Privacy Policy – ALMA STATIONERY

‌Effective Date: October 11, 2026‌

This Privacy Policy is issued by ALMA STATIONERY ECOM SL, with its registered address at Avenida de Portugal 35, C.P. 45600, Talavera de la Reina, Toledo, Spain, contact telephone number +34 925 804 017‌, and contact email address [email protected]. This policy applies to all data processing activities carried out through our official website ALMA STATIONERY, hereinafter referred to as the “Platform”, and all related services we provide to users and customers across the European Union and beyond. At ALMA STATIONERY, we specialize in hand-tested, reliable stationery products ranging from pen holders, desktop storage solutions, sticky notes, desk mats to a full range of office and study essentials, and we recognize that the trust of our customers is our most valuable asset. This document is designed to clearly outline how we collect, use, store, share and protect your personal data, in full compliance with all applicable Spanish and European Union data protection regulations, including Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD), Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), Royal Legislative Decree 1/2007 on the General Law for the Defence of Consumers and Users, the 2023 updated AEPD Cookie Guidelines, and Regulation (EU) 2022/2065 on Digital Services (DSA). We are fully committed to upholding your fundamental privacy rights, and this policy will help you understand our practices as you browse, shop and interact with our stationery e-commerce platform.

1. Data Controller Identification

For all personal data processing activities described in this Privacy Policy, ALMA STATIONERY ECOM SL acts as the independent Data Controller, as defined under Article 4 of the GDPR. We are legally registered under Spanish commercial law, with our primary place of operation at the address listed above. Should you have any questions, concerns or requests related to your personal data, you may reach out to our dedicated data protection team at any time via the following channels:

Postal Address: Avenida de Portugal 35, C.P. 45600, Talavera de la Reina, Toledo, Spain
Telephone: +34 925 804 017‌
Email: [email protected]

We maintain complete, up-to-date records of all our data processing activities in line with GDPR accountability requirements, and our internal team has received regular, specialized training on data protection protocols to ensure consistent compliance across all our operations, from order fulfillment to customer support.

2. Categories of Personal Data We Collect

We strictly adhere to the data minimization principle established under Article 5 of the GDPR, meaning we only collect the specific, limited personal data that is strictly necessary to deliver our stationery e-commerce services to you, and we never collect unnecessary or excessive information beyond the purposes explicitly stated in this policy. The personal data we may collect from you falls into the following categories:

‌Account and Registration Data‌: When you create a user account on our platform, we collect your full name, email address, chosen account password, and optional display name. This data helps you save your favorite products, track order history, and access personalized shopping features for our stationery collections.
‌Order and Transaction Data‌: When you place an order for our pen holders, desktop organizers, sticky notes, desk mats or other stationery products, we collect your full shipping address, billing address, contact telephone number, order details, purchase amount, payment method information (we do not store full credit card or debit card details on our internal servers, all payment processing is handled by PCI DSS compliant third-party payment providers), and order fulfillment status records.
‌Communication Data‌: When you contact our customer support team via email, our website contact form, or phone to ask questions about our products, request after-sales support, submit return or withdrawal requests, we retain the content of your messages, your contact information, and our team’s response records to ensure we can deliver consistent, high-quality support.
‌Technical and Usage Data‌: As you browse our website, we automatically collect limited technical data including your IP address, device type, operating system, browser type and version, language preference, time zone settings, website navigation paths, pages viewed, click-through behavior, and time spent on product pages. This data helps us troubleshoot technical issues, improve our website performance, and optimize the layout of our stationery product catalog for a smoother shopping experience.
‌Marketing Preference Data‌: If you opt in to receive our newsletter, we collect your email address and your stated preferences for new product announcements, exclusive discounts on our hand-tested stationery, and restock alerts for popular items such as our bestselling acrylic desktop organizer sets or eco-friendly recycled sticky notes. We also maintain records of any changes you make to your marketing preferences over time.
‌Voluntarily Provided Additional Data‌: On optional parts of our checkout or account page, you may choose to provide additional information such as a preferred delivery time, a personalized gift note for a stationery purchase you are sending as a present, or feedback about your experience using our products. This data is only processed for the explicit purpose you provide it for, and you may request its deletion at any time.

We do not collect any special categories of sensitive personal data as defined under Article 9 of the GDPR, including racial origin, religious beliefs, health information, or biometric data, unless you explicitly choose to provide such information voluntarily for a very specific, stated purpose, and we will only process that data with your explicit, separate, unambiguous consent.

3. Legal Bases for Data Processing

All of our personal data processing activities are rooted in one or more of the legal bases explicitly recognized under the GDPR, and we maintain full documentation to demonstrate compliance:

‌Performance of a Contract‌: The majority of our order-related data processing is necessary to fulfill the sales contract we enter into with you when you place an order on our platform. This includes processing your shipping address to deliver your stationery products, verifying your payment information to complete your purchase, and processing your return or withdrawal requests in line with our Refund and Returns Policy and the Royal Legislative Decree 1/2007 consumer protection rules. Without this data, we would be unable to complete your order and provide you with the products you have purchased.
‌Legitimate Interests‌: We process limited technical usage data and aggregated anonymized analytics data based on our legitimate interest as an e-commerce stationery retailer to improve our website functionality, prevent fraudulent transactions, optimize our product offering to match the needs of our customers who use our products for work, study and creative projects, and ensure the security of our online platform. We always balance our legitimate business interests against your individual privacy rights, and we never process your data in ways that override your fundamental privacy interests.
‌Explicit Consent‌: For all non-essential processing activities, including sending you our marketing newsletter, deploying non-essential cookies on your device, or sharing your data with third-party partners for personalized promotional purposes, we will always obtain your clear, freely given, specific, informed and unambiguous explicit consent. You will never be forced to consent to these processing activities as a condition of accessing our core shopping features, and you retain the full right to withdraw your consent at any time, with immediate effect.
‌Compliance with Legal Obligations‌: We process certain personal data to fulfill our legal obligations as a company established in Spain, including retaining transaction records for tax and accounting purposes, responding to valid, lawful requests from Spanish public authorities such as the Spanish Data Protection Agency (AEPD) or the Spanish consumer protection authorities, and meeting our transparency obligations under the Digital Services Act enforced by the Spanish National Markets and Competition Commission (CNMC).

4. Purposes for Which We Process Your Personal Data

We only use your personal data for the explicit, clearly communicated purposes that we have disclosed to you at the point of data collection, and we never process your data for any new, incompatible secondary purposes without providing you with updated information and obtaining any required separate consent. The core processing purposes include:

‌Order Fulfillment and Logistics‌: To process your completed purchase, arrange for the dispatch of your stationery products via our trusted courier partners, provide you with real-time tracking updates for your delivery, resolve any shipping-related issues, and ensure your order arrives at your designated address safely and on schedule.
‌Account Management‌: To maintain your registered user account, allow you to save your preferred shipping details, view your full order history, manage your saved favorite stationery products, and update your personal information whenever you need to.
‌Customer Support and After-Sales Service‌: To respond to your inquiries about product specifications, usage guidance for our desk accessories, warranty claims, return requests, or any other questions you may have about our stationery items or your purchase experience. Our customer support team will only access the minimal data required to resolve your specific request.
‌Website Optimization and Security‌: To monitor and diagnose technical errors on our platform, protect our website from unauthorized access, cyberattacks, and fraudulent transaction attempts, improve the accessibility of our website in line with the European Accessibility Act requirements, and ensure that all users can easily browse our full catalog of hand-tested stationery products even if they use assistive technologies.
‌Personalized Shopping Experience‌: With your explicit consent, we may use your browsing and purchase history to make tailored product recommendations for stationery items that match your preferences, for example suggesting a felt desk blotter to a customer who has already purchased a wooden pen holder from our store. These personalized suggestions are always optional, and you may disable this feature in your account settings at any time.
‌Marketing Communications‌: If you have opted in to our newsletter, we will periodically send you emails with updates about new arrivals such as our latest waterproof PVC desk covers or rotating multi-tier desktop organizers, exclusive limited-time discounts, tips for organizing your home office or study space, and announcements about seasonal promotions for our stationery collection. You may unsubscribe from our marketing communications at any time, free of charge, by clicking the unsubscribe link at the bottom of every marketing email, or by sending us a message at [email protected].
‌Legal Compliance and Dispute Resolution‌: To retain required transaction records for the mandatory periods specified under Spanish tax and commercial law, respond to valid legal requests from public authorities, defend our legal rights in the event of a dispute, and meet all our regulatory reporting obligations.

5. Cookie and Similar Technologies

In full compliance with the 2023 updated AEPD Cookie Guidelines, our website uses different categories of cookies and similar tracking technologies, and we provide you with a fully functional cookie consent banner on your first visit that allows you to granularly select which categories of cookies you agree to enable:

‌Strictly Necessary Cookies‌: These cookies are essential for the basic operation of our e-commerce platform, allowing you to add products to your cart, proceed through the checkout process, log in to your user account, and access secure areas of the website. You cannot disable these cookies through our consent banner, as the platform will not function properly without them, and they do not store any personal data that could be used for non-essential tracking.
‌Analytics Cookies‌: These cookies collect aggregated, anonymized data about how visitors interact with our website, helping us count visitor numbers, track traffic patterns, and understand which stationery product pages are most popular, so we can continuously improve our site structure and content. We only deploy these cookies if you give us your explicit consent.
‌Functional Cookies‌: These cookies remember your personal preferences when you return to our website, such as your selected language, your chosen currency for checkout, and the products you saved to your wishlist, to provide you with a more convenient, customized browsing experience.
‌Marketing Cookies‌: These cookies may be placed by our trusted third-party advertising partners to build a profile of your browsing behavior, and show you relevant ads for our stationery products on other third-party websites and social media platforms, in line with your stated interests. We will never enable these cookies without your separate, explicit prior consent.

You may adjust your cookie preferences at any time by accessing the Cookie Settings page linked in the footer of our website, and you may also modify the cookie permissions directly in your own web browser settings to block or delete cookies at your discretion.

6. Third-Party Data Sharing and Data Processors

We never sell, rent or trade your personal data to any unrelated third parties for their own commercial marketing purposes without your explicit separate consent. We only share your personal data with carefully vetted third-party data processors who act on our behalf, under a legally binding Data Processing Agreement (DPA) that fully complies with GDPR requirements, and who are contractually obligated to only process your personal data for the explicit purposes we have instructed, and implement appropriate security measures to protect your data. The categories of third-party data processors we may share your data with are:

‌Payment Service Providers‌: We work with PCI DSS certified payment gateways to process all your online payments securely. These providers receive only the transaction-related data required to verify and complete your payment, and they never share your full payment card information with us.
‌Logistics and Courier Partners‌: We share your shipping name, delivery address and contact telephone number with our selected courier service providers, exclusively for the purpose of delivering your ordered stationery products to you, and providing you with real-time delivery updates. Our courier partners are required by contract to delete all your delivery data immediately after the delivery process is fully completed, and to retain no extra copies for their own unrelated use.
‌Website Hosting and Technology Service Providers‌: We use EU-based secure hosting services to host our website and store all customer personal data on servers located within the European Economic Area (EEA), ensuring that no unnecessary cross-border data transfers take place outside of regions with an adequate level of data protection recognized by the European Commission. All our technology partners are fully audited for GDPR compliance before we begin any cooperation.
‌Customer Support and Tool Service Providers‌: We work with GDPR-compliant customer support systems that process your contact messages and support requests, with built-in features to automatically identify and mask any accidental sensitive personal data that you may submit during conversations, and ensure that all customer data can be fully deleted in a traceable, auditable manner if you submit a deletion request.
‌Regulatory and Law Enforcement Authorities‌: We may only disclose your personal data to public authorities, courts or law enforcement bodies if we are legally obligated to do so via a valid, lawful, formally issued request, and we will verify the legitimacy of all such requests before disclosing any of your personal information.

In the exceptional scenario where we ever need to transfer your personal data outside of the European Economic Area, we will ensure that the transfer is fully compliant with GDPR Chapter V rules, either by relying on an adequacy decision from the European Commission confirming that the destination country provides an equivalent level of data protection, or by using the standard data protection clauses (SCCs) that have been formally approved by the European Commission, to implement appropriate safeguards to protect your rights. We will always notify you in advance of any planned cross-border data transfers if they carry any material privacy risk.

7. Data Retention Periods

We do not retain your personal data for longer than is strictly necessary to fulfill the exact purposes for which it was originally collected, in line with the GDPR storage limitation principle. We define different, clearly documented retention periods for different categories of personal data:

‌Order and Transaction Data‌: We retain your full order records for the minimum period required to comply with Spanish tax, commercial and consumer protection laws, which is 10 years from the date your order is fully completed. After this mandatory retention period expires, we will securely delete or anonymize all related data.
‌User Account Data‌: If you maintain an active user account on our platform, we retain your account data for the full duration that your account remains active. If you choose to close your account, we will delete all your personal account data within 14 business days, except for the order records we are legally required to retain for the mandatory tax period.
‌Customer Support Communication Data‌: We retain your customer support messages and interaction records for a maximum of 3 years from the date our last interaction with you took place, unless there is an ongoing open dispute that requires us to retain the records for a longer period, after which we will permanently delete these records.
‌Marketing Consent Records‌: We retain records of your marketing preferences, including your opt-in and opt-out choices, for as long as we maintain our commercial relationship with you, and for an additional 3 years after you unsubscribe from our newsletter, to help us demonstrate our compliance with anti-spam and data protection regulations.
‌Technical Usage and Analytics Data‌: We retain raw technical browsing data for a maximum of 12 months, after which all this data is fully anonymized and aggregated into statistical datasets that can no longer be linked back to any individual identifiable user.

At the end of each retention period, our internal data management team automatically reviews all stored personal data, and ensures that any data that is no longer required is either securely deleted via permanent irreversible erasure, or anonymized so that it can no longer be associated with your identity.

8. Your Rights as a Data Subject

As a user located in the European Union or whose personal data is processed under the scope of the GDPR, you hold a full set of legally enforceable data subject rights that we fully respect and are committed to upholding. You may exercise any of these rights at any time, free of charge, by sending us a request via email at [email protected], or via post to our registered address. We will respond to all valid requests within a maximum of one month, as required by GDPR rules, and we will only ask you to provide the minimal information required to verify your identity to ensure we do not disclose your personal data to any unauthorized third party. Your full rights include:

‌Right of Access‌: You have the right to request a complete copy of all the personal data we hold about you, as well as a detailed written explanation of the purposes for which we process that data, the categories of recipients we have shared your data with, the planned retention period, and all other relevant details of our data processing activities.
‌Right to Rectification‌: If you find that any of the personal data we hold about you is inaccurate, incomplete or out of date (for example your shipping address, contact telephone number or email address), you have the right to request that we correct and update that data immediately. You may also make these corrections directly by accessing the account settings page on your user profile.
‌Right to Erasure (Right to be Forgotten)‌: You have the right to request that we permanently delete all your personal data, in circumstances where the data is no longer necessary for the original purposes for which it was collected, you have withdrawn your consent to the processing, you object to the processing and there are no overriding legitimate grounds for us to continue processing, or the processing no longer complies with applicable legal requirements. We will fulfill your erasure request without delay, unless we are legally required to retain certain specific data for mandatory legal or regulatory reasons.
‌Right to Restriction of Processing‌: You have the right to request that we temporarily restrict the processing of your personal data, for example when you contest the accuracy of your data, when our processing is unlawful and you oppose erasure and request restriction instead, when we no longer need your data but you require it for the establishment, exercise or defence of legal claims, or when you have objected to our processing based on legitimate interests during the period while we verify our legitimate grounds.
‌Right to Data Portability‌: You have the right to receive all the personal data you have provided to us, in a structured, commonly used, machine-readable format, and to request that we transmit this data directly to another data controller of your choice, where technically feasible, without any obstruction from our side.
‌Right to Object‌: You have the full right to object at any time to any processing of your personal data that is based on our legitimate interests, including profiling activities. If you submit an objection, we will immediately pause the processing, and we will demonstrate compelling legitimate grounds for the processing that override your rights and freedoms, or we will cease the processing of your data immediately. You also have the absolute right to object to processing for direct marketing purposes at any time, with no conditions attached.
‌Right to Withdraw Consent‌: For any processing activity that you previously provided explicit consent for, you have the right to withdraw that consent at any time, with immediate effect. The withdrawal of consent will not affect the lawfulness of any processing activities that took place before you withdrew your consent.
‌Right to Lodge a Complaint‌: If you believe that our processing of your personal data violates applicable data protection regulations, or if you are not satisfied with our response to your data subject request, you have the full right to lodge a formal complaint directly with the Spanish Data Protection Agency (AEPD), the national supervisory authority for data protection in Spain, located at Calle Jorge Juan, 6, 28001 Madrid.

9. Data Security Measures

We have implemented a comprehensive set of state-of-the-art technical and organizational security measures to protect all your personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, unauthorized access, and any other forms of unlawful processing. These measures include:

All data transmitted between your device and our website is encrypted using industry-standard TLS 1.3 secure protocols, ensuring that no third party can intercept or read your personal data during transmission over the internet.
All our servers hosting customer personal data are located in secure, physically guarded EU-based data centers, with 24/7 physical access control, fire detection and suppression systems, and redundant power supply systems to prevent data loss.
We enforce strict role-based access control within our team: only the minimum number of authorized, specially trained employees who need to access your data to perform their job functions (for example the order fulfillment team who need to see your shipping address) are granted access to your personal data, and all access activities are logged and audited on a regular monthly basis.
We perform regular automated and manual security vulnerability scans on our website, conduct quarterly full security audits, and keep all our software systems fully updated with the latest security patches to mitigate against the risk of cyberattacks and data breaches.
We have a formal, documented data breach response plan that is fully aligned with GDPR requirements. In the unlikely event that a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours after becoming aware of the breach, and we will directly notify all affected users without undue delay, providing clear guidance on the steps they can take to protect themselves.
All our employees are required to complete annual mandatory data protection and information security training, and are bound by internal confidentiality agreements that prohibit them from disclosing any customer personal data to unauthorized third parties under any circumstances.

10. Protection of Minors

Our stationery e-commerce platform is a general audience e-commerce website designed for use by adult customers purchasing office supplies, study essentials, and desk accessories for personal, family or professional use. We do not knowingly collect any personal data from children under the age of 16. If we become aware that we have accidentally collected personal data from a child under the age of 16 without the verifiable consent of their parent or legal guardian, we will immediately take steps to securely delete that data from all our systems. If you believe that we may have collected personal data from a minor, please contact us immediately at [email protected] so we can resolve this issue as quickly as possible, in full compliance with the DSA requirements for protection of minor users.

11. Links to Third-Party Websites

Our website may occasionally contain hyperlinks to external third-party websites, for example links to our trusted courier partners’ delivery tracking pages, or links to our social media profile pages. Please note that this Privacy Policy applies exclusively to the data processing activities that take place on our own ALMA STATIONERY website. When you click on a link to an external third-party website, we strongly recommend that you review the separate privacy policy of that third-party site before providing any of your personal data. ALMA STATIONERY ECOM SL bears no responsibility for the data processing practices of any external third-party websites that we do not operate or control.

12. Updates to This Privacy Policy

We may occasionally revise and update this Privacy Policy from time to time to reflect changes in our business operations, new regulatory requirements, or updates to our data processing practices. When we publish any material updates to this policy, we will change the “Effective Date” listed at the top of this document, and we will prominently display a clear notification on the homepage of our website to inform you of the upcoming changes before they come into effect. For any updates that significantly change your privacy rights or modify the core ways we process your personal data, we will also obtain any new required consents from you before those new practices go live. We encourage you to review this Privacy Policy periodically whenever you visit our website, to stay fully informed about how we protect your personal data.

13. Contact Information

If you have any questions, comments, concerns, or requests related to this Privacy Policy, or if you wish to exercise any of your data subject rights described above, please do not hesitate to contact us at any time:

Data Controller: ALMA STATIONERY ECOM SL
Registered Address: Avenida de Portugal 35, C.P. 45600, Talavera de la Reina, Toledo, Spain
Telephone Number: +34 925 804 017‌
Email Address: [email protected]

Our team will review your inquiry and respond to you as quickly as possible, to ensure that all your privacy concerns are fully addressed in a transparent and compliant manner.