Trade portal
Trade portal privacy notice
Last updated: 21/10/2026
Here we explain what we do with your data on the Huellas de Ibiza trade portal (tiendas.huellasdeibiza.com): applications, signing in, orders and payments. Our online shop, huellasdeibiza.com, has its own privacy policy.
Who is responsible for your data
Huellas de Ibiza is a brand owned by Raquel Baena Marí, who is the controller of your data.
- Spanish tax ID (NIF)
- 47405563X
- Address
- Avda Sant Jordi, 406, 07800 Eivissa, Illes Balears, Spain
- Email for privacy matters
- legal@huellasdeibiza.com
- +34 679 54 52 77
What data we process
- Your application
- Details of your business (type, name, opening date, premises, Instagram or website); your billing details: company name or full name, tax ID or VAT number, registered address and, in Spain, whether you are under the recargo de equivalencia (equivalence surcharge); your delivery address; what you tell us for your first order; and your contact details: name, mobile, email and how you heard about us.
- If you bought from us before the portal
- The details we already had from working together (your customer record and your invoices), so that we can give you access.
- Your orders
- Products, amounts, payment method, notes, delivery address and phone number, invoices and shipping status.
- Payments
- If you pay online, you do so on Stripe's page. We only keep the result and the amount, and we never receive your full card number. If you pay by bank transfer, we check that it has arrived.
- VAT numbers of shops in other EU countries
- The result of the VIES check, with its date, its consultation number and, if VIES provides them, the registered name and address.
- Security
- Technical connection data, such as your IP address and browser, and a log of sign-ins and important actions. We don't store your IP address in our database, only a pseudonymised version that we use to limit repeated attempts.
The details the form asks for are required, except those marked as optional: without them we can't review your application or, if we work together, invoice you.
What we use it for
| Purpose | Legal basis |
|---|---|
| Reviewing your application, including by area (using the postcode and town) | Steps you ask us to take before entering into a contract. If you represent a company, our legitimate interest in assessing a relationship with it |
| Giving you access to the portal and managing your orders, payments, deliveries and invoices | Contract. If you represent a company, our legitimate interest in managing our relationship with it |
| Invoicing, meeting our tax obligations and checking your VAT number in VIES | Legal obligation |
| Protecting the portal against bots, abuse and fraud | Legitimate interest |
| Telling you about new collections similar to what you already buy from us | Legitimate interest. You can ask us to stop at any time |
No decision about you is made by the portal alone. A member of our team reviews every application we receive. Before that, automatic filters stop submissions that look like they come from bots. The portal works out the proposal for your first order from your answers and our stock, and you can change it as you like. If VIES does not show your VAT number as valid, the order isn't completed automatically and we sort it out with you on WhatsApp.
How long we keep it
- If we work together
- For as long as our relationship lasts and, after that, for the periods set by law (commercial and tax: up to 6 years). This covers your orders, your invoices, the VIES checks and the record of changes to your account.
- If we don't end up working together
- We delete your application 12 months after our last reply, or after you sent it if we haven't replied yet, together with its record and the copies of its emails. If you don't confirm your email, we delete it after 30 days. If it is on the waiting list, we keep it for up to 24 months from when we added it. You can ask us to delete it sooner.
- Copies of emails
- We keep a copy of each email we send you from the portal for 90 days.
- Sign-in links
- They are valid for 15 minutes and can only be used once. The links in the approval email and in invitations are valid for 72 hours. We delete them the day after they expire.
- Session
- Up to 90 days, or until you sign out. Its record is deleted 7 days after it expires.
- Attempt limits
- Records of attempts are deleted after 7 days.
- Backups
- We back up the database so that nothing is lost and keep each backup for up to 90 days. Anything we delete from the portal disappears from the backups within that period.
Who we share your data with
We don't sell your data. We share it with the companies that provide a service for the portal, for the purposes described here, and when the law requires it.
- VercelVercel Inc.
- Hosting for the portal, which runs from Dublin (Ireland).
- SupabaseSupabase Inc.
- Database, hosted in Ireland.
- ResendResend, Inc.
- Sending the portal emails.
- CloudflareCloudflare, Inc.
- Turnstile, the bot check on the application form and on the ‘Sign in’ page. It analyses technical signals from your browser and connection, such as your IP address, only to tell people from bots. Cloudflare also uses them, as a controller, to improve that detection. More information in the Turnstile Privacy Addendum and in Cloudflare's privacy policy.
- StripeStripe Payments Europe, Ltd.
- Online payments. We pass on your email, the amount and the order number; you enter your payment details on Stripe's page. For some purposes, such as preventing fraud, Stripe processes them under its own privacy policy. Depending on the method you choose (for example, Klarna, Apple Pay or Google Pay), that provider also processes your data under its own policy.
- HoldedHolded Technologies S.L.
- Invoicing, with your company name, trading name, tax ID or VAT number and registered address.
- ShopifyShopify International Ltd.
- Records each order so that it can be prepared, with the shop's name, the company name and the delivery address and phone number. It also serves the product photos.
- Our warehouse. It prepares your order and hands it over to the carrier.
- European Commission (VIES)
- Checks your VAT number with your country's tax authority.
- WhatsAppMeta Platforms Ireland Ltd.
- If you message us on WhatsApp or we message you there.
- Spanish Tax Agency (Agencia Tributaria) and our tax advisers
- Invoices and mandatory tax returns.
Data outside the European Union
Vercel, Supabase, Resend, Cloudflare, Stripe and WhatsApp (Meta) are US companies or belong to US groups, and Shopify belongs to a Canadian one. If your data leaves the European Economic Area, it is protected by the European Commission standard contractual clauses in their contracts and, depending on the case, by the EU-US Data Privacy Framework or the adequacy decision for Canada.
Cookies we use
We only use cookies that the portal needs to work or that remember a choice you make. No analytics or advertising cookies.
| Name | Purpose | Duration |
|---|---|---|
__Host-hdm-tienda | Keeping you signed in | Up to 90 days, or until you sign out |
__Host-hdm-panel | Keeping the Huellas de Ibiza team signed in | Up to 90 days, or until signing out |
hdm_idioma | Remembering the language you choose. It only stores the language code | 1 year |
On the application form and the ‘Sign in’ page, Cloudflare Turnstile may use its own cookies or your browser's storage for the bot check. If you pay online, you go to Stripe's page, which has its own cookies. As they are all needed for the portal to work, or remember a choice you make, we don't ask for your consent.
Your rights
You can ask us for access to your data, or ask us to correct it, delete it, restrict its use or send it to you so you can take it elsewhere. You can also object to its use. Email us at legal@huellasdeibiza.com and tell us which right you want to exercise. We may ask you to prove your identity. You can also see your shop details under ‘Your account’, in ‘Your details’.
If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es), or to the data protection authority in your country.
Security
Data travels encrypted, you sign in without a password using single-use links, and only the Huellas de Ibiza team can access the admin panel.
Changes
If we change this notice, we will publish the new version here with its date.