1. Who we are
Infinite Story TOWA Shop (shop.infinitestorytowa.com) is operated by Shigeru Ito, a sole trader (autónomo) based in Barcelona, Spain.
- Address: C/Espronceda, Barcelona, Spain 08027
- Contact: shigeru@infinitestorytowa.com
For the purposes of the EU General Data Protection Regulation (GDPR), Shigeru Ito is the data controller for personal data collected through this website.
2. What personal data we collect
When you browse, place an order, or contact us, we may collect:
- Contact details: name, email address, phone number, shipping and billing address
- Order details: products purchased, order value, order history
- Payment information, processed directly by our payment provider (see Section 5) — we do not store your full card details on our servers
- Technical data: IP address, browser type, and basic usage data collected via cookies (see Section 7)
- Any information you provide when contacting us for support
3. Why we use your data (legal basis)
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling your order | Performance of a contract |
| Responding to customer service enquiries | Performance of a contract / legitimate interest |
| Complying with tax and accounting obligations | Legal obligation |
| Sending order-related emails (confirmation, shipping updates) | Performance of a contract |
| Marketing emails | Consent (only if you opt in) |
4. How long we keep your data
We keep order and invoice records for as long as required by Spanish tax law (generally 5 years). Account data is kept for as long as you maintain an account with us, or until you request deletion.
5. Who we share your data with
We share the minimum data necessary with the following categories of third parties, solely to run the store:
- Gelato (our print-on-demand production and shipping partner) — receives your name, shipping address, and order details so your poster can be printed and shipped directly to you, sometimes from a print facility outside the EU/EEA. Gelato acts as an independent data processor for fulfilment purposes.
- Stripe (our payment processor) — handles payment collection securely. We do not store your card number on our servers.
- Hosting provider (OVH) — hosts the website and stores order data on our behalf.
- WooCommerce / Automattic — the software platform this store runs on.
We do not sell your personal data to anyone.
6. International transfers
Because Gelato prints and ships from facilities located around the world, your order data (name and shipping address) may be transferred outside the European Economic Area to fulfil your order. Gelato maintains its own data-protection safeguards; please see Gelato’s privacy policy for details.
7. Cookies
This site uses essential cookies required for core functions like the shopping cart and checkout to work. We do not currently use cookies for advertising or third-party analytics tracking.
8. Security measures
We take reasonable technical and organisational measures to protect the personal data we hold from unauthorized access, loss, or misuse. Access to your personal data is restricted to those who need it to fulfil the purposes described in this policy, and our third-party processors (see Section 5) are contractually required to apply appropriate safeguards.
9. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”), subject to our legal obligations (e.g. tax records)
- Object to or restrict certain processing
- Request a copy of your data in a portable format
- Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es)
To exercise any of these rights, contact us at shigeru@infinitestorytowa.com.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent version.