Privacy policy

Last updated: 7 November 2026.

Data controller

Tres Semillas Gestión, S.L., NIF B09937780, registered address Calle de Bolonia 4, 4º DA, 50008 Zaragoza, España, operates Born Stubborn and is the controller for the processing described here. Contact: admin@tressemillasgestion.com.

Data, purposes and legal bases

We process the identification, contact, billing, delivery and order details you provide to handle purchases, payments, shipments, returns and pre-contract enquiries: performance of a contract or steps prior to entering into a contract. Data required for invoicing, tax obligations and handling the exercise of rights is processed to comply with legal obligations.

We may process technical and security logs strictly necessary to prevent fraud and protect the store, based on our legitimate interest in its security, balanced against your rights. You may object where applicable.

Marketing communications and the use of non-essential analytics or advertising cookies will be based on your consent where required. You can withdraw it at any time without affecting the lawfulness of earlier processing. Non-essential cookies will not be activated before the required consent is obtained. Shopify provides the store's privacy tools and cookie banner. When the banner or cookie preferences link is displayed, you can accept, reject or configure non-essential categories and change your choice later. You can also request help by email. Necessary cookies enable the cart, purchases and security, and remember preferences; analytics cookies, if authorised and enabled, measure usage; advertising cookies, if authorised and enabled, measure campaigns and personalise advertising. Cookies may be session or persistent cookies depending on their purpose and the provider's settings. You can delete or block them in your browser, although some necessary features may stop working.

Recipients

We use Shopify to host the store and manage purchases, payment providers to process payments, and Gelato and its production and delivery providers to prepare and deliver orders. We share only the data needed for each service. We may also disclose data to authorities when required by law. Payment providers process card details under their own terms; do not email us full card numbers.

Shopify may act as a processor or as an independent controller for certain features. See https://www.shopify.com/legal/privacy and https://privacy.shopify.com/ for information about its processing and your rights. If you interact with our Facebook or Instagram pages, Meta processes data from that interaction under its privacy policy: https://www.facebook.com/privacy/policy/. Any advertising or data-sharing features with Meta enabled in the store are subject to the required information and consent. The mere existence of our pages does not mean that all these features are enabled.

International transfers

Some providers may process data outside the European Economic Area. Where applicable, adequacy decisions or safeguards such as the European Commission's standard contractual clauses will be used, together with any necessary supplementary measures. You can request information about these safeguards by email. Further information is available in Shopify's and Gelato's privacy policies: https://www.shopify.com/legal/privacy and https://www.gelato.com/legal/privacy-policy, and in the privacy policy of the payment provider you choose at checkout. We do not assume that all providers or processing activities use the same transfer mechanism.

Retention

We retain order data for as long as necessary for the contract and associated liabilities. Commercial and tax documentation is retained for the applicable statutory periods; where applicable, six years for commercial documentation and four years for tax obligations, subject to interruptions or special periods. Marketing data is processed until consent is withdrawn or the data is no longer needed. Technical logs are retained for the time necessary to maintain security, resolve incidents and meet legal liabilities, avoiding indefinite retention. Afterwards, we will delete or restrict access to the data as required.

Your rights

You can request access, rectification, erasure, objection, restriction and portability, where applicable, and withdraw your consent by writing to admin@tressemillasgestion.com. We will only request proportionate additional information if needed to verify your identity. We will respond within the statutory time limits, generally one month. You can lodge a complaint with the Agencia Española de Protección de Datos: https://www.aepd.es/.

Minors and automated decisions

Purchases by minors require their legal representative's involvement where legally required. We do not intentionally request minors' data for marketing without the legal safeguards. If you notice any improper collection, contact us. Payment and security providers may use automated tools to detect fraud. You can contact us to request information or a review of a payment issue and exercise any rights concerning automated decisions granted by applicable law.

We will publish any significant changes here, without retroactively changing the legal bases for processing.