Privacy and Security policy

1. Identification of the responsible

In compliance with the General Regulation of Data Protection, Regulation (EU) 2016/679 and Organic Law 3/2018, on Personal Data Protection and guarantee of digital rights, the user is hereby informed that the personal data provided through the web site www.singularspirits.es will be processed by:

The user can contact the person responsible for any issue related to the processing of your personal data through the email indicated above.

2. The purpose of this policy

This Privacy and Security Policy has the purpose to inform in a clear and transparent about how we collect, use, retain, and protect the personal data of the users, customers or visitors to the web site.

This policy applies to data collected through the web site, contact forms, registration forms, process of purchase, subscription to marketing communications, interaction with customer services, and any other channel, enabled by the controller.

3. Personal data that we may try

Depending on the use that you make of the web site, may be processed the following categories of data:

• Identifying data: first name, last name, company name, tax identification number (NIF/CIF), registered user.
• Contact details: postal address, email address, phone.
• Billing information: tax domicile, tax information, information required to issue invoices.
• Shipping information: delivery address, consignee, contact phone number for the transport.
• Purchase data: products purchased, your order history, issues, returns, communications relating to orders.
• Technical data: IP address, identifiers, online, browser, device, operating system, cookie information, and similar technologies.
• Navigation data: pages visited, interactions with the web site, user preferences, language or settings.
• Data communication: queries, messages sent by forms, emails, or channels of customer care.
• Trade data: consent to receive communications, preferences, history of acceptance or rejection of commercial communications.
• Data verification of age: confirmation of the age of majority recorded by the system access control enabled on the web site.

Do not request sensitive data unless it is strictly necessary and there is sufficient legal basis to do so.

4. Purposes of the treatment

The personal data shall be processed for the following purposes:

4.1. Management of orders and purchases

Treat the data necessary for processing of orders through the online store, manage payments, prepare shipments, issue, purchase confirmations, resolve issues, manage returns, exchanges, warranties, and pay attention to after-sales.

4.2. Management of registered users

Create and manage user accounts, allow access to the private area, see orders, save addresses, to facilitate future purchases, and maintain the security of the account.

4.3. Billing and legal obligations

Issue invoices, keep records, attend to the requirements of administrative, tax, or legal and fulfill obligations arising from the applicable laws and regulations.

4.4. Customer care

Respond to inquiries, requests, complaints, technical issues, requests for information, communications relating to orders, and any other request sent by the user.

4.5. Commercial communications

To send commercial communications, newsletters, promotions, news, offers or information related to products and services, provided that there is the user's consent or a legal basis for valid permits.

4.6. Web site security

To prevent fraud, unauthorized accesses, uses abusive, hacker attacks, spam, illegal activities or any action that might compromise the security of the web site, for the users or the manager.

4.7. Analysis and improvement of the website

Analyze the use of the website, improve the user experience, optimize content, to detect technical errors, measure performance and improve the services offered.

4.8. Management of cookies

Manage the user's consent, with regard to the use of cookies and similar technologies, in accordance with the Policy of Cookies.

4.9. Verification of the age of majority

Verify that the user is of age prior to access to the website and the shopping, in compliance with the rules applicable to the marketing of alcoholic beverages.

5. Legal basis for the processing

The processing of personal data is carried out in accordance with the legal bases provided for in the data protection regulations. The RGPD it establishes, among other principles, that the treatment must have a proper legal basis, to be transparent, limited to the purpose and guarantee the rights of the people affected.

The legal basis applicable may be:

• Execution of a contract: to manage purchases, orders, payments, shipments, returns, warranties, and care related to purchased products.
• Fulfilment of legal obligations: for billing, accounting, tax obligations, rights, care requirements, administrative or legal nature, and for the verification of the age of majority prior to the access and purchase, in compliance with the rules applicable to the marketing of alcoholic beverages.
• User consent: for subscriptions to commercial communications, acceptance of cookies is not necessary or certain forms.
• Legitimate interest: to prevent fraud, to maintain the security of the web site, respond to inquiries initiated by the user, to improve services, or to send communications about similar products when legally appropriate.
• Defense of claims: when it is necessary to retain, or use information for the formulation, exercise or defend claims.

6. Retention of data

The personal data will be kept for the time necessary to fulfill the purpose for which they were collected and, subsequently, for the periods required by law.

General form:

• The order data and billing will be retained for the periods required by tax regulations, accounting and business.
• The data of registered users is kept as long as the account remains active, or until the user requests their deletion, unless legal obligation of conservation.
• The queries data will be kept for the time necessary to manage your request and, if applicable, to attend to the possible responsibilities.
• The data used for commercial communication will be kept until the user withdraws his consent or ask for the floor.
• The technical and security data may be retained for the time necessary to prevent abuses, to ensure the security of the website and to attend to the possible responsibilities.

When the data is no longer necessary, they will be deleted or blocked according to the applicable regulations.

7. Recipients of the data

The personal data may be communicated to third parties when necessary to provide the service, fulfill legal obligations or to execute the contractual relationship with the user.

Be able to access the data, among others:

• Providers of web hosting and technical maintenance.
• Service providers of e-mail.
• Transport companies and logistics.
• Payment gateways, banking institutions or payment service providers.
• Providers billing, accounting advice, tax or legal advice.
• Tools of analytic, marketing, or management of consents, if they are active.
• Public administrations, courts, tribunals or agencies of competent when there is a legal obligation.

These third parties will only have access to the data needed to perform their functions and shall treat it in accordance with the applicable regulations.

8. International data transfers

Some technology providers may be located outside of the European Economic area or to use infrastructure located in third countries.

When making international data transfers, it shall take the appropriate guarantees provided for by the applicable regulations, such as adequacy decisions, standard contractual clauses approved by the European Commission or other mechanisms legally valid.

Pending review: confirm if you use services such as Google Analytics, Google Ads, Goal, Mailchimp, Klaviyo, Stripe, PayPal, Sendcloud, HubSpot, Hotjar or other external providers.

9. User's rights

The user can exercise the rights recognized by the legislation on data protection:

• Right of access.
• The right of rectification.
• Right to erasure.
• Right of opposition.
• Right of limitation of treatment.
• Right to portability.
• Right to withdraw consent at any time.
• Right not to be subject to automated decisions, where appropriate.

The Organic Law 3/2018 developed in Spain aspects related to the exercise of rights and guarantees to digital in the field of protection of personal data.

The application must clearly indicate the right that you wish exercise and allow to prove the identity of the applicant when necessary.

If the user considers that the processing of your data does not conform to the regulation, may lodge a complaint with the Spanish Agency for Data Protection.

10. Data of minors

The website is not directed to minors.

Not be collected intentionally personal data of minors without the valid consent of their parents, guardians or legal representatives when it is legally enforceable.

If the manager detects that data has been collected from a child without appropriate authorization, shall adopt the necessary measures for its elimination.

Given that the products marketed are alcoholic drinks, whose sale is legally restricted to persons of legal age, the web site has a system check of the age of majority in the access. The confirmation of the age of majority by the user is a prerequisite and essential for accessing the website and any purchase. In no case shall be handled orders from persons under the age of age.

11. Security of personal data

The responsible will apply technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorized access, improper disclosure or unlawful processing.

Among the security measures may include:

• Use of secure connection using SSL certificate/HTTPS.
• Control access to the admin panel.
• Management of users and permissions.
• Periodic update of WordPress, WooCommerce, theme, and plugins.
• Backups.
• Antispam systems, and protection against unauthorized access.
• Protection of forms.
• Use of payment gateways that are safe.
• Restriction of access to personal data only to staff or approved vendors.
• Monitoring of technical problems or security.

However, no system connected to the Internet can guarantee absolute security. The user must also take reasonable security measures, to protect your credentials, using strong passwords and not share access data with third parties.

12. Security in payments

Payments made via the website will be managed through the payment methods enabled in WooCommerce.

Where payment is made via gateways for external bank details or credit card will be processed directly by the provider of payment, subject to their own security measures.

The site does not store full details of bank cards when these are managed by outside gangways safe.

Pending completion: indicate methods of real assets: card, Redsys, Stripe, PayPal, bank transfer, Bizum or other.

13. Confidentiality

The manager undertakes to treat personal data as confidential and to demand the same level of confidentiality to employees, partners and suppliers who can access personal data, by reason of the provision of services.

14. Website forms

Forms are available on the website will be able to include a box of acceptance of the privacy policy when necessary.

The user must provide truthful, accurate and up to date. The responsible will not be responsible for issues arising from incorrect or incomplete data provided by the user.

15. Commercial communications

The user can subscribe voluntarily to commercial communications, newsletters or promotions.

The sending of commercial communications will be made only when there is user's consent or a legal basis valid under the applicable regulations.

The user will be able to unsubscribe at any time using the link in the communications or contacting with us through the contact email.

16. Social networks

The web site may contain links or integrations with social networks.

The data processing carried out by such platforms is governed by their own privacy policies. The manager does not control the treatments done directly by the third party owners of social networks.

17. Cookies and similar technologies

The web site may use cookies and similar technologies own and third-party.

The user can consult detailed information on usage, configuration, acceptance or rejection in the Cookie Policy.

18. Changes in the privacy policy

The officer may modify this Security and Privacy Policy in order to adapt it to legislative changes, technical, operational, or service.

The current version will be published in each time on the website.

19. Date of last update

Last update: June 2026