Privacy policy
Draft pending legal review.
Last updated: [DATE]
At Kairana, we process your personal data in accordance with Organic Law 3/2018 (LOPDGDD) and Regulation (EU) 2016/679 (GDPR). This policy explains what data we process, why, and with which providers.
1. Data controller
- Controller: [NOMBRE Y APELLIDOS] (full name; trades as Kairana)
- Tax ID (NIF): [NIF]
- Address: [DOMICILIO]
- Email: [EMAIL DE CONTACTO]
- Phone: [TELÉFONO]
2. Data we process, purpose, and legal basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Purchase in the store | Name, shipping and billing address, email, phone, order data. The payment provider processes the payment. We do not see or store your full card number. | Manage the order, payment, shipping, invoice, and after-sales support. | Performance of a contract (Art. 6.1.b GDPR) and legal tax and accounting obligation (Art. 6.1.c). |
| Customer account and portal | Email, language, purchases that give access, unlocked meditations. | Create your account, sign you in (a code Shopify sends by email), and give access to the meditations. | Performance of a contract (Art. 6.1.b). |
| Audio playback | Technical session data (account, requested meditation, IP address in server logs). | Serve the audio only to accounts with access rights, with short-lived signed links, and prevent misuse. | Legitimate interest in protecting the content (Art. 6.1.f). |
| Service emails | Email and order or account data. | Order confirmation, shipping, box activation, access recovery. | Performance of a contract (Art. 6.1.b). |
| Waitlist / presale | Email, name (if you give it), Instagram or website (ambassadors only, if you give it), language, date and version of the consent text accepted. We do not store your IP address. | Tell you about the launch and the presale, and send your discount code. | Consent (Art. 6.1.a). |
| Ambassadors and affiliates | Name, email, contact data, assigned code, sales linked to the code, and commissions. | Assess your interest, run the program, and calculate commissions. | Consent and pre-contractual measures (Art. 6.1.a and 6.1.b); then performance of a contract. |
| Marketing messages | Email, name. | Send you news and offers. | Consent (Art. 6.1.a). You can unsubscribe at any time. |
| Contact | The data you write in your message. | Answer your request. | Consent and pre-contractual measures (Art. 6.1.a and 6.1.b). |
| Cookies | See the Cookie Policy. | Today the site uses no cookies; it only stores your cookie choice in your browser. If analytics or the store are added, they will be used only with your consent. | Necessary: exempt. All others: consent (Art. 6.1.a). |
Ambassador discount codes show how many orders use each code. The ambassador does not learn the identity of the person who uses a code. [VERIFICAR: confirm with Ana what report each ambassador gets.]
3. Minors
The content and services are for adults. If a service for minors is offered in the future, we will ask for the consent of the parents or guardians.
4. Retention periods
- Order and invoice data: the time that tax and commercial law require [VERIFICAR: usually 6 years; confirm with the accountant].
- Account and access rights to the meditations: while the account is active. If you ask to close it, we delete the data, except data that the law requires us to keep.
- Waitlist and marketing messages: until you withdraw consent or unsubscribe. [VERIFICAR: set a maximum inactivity period.]
- Ambassadors: while the relationship lasts, and for the legal periods for commissions and invoicing.
- Requests: the time needed to answer them.
After that, we delete the data or block it for the limitation periods of possible liabilities.
5. Recipients and processors
We do not give data to third parties, unless the law requires it (for example, to the tax authority). To give the service, we use these providers. They process data for us under contract:
- Shopify (Shopify International Ltd., Ireland, and Shopify Inc., Canada): online store, cart, orders, store customer accounts, portal sign-in (code by email), order and marketing emails.
- Shopify Payments / Stripe (Stripe Payments Europe Ltd., Ireland): card payment processing and fraud prevention. [VERIFICAR: whether direct Stripe is also used for the presale, or bank transfer.]
- Cloudflare, Inc.: hosting of the website and the portal, the database for the presale and ambassador list (Cloudflare D1), content delivery network, and audio storage (Cloudflare R2), with signed links.
- Business email provider: [ZOHO / GOOGLE WORKSPACE] for the contact and info mailbox.
- Carriers: [CORREOS / SEUR / DHL / OTHER] to deliver the order. They receive the delivery name, address, and phone.
- Accountant: [ACCOUNTANT NAME] for bookkeeping and taxes.
- Affiliate app (if used): [APP NAME].
6. International transfers
Some providers (for example, Shopify, Cloudflare, Stripe) can process data outside the European Economic Area, in particular in the United States and Canada. These transfers rely on a European Commission adequacy decision (such as the EU-US Data Privacy Framework, for certified companies) or on standard contractual clauses. [VERIFICAR: confirm the mechanism for each provider.]
7. Security and secrecy
[NOMBRE Y APELLIDOS] keeps your data secret and applies technical and organizational measures against alteration, loss, and unauthorized access. The audio is served only with short-lived signed links. Access to the admin area is protected.
8. Your rights
You can exercise these rights, which are personal and non-transferable, after proof of identity:
- Access to your data.
- Rectification of inaccurate data.
- Erasure (“right to be forgotten”).
- Restriction of or objection to processing.
- Portability of your data.
- Withdrawal of consent at any time, without effect on earlier processing.
- Complaint to the supervisory authority.
9. How to exercise your rights and complain
Write to: [NOMBRE Y APELLIDOS], [DOMICILIO]. Email: [EMAIL DE CONTACTO]. Attach proof of your identity.
If you think your data is not processed in accordance with the law, or you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es · dpd@agpd.es.