This policy explains how we process your personal data when you visit outletsofadirect.fr, buy from our shop or contact us, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- BORRELLO TRADING, S.L. (Outlet Sofa Direct) · Tax ID (NIF) B16807653
- Calle Mallorca, 2 · 46190 Riba-roja de Túria (Valencia), Spain
- Email: info@outletsofadirect.fr · Phone: +34 962 297 263 (Spain) / +33 9 72 55 90 03 (France)
2. What data we process
- Identification and contact details: first name, surname, email address, phone number, and delivery and billing addresses.
- Order data: products, amounts, chosen payment method, deliveries, returns and incidents. We do not store your card details: they are handled by the payment provider.
- Communications: the messages you send us by email, phone or form.
- Browsing: if you accept cookies, data on how you use the website and browser and campaign identifiers. We explain this in our Cookie policy and in section 7.
3. What we use your data for, on what legal basis and for how long
| Purpose | Legal basis | Retention period |
|---|---|---|
| Managing your order: payment, shipping, delivery, invoicing, returns and guarantees | Performance of the purchase contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c)) | For as long as the relationship lasts and then for the legal periods: 6 years for accounting records (Spanish Commercial Code) and the 3-year product guarantee |
| Answering your enquiries and complaints | Your consent when you write to us and our legitimate interest in replying (Art. 6(1)(a) and (f)) | Until the enquiry is resolved and then for as long as needed to handle any claims |
| Sending you our newsletter and offers by email | Your consent when you subscribe (Art. 6(1)(a)) | Until you unsubscribe, using the link in each email or by writing to us |
| Sending you offers for products similar to those you have already bought | Legitimate interest and Art. 21(2) of the Spanish LSSI | Until you object, using the link in each email |
| Reminding you of a basket or order you left unfinished | Legitimate interest (Art. 6(1)(f)) | Up to 30 days after the basket or until you object |
| Asking for your opinion on your purchase | Legitimate interest (Art. 6(1)(f)) | Until you object; published reviews, for as long as they are visible |
| Measuring how the website is used and showing you relevant advertising (statistics and marketing cookies) | Your consent in the cookie panel (Art. 6(1)(a)) | Depending on each cookie (see Cookie policy) and until you withdraw your consent |
| Reporting purchases from our server to measurement and advertising platforms (section 7) | Your consent in the cookie panel (Art. 6(1)(a)) | 90 days from the order |
| Preventing payment fraud | Legitimate interest (Art. 6(1)(f)) | For as long as needed for each transaction and any related claims |
We do not make decisions based solely on automated processing that produce legal effects concerning you. If you choose to pay in instalments with Alma, it is Alma that assesses the application, as controller of its own processing.
4. Who we share your data with
Only with those we need in order to provide our service, under contracts that oblige them to protect your data, and with public authorities when required by law:
| Recipient | Purpose | Country |
|---|---|---|
| Carriers: FedEx and DHL | Delivering your order and handling returns | EU (and the US in some cases) |
| Redsys and the bank | Card payments | Spain |
| Alma SAS | Deferred or instalment payment, if you choose it. Alma processes your data as an independent controller | France |
| Klaviyo | Sending emails (orders, newsletter, basket) | US |
| Google (Analytics, Ads, Tag Manager) | Measurement and advertising, only with your consent | Ireland / US |
| Meta Platforms (Facebook, Instagram) | Measurement and advertising, only with your consent | Ireland / US |
| Microsoft (Advertising, Clarity) | Measurement and advertising, only with your consent | Ireland / US |
| Trusted Shops | Customer reviews and buyer protection | Germany |
| Trustpilot | Invitation to review your purchase | Denmark |
| Usercentrics (Cookiebot) | Recording your cookie choice | Denmark / EU |
| Professional Hosting | Website hosting | Spain |
| Tax, accounting and legal advisers | Meeting our legal obligations | Spain |
5. International transfers
Some providers (Klaviyo, Google, Meta and Microsoft) may process data in the United States. These companies are certified under the EU-US Data Privacy Framework, recognised by the European Commission as providing adequate safeguards, and also apply the standard contractual clauses approved by the Commission. You can ask us for more information at info@outletsofadirect.fr.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and withdraw any consent you have given us, without affecting processing carried out before. Write to us at info@outletsofadirect.fr or by post to the address in section 1, stating which right you wish to exercise. We will reply within one month at the latest.
If you consider that we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or, if you live in France, with the Commission Nationale de l'Informatique et des Libertés (www.cnil.fr).
7. Purchase measurement from our server
If you have accepted statistics and/or marketing cookies, when you start an order we store, linked to your basket, the technical identifiers those cookies already contain (Google Analytics, Google Ads, Meta, Microsoft Advertising), your browser and your IP address. We use them solely to tell those platforms, from our server, that the order has been completed and which campaign it relates to, for the same purpose and with the same recipients as the cookies you have accepted. When we send your email address or phone number to match the purchase, they are irreversibly encrypted. If you reject cookies, we do not store any identifiers. This data is deleted 90 days after the order. You can withdraw your consent at any time from the cookie panel.
8. Security
We apply technical and organisational measures to protect your data: encrypted connections, access restricted to staff who need it, and backups.
9. Minors
The shop is intended for adults. We do not knowingly collect data from children under 14.
10. Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will let you know.