Last updated: 30 September 2026
This translation is provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.
At Rekire we process your personal data transparently and only for what we need. This policy explains what data we process, for what purposes, on what legal basis, for how long and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
1. Data controller
| Controller | Achegatec S.L. (trading as Rekire) |
|---|---|
| Tax ID (NIF) | B27340801 |
| Address | Rúa Galegos, nº 6, bajo — 27003 Lugo (Spain) |
| Privacy contact | info@rekire.com |
| Data protection officer | Rekire is not required to appoint one and has not done so. You may address any query to the contact above. |
2. Data we process
- Identification and contact data: first name, surname, company, email address, telephone number and postal address.
- Billing data: tax ID or VAT number and tax details.
- Data on your purchases and services: orders, products, licences and registered domains, subscriptions and support history.
- Payment data: payment method and transaction status. Full card details are processed directly by the payment providers; Rekire neither sees nor stores them.
- Data from your communications: the content of the messages you send us via forms, email, chat or WhatsApp.
- Browsing data: IP address, device and browser type, pages visited and data obtained through cookies, as explained in the Cookie policy.
- Data from your Google account, if you choose to sign in with it: name, email address and profile picture.
We do not process special categories of data. Mandatory form fields are marked as such; if you do not complete them, we will be unable to deal with your request or process your order.
3. Purposes, legal basis and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Creating and managing your customer account | Performance of a contract (Art. 6(1)(b) GDPR) | For as long as you keep the account |
| Processing orders and payments, delivering downloads and licences, managing subscriptions and invoicing | Performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR) | For the duration of the contractual relationship and, thereafter, blocked for the statutory periods: 6 years (Spanish Commercial Code) and 4 years (tax legislation) |
| Providing the contracted services (hosting, maintenance, support and development) | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the service and the subsequent statutory periods |
| Responding to enquiries and quotation requests received via form, email, telephone, chat or WhatsApp | Taking pre-contractual steps at your request and consent (Art. 6(1)(b) and (a) GDPR) | One year from the last communication, unless a contractual relationship is entered into |
| Notifying the Rekire team internally of shop activity (sign-ups, baskets, orders and contact messages) so that we can assist you promptly | Legitimate interest in sales and after-sales service (Art. 6(1)(f) GDPR) | For the time strictly necessary to handle the notification |
| Sending you commercial communications and newsletters | Consent; if you are already a customer, legitimate interest in relation to similar products (Art. 21.2 LSSI-CE) | Until you unsubscribe or withdraw your consent |
| Analysing use of the website and, on the basis of your browsing, building a commercial profile in order to personalise content and communications | Consent (Art. 6(1)(a) GDPR), given through the cookie panel | As set out in the Cookie policy |
| Ensuring the security of the website, protecting forms against abuse and preventing payment fraud | Legitimate interest (Art. 6(1)(f) GDPR) | For the time necessary for that purpose |
| Allowing you to sign in with your Google account | Consent (Art. 6(1)(a) GDPR) | Until you unlink the account or request its deletion |
| Publishing your comments on the blog | Consent (Art. 6(1)(a) GDPR) | Until you request their removal |
| Complying with legal obligations and handling claims | Legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR) | Until the corresponding legal actions become time-barred |
We do not take decisions based solely on automated processing that produce legal effects concerning you.
4. Commercial communications
We will only send you commercial communications if you have given us your consent or if you are a customer and they relate to products or services similar to those you purchased; in the latter case, we give you the opportunity to object at the time your data is collected. Each communication contains a link allowing you to unsubscribe easily and free of charge; you can also unsubscribe by writing to info@rekire.com.
5. Recipients and providers
We do not sell your data. We only disclose it to third parties where this is necessary to provide the service or is required by law. Depending on the case, these providers act as processors, under a contract in accordance with Article 28 GDPR, or as independent controllers of their own processing (payment providers, Google for sign-in and reCAPTCHA, and Meta for WhatsApp):
| Provider | Service | Location |
|---|---|---|
| Nicalia Internet | Website and email hosting | Spain (EU) |
| Stripe Payments Europe Ltd. | Card payments and fraud prevention | Ireland (EU) |
| Redsys and Rekire’s bank | Card payments via virtual POS terminal and direct debits | Spain (EU) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | PayPal payments | Luxembourg (EU) |
| Google Ireland Limited | Google Analytics, Google Tag Manager, reCAPTCHA and Sign in with Google | Ireland (EU) |
| Connectif | Marketing automation and newsletter delivery (currently inactive) | Spain (EU) |
| PrestaShop SA | Technical services for the e-commerce platform | France (EU) |
| Meta Platforms Ireland Ltd. (WhatsApp) | Messaging, if you choose to contact us via WhatsApp | Ireland (EU) |
| Telegram | Internal messaging for notifications to the Rekire team | Outside the European Economic Area |
We may also disclose data to the Spanish Tax Agency (Agencia Tributaria), to banks, to professional advisers bound by a duty of confidentiality and to judges, courts and authorities where there is a legal obligation to do so.
6. International transfers
Some providers may process data outside the European Economic Area. Transfers to the United States to companies certified under the EU-U.S. Data Privacy Framework (Google, Stripe, PayPal and Meta) are covered by the European Commission’s adequacy decision of 10 July 2023. In all other cases, they are carried out with the safeguards provided for in Chapter V of the GDPR, such as the standard contractual clauses adopted by the European Commission. You can request further information from us at info@rekire.com.
7. Your rights
You may exercise the following rights at any time, free of charge:
- Access: to find out whether we process your data and obtain a copy.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to ask us to delete your data when it is no longer necessary.
- Objection: to object to processing based on legitimate interest and, in any event, to receiving commercial communications.
- Restriction: to ask us to suspend processing in certain circumstances.
- Portability: to receive your data in a structured, commonly used format, or to have it transmitted to another controller.
- Withdrawal of consent, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to info@rekire.com or send a letter to our address stating the right you wish to exercise. If we have reasonable doubts as to your identity, we may ask you for additional information to confirm it. We will respond within one month, which may be extended in the cases provided for in the GDPR.
If you consider that we have not properly dealt with your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es).
8. Minors
Children under 14 may not provide us with personal data without the consent of their parents or guardians. You must be over 18 to purchase from the shop.
9. Data security and accuracy
We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encryption of communications via HTTPS and access control to our systems. Should a security breach occur, we will notify the Spanish Data Protection Agency (Agencia Española de Protección de Datos) where required by law and, if it is likely to result in a high risk to your rights, we will inform you without undue delay.
Please keep your data up to date. If you provide us with data relating to third parties, you warrant that you have informed them and that you have a legitimate basis for providing it to us.
10. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. We will always publish the current version on this page, together with the date it was last updated, and will inform you of any significant changes through our usual channels.
