§ 01 / THE SHORT VERSION
- What we collect: Order data (name, address, email, payment), warranty claims (photos, descriptions), support messages.
- What we don't collect: Browsing data sold to advertisers. Behavioural profiles. Location beyond what's needed to ship.
- Who we share with: Payment processor, shipping carrier, EU consumer dispute channels. Nobody else.
- How long we keep it: 7 years for tax/legal, then deleted. Marketing data deleted within 30 days of unsubscribe.
- Your rights: Access, correction, deletion, portability, complaint to your local DPA. All free, all within 30 days.
§ 02 / WHO WE ARE / CONTROLLER
The data controller for this site is:
CAVOK World S.L.
Calle Trasmallo 12
11380 Tarifa, Cádiz
España
VAT: ES-B-12345678
EU GDPR representative: privacy@cavokworld.com
If you're not satisfied with how we handle your data, you have the right to lodge a complaint with your local data protection authority. In Spain that's the AEPD (Agencia Española de Protección de Datos).
§ 03 / WHAT WE COLLECT
Here's the full list of data we collect, why, and the legal basis under GDPR:
| Data | Why | Legal basis |
|---|---|---|
| Name, email, address | Process & ship orders | Contract |
| Phone number | Shipping notifications | Contract |
| Payment info | Process payment | Contract |
| IP address | Fraud prevention, security | Legitimate interest |
| Order history | Warranty & support | Contract + legal |
| Email (newsletter) | If you opt in | Consent |
| Photos (warranty) | Process warranty claims | Contract |
| Support messages | Respond to enquiries | Contract / consent |
We do not collect: location data beyond shipping, browsing behaviour, device fingerprinting, or any data shared with advertising networks.
§ 04 / HOW WE USE IT
We use the data we collect to:
- Process and ship your order
- Send order confirmation, tracking, and delivery notifications
- Process warranty claims and crash damage replacements
- Respond to support messages
- Send our newsletter (only if you've opted in)
- Comply with tax and legal obligations
- Detect and prevent fraud
We do not use your data for: advertising retargeting, profiling for marketing decisions, selling to third parties, building shadow databases, or any purpose you haven't explicitly consented to.
Automated decision-making
We don't make automated decisions about you that produce legal effects. The only automated process is fraud detection on payments, which can block an order — in which case a human reviews within 24 hours.
§ 05 / WHO WE SHARE WITH
Three categories of recipients, that's it:
Payment processors
Stripe (EU: Stripe Payments Europe Ltd., Ireland), PayPal (PayPal Europe S.à.r.l., Luxembourg), Klarna (Klarna Bank AB, Sweden). They receive payment data under their own privacy policies.
Shipping carriers
DHL, UPS, FedEx, Correos, and regional carriers for specific destinations. They receive name, address, phone number, and tracking-linked email.
Legal / regulatory
If required by law — tax authorities, court orders, consumer protection bodies — we share the minimum data legally required. We challenge over-broad requests.
§ 06 / COOKIES
See our full Cookies Policy for the technical breakdown. Short version: we use a minimal set of cookies, none for advertising.
§ 07 / RETENTION
How long we keep different types of data:
| Data type | Retention |
|---|---|
| Order records | 7 years (tax / warranty) |
| Warranty claims | 2 years past warranty expiry |
| Support messages | 3 years |
| Newsletter subscription | Until you unsubscribe, +30 days |
| Account (if created) | Until deletion requested |
| Server logs | 30 days |
After the retention period, data is either deleted or anonymised.
§ 08 / YOUR RIGHTS
Under EU GDPR, you have the following rights. All of them are free. We respond within 30 days:
- Access — request a copy of all data we hold about you
- Rectification — correct inaccurate data
- Erasure — delete your data (subject to legal retention requirements)
- Restriction — limit how we process your data
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interest
- Withdraw consent — at any time, for any consent-based processing
- Lodge a complaint — with your local data protection authority
To exercise any of these rights, email privacy@cavokworld.com from the email address on file. We may ask for proof of identity to prevent fraud.
§ 09 / CHILDREN
Our site and products are not directed at children under 16. We don't knowingly collect data from children. If you believe a child has provided data to us, email privacy@cavokworld.com and we'll delete it within 24 hours.
§ 10 / CHANGES & CONTACT
We update this policy when our practices change. Major changes get an email to active customers. Minor changes get a date bump at the top of this page.
The current version is always at cavokworld.com/legal/privacy.html.
For any privacy question, request, or complaint: privacy@cavokworld.com
Postal: CAVOK World S.L., Calle Trasmallo 12, 11380 Tarifa, Cádiz, España