Privacy policy
Last updated:
1. Data controller
- Controller: Eloy Pastor Tomás.
- Tax ID: 44636737Q.
- Address: Calle Holanda 2, oficina 4, 28971 Griñón (Madrid), España.
- Contact: info@groundtactical.com.
2. Data we process
Customer account
Your name, email address and verification status. If you sign in with Google, we also receive your Google account identifier and profile picture. We never receive your password, whether for Google or your own account.
Orders and delivery
Phone number, tax identification number, company name for business purchases, and shipping and billing details: recipient, phone, address, postcode, city and province or region.
Purchase
Products, amounts, order numbers and invoices. We do not store card details: you enter them directly into Stripe's form and we only receive payment confirmation.
Communications
The destination address and status of emails we send, to evidence delivery attempts and resend failed messages, plus the content of your emails to us.
Preferences
Saved fields and products, price-drop or restock alerts you enable and, if you share your Locker, its random public-link identifier. That link shows only saved products, never your name, email or account details, and can be disabled at any time.
Session
When you sign in, we store your IP address and browser alongside the session token to detect unauthorised access. This is deleted when the session expires.
We separately retain sign-in dates to show access counts and the last sign-in in internal account management, without copying the IP address or browser into that record.
Site usage
If you are signed in and accept analytics, we save viewed products, view counts and dates in your account. Our team can see this information and your favourite fields in the administration area. Rejecting analytics stops new view records. These records are deleted when your account is deleted.
Cloudflare provides general visit and performance statistics without cookies or identifying you. If you accept analytics cookies, Google Analytics provides more detailed information to improve the shop, including viewed products, checkout steps and confirmed order amounts. If you accept optional cookies and the Meta integration is enabled, we send visits, products, checkout steps, technical issues and confirmed purchases through its Conversions API. Meta receives browser and, when applicable, ad-click identifiers and browser type to measure and optimise campaigns. We do not send your name, email, address, card details or private payment links in these events. This data is not anonymous: Meta may associate it with information it already holds about you.
3. Purposes and legal bases
- Processing orders, shipping and warranty claims — performance of the contract.
- Issuing and retaining invoices — legal obligation under tax rules.
- Maintaining your account and basket — performance of the contract at your request.
- Saving your Locker, favourites and shared link — providing your account features. Price and restock alerts are sent only with your consent and stop when you disable them.
- Responding to enquiries and suggestions — legitimate interest in responding to people who contact us.
- Collecting general statistics and monitoring performance — legitimate interest in maintaining and improving the site without individual profiling.
- Analysing site use in more detail — your consent, which you may give, refuse or withdraw at any time through “Cookie settings” in the footer.
- Measuring and optimising Facebook and Instagram advertising — consent to optional analytics and advertising cookies. Refusal does not prevent purchases. Withdraw consent through “Cookie settings”.
- Protecting accounts and detecting unauthorised access — legitimate interest in the security of the shop and your account.
4. Other parties processing your data
We work with providers that process data on our behalf, under contract and following our instructions:
- Stripe Payments Europe, Ltd. (Ireland) — payment processing. Its card form loads in your browser at checkout; card data goes directly to Stripe without passing through us. Stripe also processes data independently to prevent fraud and fulfil its obligations as a payment institution. Privacy policy .
- Our transactional email provider — sends order emails and receives your email address and message content.
- Our infrastructure providers, including Google and Cloudflare — host the application, database and product images, protect against abuse and provide general performance statistics. They physically store the data described here.
- Google Ireland Limited — only if you choose Google sign-in or accept Google Analytics. For sign-in, Google confirms your identity; for analytics, it receives the usage data described in section 2. Both are optional and analytics stays disabled until you accept it. We do not use Analytics for advertising. Privacy policy .
- Sendcloud B.V. (Netherlands) — the platform we use to prepare shipments, calculate delivery options and generate labels. It receives your name, delivery address and contact details. Privacy policy .
- The carrier that delivers your order receives the data necessary for delivery. It acts through Sendcloud as a subprocessor and depends on the delivery option you choose at checkout.
Some providers are established outside the European Economic Area, in the United States. Transfers rely on the adequacy decision for the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.
The two providers described by their role rather than name are technical services we may change without changing the data processed or its purposes. To learn their current identities, contact info@groundtactical.com and we will tell you.
Meta Platforms Ireland Limited receives the advertising events described only with your consent, when this integration is enabled. Meta also processes them for its own purposes under its privacy policy. Collection and transmission are governed by the Meta joint controller addendum. You may exercise your rights with us or Meta. We do not sell your data.
5. Retention periods
- Locker, favourites and alerts: until you delete them or close your account. Shared links become inaccessible as soon as you disable them.
- Invoices and sales data: for the periods required by tax and commercial law, which require retention for several years.
- Documentation of earlier transactions: documents subject to statutory retention are kept for the applicable period even if the product is no longer sold.
- Customer account: while you keep it open. On closure, we delete information we are not legally required to retain.
- Support emails: for the time needed to resolve the matter and document communications.
6. If you do not provide some information
Contact and delivery details are necessary to sell and deliver your order. Without them, we cannot process it. You may provide a tax identification number for billing; it is not required for consumers buying from the current catalogue.
Other information is optional. Google sign-in is a convenience, not a requirement.
7. Children
The shop is intended for adults. If you are a parent or guardian and believe we have processed a child's data, contact info@groundtactical.com and we will delete it.
8. Your rights
You may exercise your rights under the General Data Protection Regulation : access, rectification, erasure, objection, restriction, portability and the right not to be subject to automated decisions.
Contact info@groundtactical.com and state the right you wish to exercise. We will respond within the statutory one-month period. We may ask you to verify your identity before providing account information.
If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency .