1. Who processes your data
TrophyLand handcrafts replicas of hunting trophies, estates, scenes, pets and other custom pieces. We are the controller of the personal data processed on this site, on the order form, on each order's tracking page and on our internal management platform.
Data controller:
- Owner: TrophyLand
- Email: facturacion@trophyland.es
2. Customers have no account
As a customer you have no username or password with TrophyLand, and there is no way to sign up. You never need an account to order, pay or follow your order: you follow it with a private link we send you (section 5).
The management platform (the pages under /admin) is only for:
- The TrophyLand team (administration, finance and logistics).
- External suppliers (design, manufacturing, painting) we invite by email.
If someone who has not been invited tries to sign in, we send them no access code. If they try with their Google account, we end the session straight away without giving access to any data; the sign-in service may keep the name and email of that attempt, which we delete on request.
3. What data we process
If you only browse the site:
- Nothing that identifies you. We use no analytics, advertising or tracking pixels.
- The technical server logs every visit produces (IP address, browser, page requested), needed to serve the site and fix errors.
If you contact us by WhatsApp, email or phone:
- Whatever you tell us: name, number or email, the piece you want, photos or videos.
- The product customiser and the contact form send us nothing: they prepare a WhatsApp message on your device, which only reaches us if you send it.
When you place an order (form, online store or with our team):
- Name, email address and phone number.
- Shipping address (street, postcode, city, province and country).
- If you order for a company, club or hunting estate: company name, tax ID and billing details.
- The products, sizes, texts, colours and customisation instructions, and your comments.
- Files you send us (photos, videos, logos or PDFs), which may contain personal data if you choose.
- Your quote reference, if we gave you one.
While the order is in progress:
- The design proposals and photos of the finished piece we show you.
- Your approvals, rejections and comments on them.
- The carrier, tracking number and the delivery events it reports.
- Payments and, if requested, your invoice.
If you buy from our online store (Shopify), we import the order details (name, email, phone, addresses and notes) to manage it like any other order.
If you are on the team or an invited supplier:
- Name, email, role and date of last access.
- For suppliers, also: contact person, phone, tax ID, pickup address and billing details.
- The files, notes and charges you record on the platform.
To stop spam on the order form we store a salted hash of your IP address, never the IP itself.
We do not make automated decisions or build profiles about you.
4. Why we use it and on what legal basis
- To answer your enquiries and prepare a quote. Legal basis: pre-contractual steps at your request (Art. 6.1.b GDPR).
- To manage your order end to end (design, approvals, manufacturing, shipping, delivery and incidents) and contact you about it. Legal basis: performance of the contract (Art. 6.1.b GDPR).
- To issue invoices and keep accounts. Legal basis: tax and commercial law obligations (Art. 6.1.c GDPR).
- To protect the form and the platform from spam, abuse and unauthorised access. Legal basis: our legitimate interest in a secure service (Art. 6.1.f GDPR).
- To give the team and suppliers platform access and coordinate production with them. Legal basis: our employment or contractual relationship with them (Art. 6.1.b GDPR).
The checkbox on the order form confirms you have read this notice. We need your data to make your order and cannot prepare it without it.
We only write to you about your orders. We send no marketing.
5. Your tracking link
Every order has a tracking page at a unique, private address (for example /seguimiento/…). We give it to you when the order is confirmed and include it in our emails. It works like a key: it asks for no username or password, because you have no account.
Anyone with the link can see:
- The order number and your name (or your company or club's name).
- The products, quantities and customisation texts.
- The order status and expected or actual dates.
- Design proposals, photos of the finished piece and review comments.
- The carrier, tracking number and delivery history.
The link can also be used to approve or reject a design and to confirm the order has arrived.
The page never shows your email, phone number, address, prices or our internal notes.
How we protect the link:
- It is a random 122-bit identifier that cannot realistically be guessed.
- We ask search engines not to index it and leave it out of the sitemap.
- Browsers do not pass it on to other sites (no-referrer).
- Files are served through temporary links that expire within minutes and are not cached.
The link does not expire while the order exists, so treat it like a password and share it only with people who should see or decide on the order. If you shared it by mistake, email us at facturacion@trophyland.es and we will look into it with you.
Actions taken through the link (approving, rejecting, confirming receipt) are logged with their date on your order.
The order form (/formulario) shows nobody's data: it only collects what you type. File uploads use a temporary session that expires after 2 hours and sets no cookies.
6. Who we share your data with
We do not sell or rent your data. We only share it, as far as needed, with:
- Our production suppliers (design, manufacturing, painting): they receive products, customisation and files. They do not see your name, email or phone. A supplier gets the shipping address only if it ships the order to you directly.
- Carriers (such as Correos or SEUR), with the shipping details. To check a shipment we only send them the tracking number.
- The technology providers that run the service for us as data processors: web hosting, database and platform sign-in (Neon), file storage and email delivery.
- WhatsApp (Meta), if you choose to message us there, under its own privacy policy.
- Shopify, if you buy from our online store, under its own policy. Some product photos load from its servers, which receive the technical IP address needed to deliver them.
- Google, only for team members and suppliers who sign in with their Google account.
- Public authorities or courts, where the law requires it.
7. International transfers
Some technology providers may process data outside the European Economic Area. We only use those offering GDPR safeguards, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask us for details at facturacion@trophyland.es.
8. How long we keep it
- Enquiries and quotes that never become an order: while the conversation lasts and at most one year after.
- Orders, their data and files: while the relationship lasts, and afterwards as long as needed to handle claims or warranties.
- Invoices and accounting records: for the periods Spanish tax and commercial law require (generally 4 years under the General Tax Law and 6 under the Commercial Code).
- Files uploaded to the form that never become part of an order: deleted automatically after 24 hours.
- Team and supplier access: for as long as we work together. Afterwards it is deactivated and only data linked to orders or invoices is kept.
Once data is no longer needed, it is deleted or anonymised.
10. Security
We apply technical and organisational measures appropriate to the risk:
- Encrypted connections (HTTPS).
- Invitation-only, role-based platform access: nobody can sign up and each person sees only what they need.
- Private files served through temporary links.
- Encrypted integration credentials.
- A log of changes to orders.
No system is infallible. If we detect a breach that affects you, we will act as the GDPR requires.
11. Your rights
You can exercise these rights free of charge:
- Access: find out what data we hold about you.
- Rectification: correct it.
- Erasure: have it deleted.
- Objection and restriction of processing.
- Portability: receive your data in a structured format.
Since you have no account, email us at facturacion@trophyland.es saying which right you want to exercise and your order number or the email you contacted us with. We may ask you to verify your identity. We will reply within one month.
Some data cannot be deleted while the law requires us to keep it, such as invoices.
If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
12. Minors
Orders must be placed by people aged 18 or over or otherwise able to enter into contracts. If a piece is for a minor, the responsible adult or organisation must place the order.
If you give us other people's names or photos for a piece, you confirm you are entitled to do so and have informed them.
13. Changes to this policy
We may update this policy if our services or the law change. The date above shows the latest version. If a change is significant and you have an order in progress, we will tell you.
14. Contact
For any privacy question, email us at facturacion@trophyland.es.