1. Data controller
The controller responsible for the personal data described in this policy is Creston Labs, Sociedad Limitada (NIF B93760064), Calle Francisco Robles 19, 1º G, 30130 Beniel (Murcia), Spain. You can reach us about anything in this policy at [email protected].
We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).
2. What data we collect
We deliberately collect as little personal data as possible. Depending on how you interact with us, we process:
- Email address — when you purchase an e-book, subscribe to a newsletter, or write to us. We need it to deliver the content you bought and to answer you.
- Purchase data — order details (product, date, amount, country, receipt reference) provided to us by our payment processor. We never receive or store your card number or full payment credentials; payments are handled entirely by our merchant of record (Lemon Squeezy), which processes them under its own privacy policy.
- Correspondence — the content of emails you send us, so that we can handle your request.
We do not collect special categories of data, we do not profile you, and we do not use your data for automated decision-making.
3. Why we process it (legal basis, Art. 6(1) GDPR)
- To deliver purchases and subscriptions — Art. 6(1)(b) GDPR: performance of a contract.
- To answer support, refund and other enquiries — Art. 6(1)(b) GDPR, and Art. 6(1)(f) (legitimate interest in responding to people who contact us).
- To keep accounting and tax records — Art. 6(1)(c) GDPR: compliance with legal obligations under Spanish commercial and tax law.
- To send the newsletter you subscribed to — Art. 6(1)(b) GDPR: it is the service you are paying for. Every email includes a way to cancel.
We do not send marketing emails unrelated to what you purchased or subscribed to without your prior consent (Art. 6(1)(a) GDPR), which you could withdraw at any time.
4. Who we share data with
We do not sell or rent personal data to third parties. We share data only with the service providers strictly necessary to run the business:
- our merchant of record and payment processor (Lemon Squeezy), which handles checkout and billing as an independent controller;
- our email delivery provider, used solely to deliver the content and messages described above, acting as a processor on our instructions;
- public authorities, where the law requires it.
Where a provider is located outside the European Economic Area, transfers are protected by an adequacy decision or by the European Commission's Standard Contractual Clauses.
5. How long we keep data
- Purchase and invoicing records: for as long as Spanish tax and commercial law requires (generally up to six years).
- Newsletter subscriber data: for the life of the subscription, then deleted or anonymised within a reasonable period after cancellation.
- Support correspondence: for as long as needed to resolve the matter and document how it was resolved.
6. Cookies
This website is a static informational site. It sets no analytics, advertising or tracking cookies. If any cookie is ever strictly necessary for the site to function, it will be a technical cookie exempt from consent requirements. Checkout pages operated by our merchant of record may use their own cookies, governed by their cookie policy shown at checkout.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten"), where no legal obligation requires us to keep it;
- restrict or object to processing based on legitimate interest;
- data portability — receive the data you provided in a structured, machine-readable format;
- withdraw consent at any time, where processing is based on consent, without affecting prior processing.
To exercise any of these rights, email [email protected] from the address associated with your purchase or subscription, stating which right you wish to exercise. We respond within one month, as the GDPR requires.
8. Security
We apply appropriate technical and organisational measures to protect the limited personal data we hold, including access controls and encrypted connections. Payment credentials are never stored on our systems.
9. Changes to this policy
We may update this policy from time to time. The current version, with its "Last updated" date, will always be published on this page, and material changes affecting subscribers will be notified by email.
10. Contact
For any privacy question or request: [email protected], or by post to Creston Labs, Sociedad Limitada, Calle Francisco Robles 19, 1º G, 30130 Beniel (Murcia), Spain.