We collect only the bare minimum: what's necessary to ship your order, invoice you, and respond to your inquiries. This page explains what data we process, for what purposes, for how long, who has access to it, and how to regain control of it.
This document is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
Last updated: September 2026.
1. Who is the data controller?
- For any questions regarding personal data, please contact: pkmndistrict.team@proton.me
We are not required to appoint a data protection officer under Article 37 of the GDPR and Article 34 of the French Data Protection Act (LOPDGDD). Should we appoint one, we will publish their contact details here.
2. The data we collect
We only process data that you provide to us or that is generated by your use of the site.
- Identity and contact details: first name, last name, email, telephone.
- Addresses: delivery address and billing address.
- Orders: items, amount, date, order number, purchase history, shipping status and tracking number.
- Payment: type of payment method, transaction status, and the last four digits of the card. We never see or store your full card number or security code: this data is processed directly by our payment provider in a PCI DSS certified environment.
- Customer account , if you create one: login details and preferences.
- Customer service: content of your emails, messages and attachments, history of exchanges.
- Reviews and photos that you choose to publish.
- Newsletter: email address, date of consent, opens and clicks.
- Navigation: IP address, device and browser type, pages viewed, products viewed, shopping cart contents, and cookie identifiers. See our Cookie Policy .
- Fraud prevention: technical signals used by our service providers to detect fraudulent orders.
Required fields are indicated on the forms. Without them, we cannot process your order.
3. Why we process them and on what legal basis
- Processing and tracking your order, managing delivery and returns: performance of the contract (Article 6.1.b of the GDPR).
- Managing your customer account: contract execution.
- Collection of payments: execution of the contract.
- Issuance and storage of invoices, keeping of accounts: legal obligation (article 6.1.c of the GDPR, article 30 of the Spanish Commercial Code and tax legislation).
- Responding to your requests and complaints: performance of the contract and legitimate interest.
- Application of the legal guarantee and the right of withdrawal: legal obligation.
- Fraud prevention: legitimate interest (Article 6.1.f of the GDPR), namely the protection of our business.
- Sending the newsletter and commercial offers: your consent (Article 6.1.a of the GDPR) or, if you are already a customer, our legitimate interest for similar products, in accordance with Article 21.2 of Law 34/2002, with the possibility of unsubscribing at any time.
- Publication of customer reviews: your consent.
- Measuring site traffic and improving pages: your consent, except for internal audience measurement exempted under Article 22.2 of Law 34/2002 and the AEPD guide on cookies.
- Advertising and retargeting: your consent.
- Site security and retention of technical logs: legitimate interest.
The analytics and advertising tools actually active on the site are listed in the cookie management panel, where you can also disable them one by one.
4. Who has access to your data
We do not sell or rent your data. Access is granted to our authorized staff and the following service providers, who act as data processors or, as applicable, data controllers:
- Shopify International Limited (Bunkers Hill, Dublin 2, Ireland), which hosts the store and order database.
- Payment providers , to process transactions and prevent fraud.
- Carriers , who receive your name, address, email and telephone number, strictly for the purpose of delivering and tracking the package.
- Email sending provider for order confirmations, tracking and newsletters.
- Customer review solution , if applicable.
- Audience measurement and advertising tools , only if you have given your consent.
- Accounting and tax advisor , to ensure we meet our obligations.
- Administrative or judicial authorities , when required by law.
Each subcontractor is bound by a contract compliant with Article 28 of the GDPR, which prohibits them from using your data for their own purposes.
5. How long do we keep them?
- Order and delivery data: 5 years from delivery, which is the limitation period for personal actions provided for in Article 1964.2 of the Spanish Civil Code.
- Invoices and accounting documents: 6 years from the last entry, in accordance with Article 30 of the Commercial Code, and 4 years for tax purposes.
- Customer account: as long as the account is active, then 3 years from your last contact.
- Newsletter contacts not customers: until you unsubscribe and, in any case, 3 years from the last contact, after which the data is deleted or anonymized.
- Exchanges with customer service: 3 years from the date of the last message.
- Payment data (never the card number, which we do not store): for the duration of the transaction, then for the intermediate retention period applicable to the service provider under its legal obligations.
- Published reviews: as long as the review is online, until you request its removal.
- Cookies and associated browsing data: maximum 24 months.
- Proof of cookie consent: 24 months.
- Connection and security logs: 12 months.
Upon expiry of these periods, the data is deleted or anonymized, except when it is blocked and held at the disposal of judges and courts as well as public authorities for the limitation period, in accordance with Article 32 of the LOPDGDD.
6. Transfers outside the European Union
Our hosting provider, Shopify, is based in Ireland, which is within the European Union. However, part of its infrastructure and some of our service providers may process data from countries outside the European Economic Area, including the United States and Canada.
These transfers rely on at least one of the mechanisms provided for in Chapter V of the GDPR:
- an adequacy decision from the European Commission, for example for Canada or the EU-US Data Privacy Framework for certified US companies;
- the standard contractual clauses adopted by the European Commission;
- additional technical and organizational measures, including encryption.
You can obtain a copy of the applicable warranties by writing to support@pkmnoutlet.com
7. Your rights
You have the following rights over your data at any time:
- Access (Article 15 of the GDPR): to know if we process your data and to obtain a copy of it.
- Rectification (article 16): to have inaccurate or incomplete data corrected.
- Erasure (Article 17): You can ask us to erase your data, except when the law requires us to keep it, as is the case for invoices.
- Limitation of processing (article 18): ask us to freeze your data while we carry out a verification.
- Objection (Article 21): You have the right to object to processing based on our legitimate interest, without having to justify yourself when it concerns commercial prospecting.
- Portability (Article 20): to receive the data you have provided to us in a structured and machine-readable format, or to ask us to transmit it to another data controller.
- You may withdraw your consent at any time, without this affecting the lawfulness of the processing carried out before this withdrawal.
- Rights of deceased persons (article 3 of the LOPDGDD): your heirs may request access to your data, its rectification or its erasure, unless you have expressly prohibited it.
How to practice them
Write to support@pkmnoutlet.com specifying your request. We may ask for proof of identity if we have reasonable doubt. We will respond within one month, which may be extended to three months if the request is complex; in this case, we will inform you.
To unsubscribe from the newsletter, simply use the link at the bottom of each email.
8. Complaint to the Spanish Data Protection Agency (AEPD)
If you believe that we are not respecting your rights, you can lodge a complaint with the supervisory authority:
- Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid
- Online portal: sedeagpd.gob.es
- Information: www.aepd.es
However, we encourage you to write to us first: almost all requests can be resolved in a single email.
9. Cookies
This website uses cookies and similar technologies. Those that are not strictly necessary for its operation are only placed after you give your consent, which is obtained via the banner displayed during your first visit. Details can be found in our Cookie Policy , where you can also change your preferences at any time.
10. Security
We apply appropriate technical and organizational measures: encryption of communications via HTTPS, data access limited to authorized personnel, strong authentication on administration tools, hosting with a certified provider and payments processed in a PCI DSS environment.
In the event of a security breach likely to result in a high risk to your rights, we will inform you as soon as possible, in accordance with Article 34 of the GDPR.
11. Minors
This website is intended for adults. Under Article 7 of the LOPDGDD (Law on the Protection of Personal Data), the processing of a minor's data based on their consent is only lawful from the age of fourteen; below this age, it requires the consent of the holder of parental authority or guardianship. We do not knowingly collect data concerning children under the age of fourteen. If we were notified of such collection, the data would be deleted immediately.
12. Automated Decisions
We do not make any decisions that have legal effects concerning you based solely on automated processing, with the exception of fraud checks carried out by our payment providers, which may result in a transaction being declined. In this case, you can request a review by a human being by writing to us.
13. Changes to this policy
This policy may change, for example, if we add a tool or if regulations change. The applicable version is the one published on this page. In the event of a substantial change, we will notify you by email or by posting a notice on the website.