Privacy Policy
The short version: we ask for the least we can, we ask nothing about your child, this site sets no cookies and runs no trackers, and we never sell your data. The long version follows.
1. Who is responsible for your data
The data controller is the seller identified below. Write to us about anything on this page and a founder, not a helpdesk, will answer.
- Seller
- Juan Gabriel Monroig (sole trader / autónomo)
- Tax ID
- Z0726855Z
- Address
- Calle Campillos 301A, Pinos de Alhaurín, 29130 Málaga, Spain
- hello@getbloomstones.com
- Website
- https://getbloomstones.com
2. What we collect
When you buy a box
- Your name and the delivery address
- Your email address, and a phone number if the carrier requires one
- What you ordered, when, and the amount paid
- Payment confirmation from Stripe. Card details go straight to Stripe — we never see or store your full card number
- Your tax details, only if you ask us for an invoice in a company name
When you email us
- Your email address and whatever you choose to write to us
What we do not collect
We do not ask for your child's name, date of birth, school, or anything about their health, support needs or assessments. Nothing on this site or in the buying process requires it. If you volunteer something about your child in an email — many parents do — we keep it only as long as we need it to answer you, we never use it for marketing, and you can ask us to erase it at any time.
3. This site sets no cookies
getbloomstones.com is a set of static pages. There is no analytics script, no advertising pixel, no session cookie and no third-party tracker on it. That is why you have not been shown a cookie banner: there is nothing to consent to. If we ever add analytics, we will update this page and ask for consent before anything runs.
Our hosting provider does keep short-lived server logs, including IP addresses, for security and to keep the site up.
4. Why we use your data, and on what legal basis
- To take and deliver your order
- Performance of our contract with you (GDPR art. 6.1.b)
- To issue invoices and keep accounting and tax records
- Compliance with a legal obligation (art. 6.1.c)
- To answer your emails and handle complaints and refunds
- Our legitimate interest in running the business and supporting buyers (art. 6.1.f)
- To keep the site and payments secure and prevent fraud
- Legitimate interest (art. 6.1.f)
- To send you an email newsletter
- Your consent (art. 6.1.a), which you can withdraw at any time using the unsubscribe link. We do not add buyers to a list automatically
5. Who else sees it
We do not sell or rent personal data, ever. We share the minimum with the providers that make the business run, each of them bound by a data processing agreement:
- Stripe
- Payment processing. Stripe is a controller in its own right for payment data
- Google (Firebase Hosting)
- Serving this website
- Cloudflare
- Domain name service and routing email sent to our address
- Google (Gmail)
- Our email mailbox
- Our shipping carrier
- Name, address and phone number, only so the box reaches you
We will also disclose data where a law, a court or a public authority requires it.
6. Data leaving the EU
Some of those providers are based in the United States or process data there. Where that happens, transfers are covered by the European Commission's standard contractual clauses, by the EU–US Data Privacy Framework, or both.
7. How long we keep it
- Orders, invoices and accounting records
- Up to six years, because Spanish commercial and tax law requires it
- Email correspondence
- Up to two years after the conversation ends, then deleted
- Newsletter subscription
- Until you unsubscribe
8. Your rights
You can ask us at any time to:
- give you a copy of the data we hold about you
- correct anything that is wrong
- erase it, where we are not required to keep it
- restrict or object to how we use it
- send it to you, or to another provider, in a portable format
- withdraw a consent you gave, without affecting what came before
Email hello@getbloomstones.com and we will respond within one month. It is free, and we will not make you explain why.
If you are not satisfied with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos — www.aepd.es — or to the supervisory authority where you live.
9. Keeping it safe
Access to order data is limited to the two founders, over accounts protected by two-factor authentication. The site is served over HTTPS. We keep no card data at all. If a breach ever affects your rights, we will tell you and the authority within the deadlines the GDPR sets.
10. Changes
If this policy changes in a way that matters, we will email buyers rather than quietly editing the page. The date at the top always shows the current version.
Questions about this page? Email hello@getbloomstones.com — a founder answers.