Privacy policy

Last updated: 12 October 2026

This policy explains how Stateful Kit ("we", "us") handles your personal data when you visit this store or buy one of our products. We sell digital products only: PDF guides delivered by download. We do not ship physical goods.

1. Who is responsible for your data

The data controller is Sergio Garrido Merino (tax ID/NIF: 05983714B), owner of Stateful Kit, the trade name under which this online store operates. For any privacy question or request, write to sergiogm.business@gmail.com.

2. What data we collect

Order data: your name, email address, the billing details requested at checkout, the products you buy, the price paid and the date of the order.
Payment data: payments are handled by the payment provider you use at checkout. We do not receive or store your full card number. We only receive limited information, such as the payment status, the type of payment method and the last digits of the card.
Account data (optional): if you choose to create a customer account, your email address and your order history.
Messages: what you tell us when you write to us.
Technical data: IP address, device and browser type, pages visited and similar data collected through cookies and similar technologies (see section 8).

3. Why we use your data and on what legal basis

To process your order, deliver your download and give you support. Legal basis: performance of the contract you enter into with us (Article 6(1)(b) GDPR).
To issue invoices, keep accounting records and meet our tax obligations. Legal basis: legal obligation (Article 6(1)(c) GDPR).
To keep the store secure and prevent fraud. Legal basis: our legitimate interest in protecting the store and our customers (Article 6(1)(f) GDPR).
To send you news and offers by email, only if you ask for them (for example, by ticking the box at checkout). Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link included in every email.
To measure and improve the store with analytics or marketing cookies, only if you accept them. Legal basis: your consent.

We do not make decisions about you based solely on automated processing, and we do not sell your personal data.

4. Who we share your data with

We only share your data with the providers we need to run the store, and with the authorities when the law requires it:

Shopify (Shopify International Limited, Ireland, and its group companies), which hosts the store, the checkout and the order system, and processes your data on our behalf as a data processor.
The payment provider you use at checkout (for example, Shopify Payments and its payment partners, or any other provider shown at checkout), which processes your payment. For some purposes, such as fraud prevention and their own legal obligations, payment providers act as independent controllers under their own privacy policies.
The digital delivery app we use within Shopify to send you your download link.
Public authorities, such as tax authorities, when the law requires it.

If you use Shop Pay or the Shop app, Shopify processes your data as an independent controller under its Consumer Privacy Policy. You can also exercise rights over the data Shopify holds through the Shopify Privacy Portal.

5. International transfers

Shopify and some payment providers may process data outside the European Economic Area, for example in Canada or the United States. When this happens, the transfer is covered by an adequacy decision of the European Commission (such as the decision for Canada, or the EU-U.S. Data Privacy Framework for certified companies) or by the Standard Contractual Clauses approved by the European Commission.

6. How long we keep your data

Order and invoice data: for as long as tax and commercial law requires (in Spain, generally up to six years).
Marketing email data: until you unsubscribe or withdraw your consent.
Messages and support requests: while we handle your request and, after that, only as long as needed to deal with possible claims.
Customer account: until you ask us to delete it, without affecting the order data we must keep by law.

7. Your rights

You can ask us at any time to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where we use your data based on your consent, you can withdraw it at any time; this does not affect processing carried out before.

To exercise your rights, write to sergiogm.business@gmail.com from the email address linked to your order, or tell us how we can verify your identity. We will answer within one month, as the law requires.

If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the data protection authority of the country where you live.

8. Cookies

The store uses cookies and similar technologies. Some are strictly necessary for the store and the checkout to work (for example, to keep your cart and process your order) and do not require your consent. Others, such as analytics or marketing cookies, are only used if you accept them in the cookie banner. You can change your choice at any time by deleting the cookies in your browser; the banner will then appear again. You can read more about the cookies used by Shopify stores in Shopify's cookie policy.

9. Children

This store is not intended for children. We do not knowingly collect data from anyone under 14, the minimum age to consent to the processing of personal data in Spain. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

We rely on the security measures provided by Shopify, including encrypted connections (HTTPS) and a PCI DSS compliant checkout, and we limit access to your data to what is needed to run the store.

11. Changes to this policy

We may update this policy when the law or our services change. We will publish the new version on this page with its update date and, if the changes are significant, we will let you know by reasonable means.

12. Contact

Sergio Garrido Merino (Stateful Kit). Email: sergiogm.business@gmail.com