Last updated: 23 October 2026
This policy explains which personal data we process when you use ecom-addons.com, why, for how long and what rights you have. It is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Data controller
- Controller: Oriol Martí Collell
- Tax ID (NIF): 45859450H
- Address: C/ Sant Valentí, 2, 4-2, 08221 Terrassa (Barcelona), Spain
- Contact: hello@ecom-addons.com
We have not appointed a data protection officer because we are not required to. For any privacy question, write to the address above.
What data we process and why
Customer account
You need an account to buy, download products and ask for support. We process your email address and password (handled by Amazon Cognito; we never see it) and, if you fill them in on your profile, your name, company, VAT ID, country and language. If you sign in with Google, Google tells us your email address and confirms it is verified; we receive no password and nothing else from your Google account.
Legal basis: performance of the contract (art. 6(1)(b) GDPR).
Purchases, licences and invoicing
We record your orders, the products bought, the amount, the licence keys and the date until which you get updates. Payments are processed by Stripe: you enter your card details directly with Stripe and we have no access to them. Stripe sends us the payment result and your billing details (name, address and VAT ID) so we can issue the invoice and calculate VAT.
Legal basis: performance of the contract (art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (art. 6(1)(c) GDPR). Stripe also processes data to prevent fraud as an independent controller; see its privacy policy.
Support
We keep the support tickets you open from your account, with the messages and any data you include in them.
Legal basis: performance of the contract (art. 6(1)(b) GDPR).
Reviews
If you post a product review, it is shown publicly with the rating, the text and your profile name (or, if you have no name, the part of your email address before the @). You can delete it at any time.
Legal basis: your consent when you post it (art. 6(1)(a) GDPR).
Newsletter
If you subscribe, we keep your email address, language and subscription status (pending, confirmed or unsubscribed). We use double opt-in: we only send you the newsletter after you confirm from the email we send you. Every issue includes an unsubscribe link.
Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.
Service emails
We send you emails needed for the service: order confirmations, support replies and notices about your licences. We record whether an email bounces or is marked as spam so we stop sending to addresses that do not work.
Legal basis: performance of the contract (art. 6(1)(b) GDPR) and our legitimate interest in keeping email deliverable (art. 6(1)(f) GDPR).
Web analytics
Only if you accept it in the cookie banner, we use Google Analytics 4 to get usage statistics for the website: pages visited, where visits come from, device type and approximate location. We have turned off Google signals and ad personalisation. Details are in the cookie policy.
Legal basis: your consent (art. 6(1)(a) GDPR and art. 22(2) LSSI-CE).
Security
Our servers log technical data about requests (IP address, date, page requested) to detect abuse and fix errors.
Legal basis: our legitimate interest in protecting the service (art. 6(1)(f) GDPR).
How long we keep data
- Account and profile: while the account is active. If you ask us to delete it, we do so, except for data we must keep by law.
- Orders and invoices: for the periods required by tax and commercial law (up to 6 years, art. 30 of the Spanish Commercial Code).
- Support tickets: while the account is active.
- Reviews: until you delete them or your account.
- Newsletter: until you unsubscribe. After that we keep only your email address marked as “unsubscribed” so we never write to you again.
- Google Analytics: 14 months at most.
- Technical logs: 12 months at most.
Recipients and processors
We do not sell your data or share it with third parties unless required by law (for example, to the Spanish tax authorities). To provide the service we use these providers, which process data on our instructions:
| Provider | Purpose | Data location |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, sign-in (Cognito) and email delivery (SES) | European Union (Ireland) |
| Stripe Payments Europe, Ltd. | Payments, invoices and tax calculation | EU, with possible transfers to the US |
| Google Ireland Limited | Sign-in with Google (only if you use it) and web analytics (only with your consent) | EU, with possible transfers to the US |
When a provider transfers data outside the European Economic Area, it does so under the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting the lawfulness of earlier processing. Write to hello@ecom-addons.com from your account’s email address, or tell us how to identify you. We will reply within one month.
You can correct your profile details directly from your account.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country.
Minors
The website is aimed at professionals and online stores. We do not allow anyone under 14 to create an account.
Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), encryption of stored data, restricted access and passwords handled by a specialised provider.
Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will let you know by email.