PRIVACY POLICY

Trade name: HEAVY ARTIFACTS

Website: www.heavyartifacts.com

DATA CONTROLLER

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), we inform you that the personal data you provide will be processed by:

Controller: D. Germán Álvarez Sánchez Trade name: HEAVY ARTIFACTS NIF: 53500382J Address: C/ Virgen del Coro, 18. 28027 Madrid Email: contact@heavyartifacts.com

PURPOSES OF PROCESSING

The personal data you provide will be processed for the following purposes, depending on the context in which they are collected:

Order and customer management: processing purchases made through the online store, managing product shipments, issuing invoices and handling any order-related incidents. Commercial communications: if you have given your consent, we will send you communications about new products, collections, launches and news from HEAVY ARTIFACTS. You may withdraw this consent at any time. Customer service: managing enquiries, complaints or requests submitted through the contact form, email or other available channels. User account management: if you register in our store, managing your account, order history and preferences. Legal obligations: complying with the accounting, tax and legal obligations applicable to us.

LEGAL BASIS FOR PROCESSING

The processing of your data is based on the following legal grounds:

Performance of a contract: processing is necessary for the management of your order, shipment of purchased products and the contractual relationship arising from your purchase. Consent: for the sending of commercial communications and the use of non-essential cookies, where you have expressly provided it. Legal obligation: for compliance with our accounting, tax and other legal requirements. Legitimate interest: for the management of enquiries and complaints, and for fraud prevention.

DATA COLLECTED

Depending on your interaction with our website, we may collect the following personal data:

Identification data: name and surname. Contact data: email address, phone number. Shipping and billing data: postal address, city, province, postcode and country. Transaction data: information about products purchased, amount and payment method. We do not store full credit card details; payment is handled by secure, certified payment gateways. Browsing data: technical information about your device and behaviour on the website, collected via cookies (see our Cookie Policy).

DATA RETENTION

Your personal data will be retained for as long as necessary to fulfil the purpose for which it was collected and while a contractual relationship with you exists. Once that relationship has ended, data will be blocked and retained only for the periods required by law:

Billing and accounting data: 6 years, in accordance with the Commercial Code and applicable tax regulations. Customer and order data: 5 years, in accordance with applicable civil regulations. Commercial communications: until you withdraw your consent.

After these periods, data will be securely deleted.

DATA RECIPIENTS

Your data may be shared with third parties only when necessary for the provision of the service or by legal obligation:

Transport and logistics companies: for the management of order shipments (name, delivery address and contact phone number). Payment gateways: for the secure processing of payments (payment data is processed directly by the payment provider; HEAVY ARTIFACTS does not have access to full card details). Technology platforms: hosting providers, e-commerce platform and management tools, acting as data processors and contractually bound to process data in accordance with the GDPR. Public authorities: where there is a legal obligation to communicate data (Tax Agency, law enforcement, etc.).

HEAVY ARTIFACTS does not sell, rent or transfer your personal data to third parties for commercial purposes.

INTERNATIONAL TRANSFERS

Some of our technology providers may be located outside the European Economic Area (EEA). In such cases, we ensure that these transfers are carried out with appropriate safeguards in accordance with the GDPR, such as standard contractual clauses approved by the European Commission or other legally recognised transfer mechanisms.

USER RIGHTS

Under current data protection regulations, you have the right to:

Access: find out what personal data of yours we are processing. Rectification: request the correction of inaccurate or incomplete data. Erasure: request the deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected. Objection: object to the processing of your data in certain circumstances. Restriction of processing: request that the processing of your data be restricted in certain cases. Portability: receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller. Withdrawal of consent: revoke at any time the consent given, without affecting the lawfulness of processing prior to its withdrawal.

To exercise any of these rights, you may contact us in writing at the postal address or email indicated in the DATA CONTROLLER section, enclosing a copy of your ID or other identifying document. We will respond to your request within a maximum of one month.

If you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

DATA SECURITY

HEAVY ARTIFACTS has adopted the necessary technical and organisational measures to guarantee the security and integrity of personal data and to prevent its loss, alteration and/or access by unauthorised third parties, in accordance with the GDPR. However, please note that security measures on the Internet are not impenetrable.

COOKIES

This website uses its own and third-party cookies. You can find more information about the cookies we use, their purpose and how to manage them in our Cookie Policy.

MINORS

This website is not directed at persons under 18 years of age and HEAVY ARTIFACTS does not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data without the consent of their guardians, please inform us so that we can proceed with its deletion.

UPDATES TO THIS PRIVACY POLICY

HEAVY ARTIFACTS reserves the right to modify this Privacy Policy to adapt it to legislative, jurisprudential or business practice developments. In the event of substantial changes, we will notify you prominently on the website or through available contact channels. The date of the last update appears at the bottom of this document.

Last updated: March 2026.