What this covers
This text adds to our privacy policy for purchases in the app's shop. Anything not covered here follows the general policy.
1. Controller
The controller of your data as a buyer is , tax ID (NIF) , address . Contact: hello@fescims.com.
2. What data we process
- For the order: your Cims account, name, delivery address, phone, email, the products and sizes, the amounts, the coupon, and the status and tracking of each parcel.
- For the payment: the identifiers Stripe gives us and the payment result. You enter your card details in Stripe's payment sheet, and they never reach our servers.
- For after-sales: withdrawal requests, the tracking number, carrier and posting-receipt photo you add for your return, if any, and problem reports with the photo you attach.
- For summit prints: the photos you choose and those summits' names, heights and dates, with the order, border and cover you pick.
The order and payment data are needed for the contract: without them we can't accept, make or deliver your order.
3. Why, and on what legal basis
- Making, shipping and charging for your order (including printing your summit prints from the photos you choose), and handling withdrawals, defects and orders not received: necessary to perform the purchase contract.
- Invoicing, bookkeeping and the legal guarantee: required by law.
- Preventing fraud and applying the claims limit in the terms of sale: our legitimate interest in a shop that works without abuse. Only incidents in which we confirm misuse count, never withdrawing or using the guarantee in good faith. It isn't an automated decision: before we stop selling to you, a person reviews the case and hears from you.
- Offering you a pack of summit prints with your best photos: by email when you reach 10, 25, 50 or 100 summits or finish a challenge, and in December with the year's best, only if you have agreed to receive marketing messages. In December we also tell you with an app notification, based on our legitimate interest in offering products of the app you use; you can turn notifications off in your profile.
You can withdraw your consent to marketing messages at any time, by turning emails off in your profile in the app or with the unsubscribe link in each email, without affecting anything we did before.
4. Who we share your data with
Only with the providers the shop needs, and only what each of them needs:
- Stripe (payments): the amount, your email and the payment details you enter in its sheet. Stripe also uses this data to prevent fraud and meet its legal obligations, as an independent controller. We contract with Stripe Payments Europe, Limited (Ireland); when Stripe, LLC processes data in the US, the transfer relies on the EU-US Data Privacy Framework.
- Printful (production and shipping): your name, address, phone and email, to make and deliver the order, and the print files. Printful passes your name, address and phone to the carrier that delivers the parcel. We contract with Printful, Inc. (US), which may process the data in the US; the transfer relies on the European Commission's standard contractual clauses in its data processing terms.
- Prodigi (summit prints): your name, address and phone, to print and send them, and the print files with your photos and your summits' names, heights and dates. Prodigi is a UK company (a country with an EU adequacy decision) that prints them in Latvia, and passes your name and address to the postal service that delivers them.
- Resend (email): your email address and the content of the order emails (confirmation, shipping, refunds and withdrawals). Resend (Plus Five Five, Inc.) is in the US; the transfer relies on the EU-US Data Privacy Framework and standard contractual clauses.
- Railway (servers and database): all the shop's data. Railway Corporation is in the US; the transfer relies on the EU-US Data Privacy Framework.
- Amazon Web Services (photos and print files): we store them in its Paris region (eu-west-3) and contract with Amazon Web Services EMEA SARL (Luxembourg). Should they be accessed from outside the European Economic Area, its standard contractual clauses apply.
- Discord (internal alerts): the order number, the items, the amounts and the reason for each alert and, for returns and problem reports, the tracking number or photo you give us, so we can deal with them. Discord, Inc. is in the US; the transfer relies on the EU-US Data Privacy Framework and standard contractual clauses.
You can ask us for a copy of these safeguards at hello@fescims.com.
5. How long we keep data
- Orders, payments and invoices: 6 years from the order, as commercial and tax law require; then we delete them with all their files.
- Withdrawals (with the return's tracking number and posting-receipt photo), problem-report photos and the print files of your summit prints: 3 years from delivery (or from the order, if it was never delivered). Then we delete them.
- If you delete your account, we delete unpaid orders; paid ones are kept blocked, separate from your profile, only for the legal periods above.
6. Your rights
You can ask to access, correct, delete, restrict or port your data, or object to its processing, by writing to hello@fescims.com. In particular, you can object at any time to processing based on our legitimate interest (fraud prevention, the claims limit and app notifications). If you think we have mishandled your data, you can complain to the Spanish Data Protection Agency (AEPD).
Purchase terms: Terms of sale.