confirmations and support emails. | EU or SCC-covered |
| Analytics provider | Anonymised site usage statistics (no personally identifiable data). | EU or SCC-covered |
International data transfers (USA)
Stripe and Netlify are US-based. Transfers to the USA are covered by Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46.2(c), providing adequate safeguards. You can request details of these safeguards by contacting us.
We may also disclose data where required by law, court order, or to protect the rights, property or safety of ATLAS Trade Group, our customers or others.
Data retention periods
We retain personal data only for as long as necessary for its purpose or as required by law. Our retention schedule:
| Data type | Retention period | Reason |
|---|---|---|
| Order & invoice records | 5 years from transaction date | Spanish tax law (Ley del IVA, Ley del IS) |
| Account data (active) | Duration of account + 2 years | Contract relationship |
| Account data (inactive) | Deleted after 24 months of inactivity | Data minimisation (GDPR Art. 5.1.e) |
| Support communications | 3 years from last contact | Dispute resolution, legal claims |
| Marketing consent records | Until consent withdrawn + 3 years | Proof of consent |
| Technical / analytics data | 26 months (anonymised after 6 months) | Site performance analysis |
| Fraud prevention records | 5 years | Legitimate interest, legal claims |
When data is no longer needed, it is securely deleted or anonymised so it can no longer identify you.
Your rights under GDPR
As an EU resident, you have the following rights regarding your personal data. All requests are free of charge and responded to within 30 days (extendable to 90 days for complex cases, with notice):
🔑 Right of access (Art. 15)
Obtain a copy of all personal data we hold about you, including how it is used and with whom it is shared.
✎ Right to rectification (Art. 16)
Have inaccurate or incomplete personal data corrected without undue delay.
🗑 Right to erasure (Art. 17)
Request deletion of your data where it is no longer necessary, consent has been withdrawn, or processing is unlawful. Subject to legal retention requirements.
🚫 Right to restrict processing (Art. 18)
Limit how we use your data while a dispute or verification is pending, without full deletion.
📤 Right to data portability (Art. 20)
Receive your data in a structured, machine-readable format (e.g. CSV/JSON) to transfer to another provider.
🚫 Right to object (Art. 21)
Object to processing based on legitimate interest, including direct marketing (always honoured immediately).
✖ Withdraw consent (Art. 7.3)
Withdraw marketing consent at any time via the unsubscribe link in any email or by contacting us directly.
😱 Right to complain (Art. 77)
Lodge a complaint with the Spanish data authority (AEPD) at aepd.es if you believe your rights have been violated.
To exercise any right, email info@atlas-trade-group.com with “Data Rights Request” in the subject line. We may ask you to verify your identity before processing the request.
How we use cookies
Cookies are small text files stored on your device when you visit our site. We use cookies in compliance with the EU ePrivacy Directive and GDPR. We distinguish between:
| Cookie type | Purpose | Consent required? | Retention |
|---|---|---|---|
| Strictly necessary | Session management, shopping cart, login, security (CSRF). Site cannot function without these. | No — exempt | Session / 24h |
| Functional | Remembering language preference (EN/ES), currency, recently viewed products. | Yes | Up to 12 months |
| Analytics | Anonymous page view and traffic statistics to improve the site. No personally identifiable data. | Yes | Up to 26 months |
| Marketing / retargeting | Currently not used. If introduced, will require explicit opt-in consent. | Yes (if used) | N/A |
Managing your cookie preferences
You can withdraw cookie consent at any time by clearing your browser cookies or adjusting your browser settings. Note that disabling strictly necessary cookies will affect site functionality. For analytics cookies, you can opt out via your browser’s privacy settings.
How we protect your data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, including:
- SSL/TLS encryption for all data in transit between your browser and our servers
- Stripe for payment processing — we never handle raw card data
- Access controls — personal data is accessible only to staff who need it to perform their role
- Regular security reviews of our hosting infrastructure
- No storage of passwords in plain text — all passwords are hashed using modern algorithms
Data breach notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Spanish data authority (AEPD) within 72 hours as required by GDPR Article 33. If the breach is likely to result in high risk to you personally, we will also notify you directly without undue delay.
Our site is not for children
atlas-trade-group.com is intended for adults (18+) and B2B buyers. We do not knowingly collect or process personal data from anyone under the age of 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@atlas-trade-group.com and we will delete it promptly.
Emails, newsletters and promotions
We will only send you marketing emails if you have given us explicit consent to do so — for example, by ticking an opt-in box during registration or checkout. We never add you to marketing lists automatically.
Every marketing email we send includes an unsubscribe link. You can also withdraw consent at any time by emailing info@atlas-trade-group.com. Withdrawal of marketing consent does not affect order confirmations and transactional emails, which we must send as part of your contract.
How we update this privacy policy
We may update this policy periodically to reflect changes in law, technology or our practices. The “Effective” date at the top will always show the current version date.
For material changes that significantly affect how we use your data, we will notify you by email at least 14 days in advance. For minor updates, we will update the date on this page. We encourage you to review this policy periodically.