Privacy policy

Last updated: 29 July 2026

This Privacy Policy explains what personal data The Calm Puppy collects when you visit this site or buy from us, why we collect it, and what rights you have. We keep it short and specific on purpose.

1. Who is responsible for your data

The data controller is Diego Marin, NIF 78841837E, Tudela, Navarra, Spain, trading as The Calm Puppy. For any privacy question or request, write to support@thecalmpuppy.com.

2. What we collect

  • Order data: your name, email address, billing address, country, the products you bought, the amount paid and the time of purchase.
  • Payment data: handled directly by our payment providers. We receive confirmation that a payment succeeded and the last digits and brand of the card. We never see or store your full card number.
  • Communications: the content of emails or contact-form messages you send us.
  • Technical and usage data: IP address, browser and device type, pages viewed, referring site, and similar information collected through cookies and comparable technologies.
  • Marketing data: your email address, if you choose to subscribe.

We do not knowingly collect data from anyone under 16, and this site is not directed at children.

3. Why we use it, and on what legal basis

  • To deliver what you bought — process the order, send the download link, provide support. Legal basis: performance of a contract.
  • To keep accounting and tax records — invoices and transaction records. Legal basis: legal obligation.
  • To prevent fraud, chargeback abuse and unauthorised sharing of our files, and to defend legal claims. Legal basis: our legitimate interests.
  • To improve the site and understand what works — aggregated analytics. Legal basis: consent, where required, otherwise legitimate interests.
  • To send marketing emails about our products. Legal basis: your consent, or legitimate interest where you are an existing customer buying a similar product. You can unsubscribe from any email in one click.
  • To measure and target advertising on third-party platforms, where you have consented through the cookie banner. Legal basis: consent.

We do not sell your personal data, and we do not share it for anyone else's independent marketing.

4. Who processes it for us

We use trusted service providers who process data on our instructions and under contract:

  • Shopify — hosts this store, the checkout and our order records.
  • Payment providers (such as Shopify Payments, Stripe or PayPal) — process payments and fraud checks.
  • Digital delivery and email providers — send your download link and our emails.
  • Meta Platforms (Facebook and Instagram) — we share activity data such as pages viewed, items added to the cart and completed purchases, through the Meta pixel and the Conversions API, so that we can measure our advertising and show relevant ads. This happens only where you have consented through the cookie banner. You can also limit it from the "Off-Facebook activity" settings of your own Facebook account.
  • Other analytics and advertising platforms — only to the extent you have consented via the cookie banner.

Some of these providers are based outside the European Economic Area, including in the United States. Where data is transferred internationally we rely on the appropriate safeguards permitted by the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We may also disclose data where we are legally required to, or where it is necessary to enforce our Terms of Service or protect our rights.

5. Cookies

We use cookies that are strictly necessary to run the store (keeping your cart, securing checkout) — these do not require consent. We also use optional analytics and advertising cookies, which are only set if you accept them in the cookie banner. You can change your choice at any time through the cookie preferences link on this site, or by clearing cookies in your browser.

6. How long we keep it

Order and invoice records are kept for as long as required by Spanish tax and accounting law — generally up to six years from the end of the relevant financial year. Support emails are kept for up to three years. Marketing data is kept until you unsubscribe. Analytics data is kept for the retention period configured in each platform.

7. How we protect it

Data is transmitted over encrypted connections (HTTPS) and stored on the secure infrastructure of our providers, with access limited to those who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.

8. Your rights

Under the GDPR and Spanish data protection law you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased, where no legal obligation requires us to keep it;
  • restrict or object to certain processing, including direct marketing;
  • receive your data in a portable format;
  • withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any of these, email support@thecalmpuppy.com. We reply within one month. We may need to verify your identity first. If you believe we have handled your data badly you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the supervisory authority in your own country.

9. Changes

If we change this policy we will update the date at the top of this page. Significant changes will be announced on the site.

10. Contact

The Calm Puppy — support@thecalmpuppy.com