At ZiNGS, we respect your privacy and are committed to protecting your personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and the guarantee of digital rights, and other applicable legislation.
This policy explains what personal data we collect, how we use it, how long we retain it, with whom it may be shared and how you can exercise your rights.
Last updated: 17 September 2026.
1. Data controller
- Data controller: Enrique González-Lahore Herce
- Trading name: ZiNGS
- Spanish tax identification number (NIF): 51608008X
- Address: Calle de Alcalá, 231, 28028 Madrid, Spain
- Website: www.zings.es
- Email: info@zings.es
- Telephone: +34 91 726 31 88
ZiNGS has not appointed a data protection officer.
2. Personal data we process
Depending on your relationship with ZiNGS and the services you use, we may process the following categories of data:
- Identification data: first name, surname and, where necessary, tax identification details.
- Contact data: email address, telephone number, postal address and billing or delivery details.
- Account data: user ID, login credentials, password stored using cryptographic techniques, preferences and account history.
- Order data: products purchased, amounts, returns, incidents, communications and order status.
- Financial and transaction data: payment method, payment confirmation and information required to manage invoices, refunds or incidents.
- Personalisation data: names, text, photographs, images or instructions supplied to personalise a product.
- Communication data: enquiries made by email, contact form, telephone or WhatsApp.
- Marketing preference data: communication subscriptions, products viewed and interactions with marketing campaigns.
- Technical and browsing data: IP address, device, browser, online identifiers, technical logs, pages visited and information obtained through cookies or similar technologies.
- Video surveillance data: images recorded by security cameras in the physical shop.
ZiNGS does not store full bank card details. These details are processed directly by the relevant financial institutions or payment platforms.
3. Sources of personal data
Personal data may be obtained:
- Directly from users when they create an account, place an order, request a return or contact ZiNGS.
- Through the data and instructions supplied to personalise a product.
- Through cookies and similar technologies, where the user has given the relevant consent or another lawful basis applies.
- From payment, shipping or technology providers where necessary to process an order or resolve an incident.
- Through the video surveillance system installed in the physical shop.
- Through reviews or comments voluntarily published by users on Google.
4. Purposes and lawful bases
4.1. Customer account management
We process data to create and administer accounts, facilitate future purchases, display order history and manage user preferences.
Lawful basis: performance of a contractual relationship or steps taken at the user’s request.
4.2. Order and purchase management
We process data to handle orders, verify payments, prepare products, arrange deliveries, issue invoices, process returns, apply warranties and resolve incidents.
Lawful basis: performance of the sales contract and compliance with applicable legal obligations.
4.3. Payments and fraud prevention
The information required to make a payment is disclosed to the financial institutions and platforms selected by the customer, such as Redsys, Bizum, PayPal or the relevant bank.
Lawful basis: performance of the contract, compliance with legal obligations and legitimate interests in preventing fraudulent transactions.
4.4. Preparation and delivery of orders
Identification, contact and address data are used to prepare and deliver orders and manage any shipping incidents.
Lawful basis: performance of the sales contract.
4.5. Handling enquiries
We process data provided through the contact form, email, telephone or WhatsApp to respond to questions, requests or complaints.
When users contact us through WhatsApp, their data will also be processed by WhatsApp Ireland Limited in accordance with its own terms and privacy policy.
Lawful basis: steps taken before entering into a contract, performance of the contract or ZiNGS’ legitimate interests in properly handling communications received.
4.6. Personalised products
We process the text, names, photographs, images or instructions supplied by customers to produce the requested product.
Lawful basis: performance of the sales contract.
Customers must ensure that they are authorised to use any images or personal data relating to other people that they provide to ZiNGS. Special-category or otherwise sensitive data that are not necessary for personalisation must not be submitted.
Personalisation files will be retained only for as long as necessary to produce and deliver the product and handle any incidents, returns, warranties or complaints. They will then be deleted unless a legal obligation or outstanding claim justifies their retention.
4.7. Marketing communications and newsletter
Where authorised by the user, ZiNGS may send information about products, news, offers and promotions by email or other electronic means.
These communications may be managed through Connectif and adapted according to the user’s preferences or interactions with the shop.
Where a prior commercial relationship exists, ZiNGS may send information about its own products that are similar to those previously purchased, provided this is permitted by law and customers are offered a simple way to object.
Lawful basis: the data subject’s consent or, where legally applicable, the existing commercial relationship.
Users may unsubscribe at any time using the link included in each communication or by writing to info@zings.es.
4.8. Abandoned baskets
Where users have provided their email address and an appropriate lawful basis exists, ZiNGS may send reminders about products remaining in their basket.
Lawful basis: the data subject’s consent.
4.9. Analytics, advertising and measurement
With the user’s consent, ZiNGS may use Google Analytics, Google Ads, Meta Pixel and similar technologies to measure use of the website, analyse campaign performance, create audiences and display advertising adapted to the user’s interests.
Lawful basis: consent given through the cookie settings panel.
Users may withdraw or change their consent at any time through the cookie settings tool available on the website.
4.10. Reviews published on Google
Users may voluntarily publish reviews about ZiNGS on Google. These reviews may include the name, alias, photograph and content that the user has chosen to make public according to their account settings.
ZiNGS may view and respond to these reviews to assist customers, manage its commercial reputation and improve its products and services.
Google acts as the data controller for information published through its services in accordance with its own terms and Privacy Policy.
Lawful basis for processing by ZiNGS: legitimate interests in assisting customers and managing its commercial reputation.
4.11. Security and prevention of misuse
ZiNGS may process certain technical data, such as IP addresses, access logs and device information, to protect the website, prevent unauthorised access, detect fraudulent activity and prevent automated or abusive form submissions.
Google reCAPTCHA is used for this purpose. When a protected form is loaded or used, certain technical data may be disclosed to Google to determine whether the interaction was performed by a person or an automated system.
Further information is available in Google’s Privacy Policy and Terms of Service.
Lawful basis: ZiNGS’ legitimate interests in ensuring the security of the website and its forms.
The use of cookies or non-essential technologies associated with these services will be subject to the user’s consent.
4.12. Video surveillance in the physical shop
The ZiNGS physical shop has video surveillance cameras to protect people, property and the premises.
The cameras are limited to areas necessary for this purpose. They are not used to record private areas or, except for the minimum area essential to monitor entrances, public spaces.
Lawful basis: performance of a task carried out in the public interest, pursuant to Article 6(1)(e) of the GDPR and Article 22 of Spanish Organic Law 3/2018.
Images may be disclosed to law enforcement agencies, courts, tribunals or other competent authorities where necessary to investigate an incident or comply with a legal obligation.
Images will be deleted within a maximum of one month from the date of recording, unless they must be retained to provide evidence of events affecting the integrity of people, property or premises or made available to the competent authorities.
4.13. Compliance with legal obligations
Certain data will be processed to comply with tax, accounting, commercial, consumer, data protection and other applicable legal obligations.
Lawful basis: compliance with a legal obligation.
5. Mandatory data
Fields marked as mandatory are required to provide the requested service or process a purchase. If users do not provide this information, ZiNGS may be unable to create the account, process the order, arrange delivery or respond to the request.
Data used exclusively for marketing, analytics or advertising purposes are optional and require the relevant consent, except where otherwise expressly permitted by law.
6. Recipients and service providers
ZiNGS does not sell personal data. Data may be disclosed to the following recipients or providers where necessary:
- Payment providers: Redsys, Bizum, PayPal and financial institutions.
- Shipping companies: Correos, Correos Express and GLS Spain.
- Hosting and email provider: Gigas.
- Marketing automation platform: Connectif.
- IT support provider: the professional responsible for maintenance and technical support, who may access data only where necessary to provide these services.
- Analytics, advertising, security and review services: Google.
- Advertising and communication services: Meta and WhatsApp.
- Security and video surveillance providers: where their involvement is necessary to maintain or operate the system.
- Public authorities, law enforcement agencies, courts and tribunals: where required by law or necessary to investigate an incident.
Depending on the service provided, these providers may act as processors on behalf of ZiNGS or as independent controllers applying their own terms and privacy policies.
7. International data transfers
Some technology providers may process personal data outside the European Economic Area or allow it to be accessed from other countries.
Google Ireland Limited, Meta Platforms Ireland Limited and WhatsApp Ireland Limited may use companies within their respective groups or providers located outside the European Economic Area.
Where recipients established in the United States participate in the EU-US Data Privacy Framework, transfers may be based on the relevant European Commission adequacy decision. In other cases, providers must use European Commission standard contractual clauses or other safeguards recognised under the GDPR.
PayPal provides its services in the European Economic Area through PayPal (Europe) S.à r.l. et Cie, S.C.A., based in Luxembourg. Where PayPal transfers data internationally within its group or to other recipients, it may use binding corporate rules, adequacy decisions, standard contractual clauses or other legally recognised mechanisms.
Further information about these transfers and safeguards is available in the privacy policies of Google, Meta, WhatsApp and PayPal.
8. Retention periods
- Orders, payments and invoices: for the duration of the contractual relationship and subsequently for the periods required by tax, commercial, consumer and other applicable legislation.
- Enquiries and communications: for up to 12 months after resolution, unless they must be retained for longer because of a complaint or legal obligation.
- Customer account: while the account remains active and, after cancellation, for the periods necessary to deal with potential liabilities.
- Marketing communications: until the user withdraws consent, unsubscribes or objects to processing.
- Abandoned baskets: for a maximum of 30 days.
- Personalisation data: for the time necessary to produce and deliver the order and deal with any incidents, returns, warranties or complaints.
- Analytics and advertising data: for the periods stated in the Cookie Policy or until the user withdraws consent.
- Technical and security logs: for the time necessary to detect, investigate and resolve incidents and in accordance with the retention settings used by the technology providers.
- Video surveillance: for a maximum of one month from recording, unless the images must be retained due to an incident or made available to the competent authorities.
- Reviews published on Google: for the period determined by Google or until the user changes or removes them, without prejudice to any responses published by ZiNGS.
Once these periods have ended, the data will be deleted or kept blocked only for as long as necessary to deal with potential legal liabilities.
9. Automated decision-making and profiling
ZiNGS does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.
Subject to the relevant consent, basic marketing profiles may be created from purchases, products viewed or interactions with communications to personalise recommendations and campaigns.
Payment providers may apply their own automated fraud prevention systems in accordance with their terms and privacy policies.
10. Children
The website and its services are not specifically directed at children. Children under the age of 14 must not provide personal data without the authorisation of their parents, guardians or legal representatives.
If ZiNGS becomes aware that a child’s data have been collected without the necessary authorisation, it will take reasonable steps to delete them.
11. Data subject rights
Users may exercise the following rights:
- Access: to obtain information about the personal data processed by ZiNGS.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request the deletion of data where applicable.
- Objection: to request that certain processing activities cease.
- Restriction: to request that processing be restricted in certain circumstances.
- Data portability: to receive data in a structured format or request its transmission to another controller where applicable.
- Withdrawal of consent: to withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
To exercise these rights, users may contact:
- Email: info@zings.es
- Postal address: ZiNGS, Calle de Alcalá, 231, 28028 Madrid, Spain.
The request must identify the right that the user wishes to exercise. Where necessary to verify the applicant’s identity, ZiNGS may request additional information.
If users believe that their data have not been processed correctly, they may lodge a complaint with the Spanish Data Protection Agency.
12. Data security
ZiNGS implements appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access, disclosure or destruction.
The IT support provider’s access to personal data will be limited to cases where it is necessary to provide support, maintain the shop or resolve technical incidents, and will be subject to confidentiality and data protection obligations.
However, no system connected to the internet can guarantee absolute security. Users must also protect their credentials and notify ZiNGS of any unauthorised use of their account.
13. Cookie Policy
Information about the cookies and similar technologies used by ZiNGS, their providers, purposes and duration is set out in the Cookie Policy.
Users may accept, reject or configure non-essential cookies through the settings panel available on the website.
14. Changes to this policy
ZiNGS may update this Privacy Policy to reflect legal or technical changes or changes to the services provided.
Where changes are significant, users will be informed through the website or by other appropriate means. The date of the latest update will appear at the beginning of this page.
15. Contact
For any enquiry concerning this Privacy Policy or the processing of personal data, please write to info@zings.es.