Privacy Policy

1. Who we are

This Privacy Policy applies to the website spaininternet.net, operated by Spain Internet, located at Calle Rosalía de Castro 29, Bajo, 36001 Pontevedra, Spain.

We are the data controller of the personal information you provide when you use our website, place an order, or contact us.

If you have any questions about this policy or want to exercise your rights, please contact us at support@spaininternet.net.

No Data Protection Officer (DPO) has been appointed because our processing activities do not legally require one. Privacy questions are handled directly by the team via the contact email above.

2. What personal data we collect

We collect the following categories of personal data:

Account & order data: name, email address, phone number, delivery address, dates and product chosen, order number. Provided by you when placing an order or registering.

Payment data: processed directly by our payment provider (Stripe or PayPal). We do not store your full card number — only the last four digits and a non-reversible token used for refunds and fraud prevention.

Technical data: IP address, browser type, device type, language, pages visited, referrer URL. Collected automatically via server logs and (with your consent) Google Analytics.

Support data: the content of any email, chat or contact-form message you send us, plus your email address and any details you choose to share.

Cookies and similar technologies: see our Cookie Policy for the full list and how to manage them.

3. Why we use your data (purposes and lawful basis)

We process your personal data for the following purposes, each with a specific lawful basis under the EU General Data Protection Regulation (GDPR, Article 6):

To fulfil your order (delivering WiFi, SIM or eSIM, customer support, refunds, returns) — lawful basis: performance of a contract (Art. 6(1)(b)).

To comply with tax and accounting law (storing invoices and order records for the legally required period) — lawful basis: legal obligation (Art. 6(1)(c), Spanish General Tax Law).

To prevent fraud and secure our services (Stripe risk scoring, IP-based blocking of abusive traffic) — lawful basis: legitimate interest (Art. 6(1)(f)).

To improve the website (analytics, A/B testing) — lawful basis: your consent (Art. 6(1)(a)), via the cookie banner.

To send marketing or service emails (occasional newsletters, return reminders) — lawful basis: your consent (Art. 6(1)(a)) for marketing; performance of contract for transactional emails (delivery confirmations, return reminders).

4. Who we share your data with

We never sell your data. We share it only with the following processors, each of which provides a service essential to operating the website:

• Stripe Payments Europe Ltd (Ireland) — payment processing.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — payment processing.
• Google LLC (United States) — Google Analytics 4 and Google Ads (only with your analytics/marketing consent).
• Tidio LLC (United States) — live chat (only loaded with your marketing consent).
• Resend, Inc. (United States) — transactional and marketing email delivery.
• Mailgun Technologies, Inc. (United States) — fallback email delivery.
• A2 Hosting B.V. (Netherlands) — website hosting.
• MRW and Correos (Spain) — physical delivery and returns of WiFi devices and SIM cards.
• Vodafone España S.A.U. (Spain) — mobile network operator providing connectivity for our SIM cards and eSIMs.

We may also disclose data when required by Spanish or EU law (court order, criminal investigation), but only to the extent strictly necessary.

5. International data transfers

Some of our processors are located outside the European Economic Area (EEA), in particular in the United States (Google, Stripe, Tidio, Resend, Mailgun).

Where a transfer to a third country is necessary, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, on the EU–US Data Privacy Framework. Each US processor has contractually committed to GDPR-equivalent safeguards.

You have the right to obtain a copy of the safeguards we apply by emailing support@spaininternet.net.

6. How long we keep your data

We keep your personal data only for as long as necessary for the purposes described above, and at most for the periods below:

• Order records and invoices: 6 years (Spanish General Tax Law / Commercial Code).
• Account data: until you request deletion or your account is inactive for 5 years.
• Customer support emails: 3 years from the last contact.
• Marketing consent: until you withdraw it.
• Analytics data (Google Analytics 4): 26 months by default.
• Cookie consent record: 24 months (after which we re-prompt you).
• Server access logs: 90 days.

After the retention period, data is either deleted or anonymised so it can no longer identify you.

7. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) — to receive a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — to have inaccurate data corrected.
• Right to erasure / "right to be forgotten" (Art. 17) — to have your data deleted, subject to legal retention obligations.
• Right to restriction of processing (Art. 18) — to ask us to limit how we use your data while a complaint is being investigated.
• Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format and have it transmitted to another controller.
• Right to object (Art. 21) — including the right to opt out of marketing emails at any time.
• Right to withdraw consent (Art. 7(3)) — at any time, by clicking "Manage cookies" in the footer or by emailing us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making (Art. 22) — we do not use automated decision-making or profiling that produces legal effects on you.

To exercise any of these rights, email support@spaininternet.net. We will respond within 30 days. We may ask you to verify your identity before fulfilling the request.

8. Children's data

Our services are aimed at adults travelling to Spain. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. How we protect your data

We apply industry-standard security measures, including:

• HTTPS encryption on every page.
• Encrypted storage of databases and backups.
• Card payments handled directly by Stripe and PayPal under the PCI-DSS standard — we never see your full card number.
• Limited access to personal data on a need-to-know basis for staff.
• Regular software updates and security audits.

No system is 100% secure. In the unlikely event of a personal data breach affecting your rights, we will notify the AEPD within 72 hours and inform you directly when required.

10. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add a new processor, when the law changes, or when we improve our practices. The "Last updated" date at the top of the page indicates the most recent revision.

If the change is material (e.g. a new category of data or a new purpose), we will notify you by email or by re-prompting you on the website.

11. Right to lodge a complaint with AEPD

If you believe that we have processed your personal data unlawfully, you have the right to lodge a complaint with the Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
Website: www.aepd.es
Phone: 901 100 099 / +34 91 266 35 17

We would, however, appreciate the chance to address your concerns first — please contact us at support@spaininternet.net before filing a complaint.

12. Contact us

For any privacy-related question or to exercise any of the rights above, contact:

Spain Internet
Calle Rosalía de Castro 29, Bajo
36001 Pontevedra, Spain
Email: support@spaininternet.net
Phone: +34 986 596 655