Privacy Policy

Introduction

At BRASI, we respect and protect the privacy of our users and customers. This Privacy Policy document sets out the terms under which BRASI uses and protects the personal information you provide when using our website. We are committed to ensuring the security of your data and handling your information in accordance with applicable laws, including the EU General Data Protection Regulation (GDPR) and other current privacy regulations.

Information Collected

When you interact with our website, we may collect different types of personal information, including:

  • Personally Identifiable Information: Name, address, email address, phone number, and other similar data.
  • Demographic Information: Age, gender, preferences, and interests.
  • Payment and Billing Data: Information required to process payments and issue invoices.
  • Browsing Data: Information about your use of the website, such as IP address, browser type, access time, and pages visited, through cookies and similar technologies.

Purposes of Data Processing

The information collected is used for the following purposes:

  • Order Management: Processing and managing your orders, deliveries, and returns.
  • Service Improvement: Optimising the quality of our products and services based on your preferences and purchasing behaviour.
  • Commercial Communications: Sending marketing communications, special offers, and updates on new products that may be of interest to you. You can opt out of receiving these communications at any time.
  • Legal Compliance: Ensuring compliance with our legal and tax obligations.

Legal basis for processing

We process your data under these legal bases:

  • Contract (Art. 6.1.b GDPR): data relating to an order, to prepare it, charge for it, ship it, and manage changes and returns.
  • Legal obligation (Art. 6.1.c): invoices and tax obligations.
  • Consent (Art. 6.1.a): the newsletter and analytics and advertising cookies, including what is sent to Google, Microsoft, and Meta upon purchase. You can withdraw it at any time without affecting previous processing.
  • Legitimate interest (Art. 6.1.f): store security and handling your enquiries.

Information Protection

BRASI is committed to protecting your personal data. We use advanced security measures, including SSL (Secure Sockets Layer) technology to encrypt transmitted information, and keep our systems updated to prevent unauthorised access.

Cookies

We use necessary cookies for the store to function and, only if you accept them, analytics cookies (Google Analytics) and advertising cookies (Google Ads, Microsoft Advertising, and Meta). What cookies are, their purpose, duration, and how to change your choice are detailed in the cookie policy. You can change your mind at any time via the “Cookie Preferences” link in the footer.

Who receives your data

We do not sell your data. Only the providers we need to fulfil your order and maintain the store receive it, each for their specific purpose and under a data processing agreement:

  • Web hosting (SYS4NET, Spain) and the network that protects and speeds it up (Cloudflare).
  • Payment gateways (Stripe and PayPal).
  • Shipping (Packlink and Correos Express).
  • Order emails (Brevo) and customer service emails (Microsoft 365).
  • Backups, encrypted and hosted in the EU (Microsoft Azure).
  • With your consent, Google (Analytics and Google Ads), Microsoft (Microsoft Advertising, Bing ads), and Meta (Facebook and Instagram) for analytics and advertising.

Stripe, PayPal, Cloudflare, Google, Microsoft, and Meta may process data outside the European Economic Area with GDPR safeguards (EU-US Data Privacy Framework or Standard Contractual Clauses). Outside of these cases, we will only disclose your data if required by law or a court order.

Ad Measurement

If you accept advertising cookies, upon purchase we send Meta (Facebook and Instagram) the amount and items purchased, along with your email, phone number, first name, surname, city, postcode, and country encrypted (SHA-256), together with the IP address, browser, and Meta cookies, to determine if the purchase came from an ad. If you accept analytics cookies, we send Google Analytics the amount and items along with your visit identifier. We send nothing you haven’t accepted.

With advertising cookies, upon purchase we also send Google Ads the amount and order number, along with your email, phone number, first name, surname, city, postcode, and country, which Google’s tag encrypts (SHA-256) in your browser before sending them (enhanced conversions), to determine if the purchase came from a Google ad.

And to Microsoft Advertising (Bing ads), the amount, order number, and items, with your email and phone number encrypted in the same way.

With that same permission, Google and Microsoft also receive information about which items you view and add to your cart, to show you ads for those items.

IP and browser data are deleted from our store after 15 days. Amazon and eBay orders are never sent. You can withdraw consent via “Cookie Preferences” in the footer.

Marketplace Purchases (Amazon)

If you purchase a Brasi product on Amazon, Amazon provides us with the name, address, and delivery phone number solely to fulfil your order. We do not use this for anything else and anonymise it 15 days after delivery.

Links to Third-Party Sites

Our website may contain links to third-party websites that may be of interest to you. BRASI is not responsible for the privacy policies and practices of those sites. We recommend reviewing their privacy policies to ensure you agree with them before providing them with personal information.

How long we keep your data

  • Orders and invoices: the period required by tax law (6 years).
  • Addresses for orders placed on Amazon: 15 days after delivery.
  • Newsletter: until you unsubscribe.
  • IP and browser for ad measurement: 15 days.
  • Cookies: the duration for each, as stated in the cookie policy.
  • Backups: 14 days. System access logs: 13 months.

User Rights

Under the GDPR, you have the following rights regarding your personal information:

  • Access: You can request information about the personal data we hold about you.
  • Rectification: You have the right to correct any inaccurate or incomplete data.
  • Erasure: You can request the deletion of your personal data, except in cases where the law requires its retention.
  • Restriction of Processing: You can request the restriction of the processing of your data in certain circumstances.
  • Portability: You have the right to receive your data in a structured and commonly used format.
  • Objection: You can object to the processing of your personal data in certain situations.

To exercise these rights, please write to us from https://brasi.eu/contactenos or contact us directly via our contact page. We will respond to your request as soon as possible, in accordance with the established legal timeframes.

Changes to the Privacy Policy

BRASI reserves the right to modify this Privacy Policy at any time to adapt to new legal, regulatory, or technical requirements. Users are advised to periodically review this policy to stay informed of any changes. Any modifications will take effect upon publication on our website.

Contact

If you have any questions or concerns about this Privacy Policy, or if you wish to exercise any of your rights, please contact us via the contact section on our website.

Supervisory authority

If you believe the processing of your personal data does not comply with regulations, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es), which is the competent supervisory authority. You can also contact us first by emailing hola@brasi.eu: we handle any request regarding your data within the legal timeframe of one month.

Back to top