The Shopsumer Institute | Consulting

Privacy Policy

We take the protection of your personal data seriously. This Privacy Policy explains which personal data we process when you visit theshopsumerinstitute.com or contact us, for what purposes, and what rights you have under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

Controller: The Shopsumer Institute S.L.U.

Address: Paseo Manuel Girona 55, 1º 4ª 08034 Barcelona, Spain

Tax ID (NIF): ESB64437288

Email: info@theshopsumerinstitute.com

2. What data we process, why and on what legal basis

2.1 Visiting the Website (server log files)

When you visit the Website, our hosting provider automatically records technical data sent by your browser: IP address, date and time of access, page visited, referring website, browser type and version, and operating system.

  • Purpose: to deliver the Website and to ensure its security and stability.

  • Legal basis: our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR).

  • Retention: up to 30 days, unless longer storage is needed to investigate a specific security incident.

2.2 Contact form and email

If you contact us through the contact form or by email, we process the data you provide: in particular your name, email address, company, position, phone number (if given) and the content of your message. Fields marked as mandatory are needed to answer your enquiry.

  • Purpose: to handle and answer your enquiry and, where applicable, to prepare an offer or a contract.

  • Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR); for other enquiries, our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR).

  • Retention: for as long as necessary to handle your enquiry and any follow-up, and no longer than 12 months after our last contact, unless a business relationship results from it. After that, the data is blocked for the legal limitation periods (Art. 32 LOPDGDD) and then deleted.

2.3 Embedded Vimeo videos

The Website embeds videos from the platform Vimeo, operated by Vimeo.com, Inc. (USA). The Vimeo player is only loaded after you have given your consent in the cookie banner. When the player loads, your browser connects to Vimeo’s servers and transmits, among other things, your IP address, device information and the page you are visiting. Vimeo may set cookies (see the Cookie Policy).

  • Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI). You can withdraw it at any time via Vimeo cookie settings.

  • Transfer to the USA: Vimeo may process data in the USA. Such transfers are based on the EU-U.S. Data Privacy Framework, where the recipient is certified, or on the EU Standard Contractual Clauses.

  • More information: https://vimeo.com/privacy

2.4 Language selection and technically necessary cookies

We use technically necessary cookies, for example to remember your chosen language. Details are set out in our Cookie Policy. Legal basis: our legitimate interest in providing a functioning multilingual website (Art. 6(1)(f) GDPR, Art. 22.2 LSSI).

2.5 Google Analytics 4 (statistics)

If you accept statistics cookies in our cookie banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies (see the Cookie Policy) to collect information on how visitors use the Website, for example the pages visited, the time spent on them, the referring website, and device and browser information. Google Analytics 4 does not log or store full IP addresses. We only use this information in aggregated form to evaluate the use of the Website.

  • Purpose: to understand how the Website is used and to improve its content and structure.

  • Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI). Google Analytics is only loaded after you have given your consent. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page.

  • Retention: Google Analytics data is deleted automatically after 14 months.

  • Transfer to the USA: Google may process data in the USA. Such transfers are based on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and on the EU Standard Contractual Clauses.

  • More information: https://policies.google.com/privacy

3. Recipients

We do not sell your data. We only share it where necessary with:

  • our hosting provider Arsys, Spain (www.arsys.es), which hosts the Website as a data processor under a data processing agreement (Art. 28 GDPR);

  • WYP.agency, which develops and maintains the Website and may have access to data for that purpose, as a data processor;

  • Google Ireland Limited, as a data processor for Google Analytics, if you have consented to statistics cookies;

  • Vimeo, as an independent controller, if you have consented to loading videos;

  • public authorities, courts or advisers bound by professional secrecy, where required by law.

4. International transfers

In principle, we process your data within the European Economic Area. Transfers to countries outside the EEA (for example the USA when using Vimeo or Google Analytics) only take place on the basis of an adequacy decision of the European Commission or appropriate safeguards such as the EU Standard Contractual Clauses.

5. Your rights

You have the right to:

  • access your personal data (Art. 15 GDPR);

  • have inaccurate data rectified (Art. 16 GDPR);

  • have your data erased (Art. 17 GDPR);

  • restrict processing (Art. 18 GDPR);

  • data portability (Art. 20 GDPR);

  • object to processing based on legitimate interest (Art. 21 GDPR);

  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR).

To exercise your rights, write to info@theshopsumerinstitute.com with the subject “Data protection”. If we have reasonable doubts about your identity, we may ask for proof of identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country of residence.

6. Automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

7. Security

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encrypted transmission (HTTPS) of the Website.

8. Minors

The Website is aimed at business users and not at persons under 14 years of age. We do not knowingly collect data from minors.

9. Changes to this Privacy Policy

We may update this Privacy Policy when our services or the legal requirements change. The version published on the Website applies.

Last updated: 09/11/2026