Privacy policy

This policy explains how we collect and use personal data when you visit businessstepbystep.co.uk, buy from us, sign up to our newsletter or contact us, and what rights you have. We use personal data in line with the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act and, because we are based in Spain, the EU General Data Protection Regulation (EU GDPR) and Spain's data protection law.

Who is responsible for your data

The controller of your personal data is Ismael Giménez Olmos, a sole trader trading as Business Step by Step ("we", "us"), of Calle San Juan 29, 03190 Pilar de la Horadada (Alicante), Spain. NIF (Spanish tax ID): 48736486S. For anything about your data, email support@businessstepbystep.co.uk.

The data we collect

Order data: your name, email address, billing address, the products you buy, the price, the date and time of the order, and the order number.
Consent record: the fact that, before paying, you ticked the box asking for immediate access and acknowledging that you lose your 14-day right to cancel once the download is available, with the date and time.
Payment data: confirmation that your payment succeeded and basic payment details, such as the card type and the last four digits. Payments are handled by our payment providers through Shopify's checkout, and we never see your full card details.
Download data: information about the download links sent to you and, where recorded, how often they have been used.
Account data: if you sign in to a customer account, your email address and order history.
Messages: what you tell us when you email us or use the contact form, and our replies.
Newsletter data: if you sign up, your email address and a record of when and how you gave your consent.
Technical and usage data: your IP address, browser and device type, pages visited and similar information collected through cookies and similar technologies, as described below.

Why we use your data and our legal bases

To process your order, deliver your downloads, resend lost links and give you customer support. Legal basis: performance of our contract with you, or steps you ask us to take before entering into it.
To keep our accounting and tax records and meet other legal obligations. Legal basis: compliance with a legal obligation.
To keep a record of your consent to immediate access and your acknowledgement about the right to cancel. Legal basis: compliance with a legal obligation, and our legitimate interests in being able to show that we followed consumer law.
To keep the shop secure and to prevent fraud and misuse. Legal basis: our legitimate interests in protecting our shop, our customers and our products.
To deal with questions, complaints and legal claims. Legal basis: our legitimate interests in responding to you and in establishing, exercising or defending legal claims.
To send you our newsletter. Legal basis: your consent. We only send marketing emails if you have signed up through our newsletter form, and every email has an unsubscribe link.
To understand how the website is used and, in future, to measure our advertising. Legal basis: your consent, given through the cookie banner.

Emails about your order, such as the order confirmation, are part of our service and are not marketing.

You do not have to give us your personal data, but we need your name, email address and payment to process an order. Without them, we cannot sell you a product.

Cookies and similar technologies

We use cookies that are strictly necessary for the shop to work, for example to keep your cart, run the checkout and keep the website secure. These do not need your consent.

When you visit from the UK or the EU, a cookie banner lets you accept or reject non-essential cookies, such as analytics cookies. Non-essential cookies are only used if you accept them. We may later add advertising tools such as the Meta pixel to measure our adverts and show them to people who may be interested. These will only run if you accept them in the cookie banner, and we will update this policy before we add them. You can change your mind at any time by clearing the cookies for this website in your browser, after which the banner will ask you again.

Who we share your data with

Shopify, which provides our online shop, checkout, order management, download delivery (Shopify Digital Products) and order emails, and acts as our data processor. Shopify may also use some data for its own purposes, as set out in its own privacy policy.
Payment providers, which process your payment through Shopify's checkout. They act as our processors and, for some purposes such as fraud prevention and meeting their own legal obligations, as independent controllers under their own privacy notices.
Email and newsletter tools that we use with Shopify to send order and newsletter emails, acting as our processors.
Advertising platforms such as Meta, only if we add their tools and you accept them in the cookie banner. These platforms may also use the data for their own purposes under their own privacy policies.
Professional advisers, such as an accountant or lawyer, where needed, under a duty of confidentiality.
Public authorities, such as tax authorities, courts or the police, where the law requires it.

We do not sell your personal data.

International transfers

We are based in Spain and our customers are mainly in the United Kingdom. Shopify and our other service providers may process data in other countries, including Canada and the United States. Data moves between the UK and the European Economic Area under adequacy decisions. Where data is transferred to a country that does not have an adequacy decision, our providers use appropriate safeguards, such as standard contractual clauses approved by the European Commission together with the UK addendum or the UK international data transfer agreement, or, where it applies, the EU-US Data Privacy Framework and its UK extension. You can contact us for more information about these safeguards.

How long we keep your data

Orders, payment records and consent records: for as long as tax and commercial law require us to keep them, which in Spain is generally six years, and for longer only if we need them for a legal claim.
Messages: for as long as we need them to deal with your request and any follow-up, after which we delete them unless they form part of an order record.
Newsletter: until you unsubscribe or ask us to delete your data. After that, we keep your email address on a list of people not to contact, and a record of your consent for as long as we may need to show that it was given.
Cookies: for the periods shown in the cookie banner or your browser settings.

Your rights

Under the UK GDPR and the EU GDPR, you have the right to:

access the personal data we hold about you and receive a copy
have inaccurate data corrected and incomplete data completed
have your data deleted in some circumstances
restrict how we use your data in some circumstances
object to our use of your data where we rely on legitimate interests, and object at any time to direct marketing
receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation (data portability)
withdraw your consent at any time, for example by unsubscribing from the newsletter or rejecting cookies, without affecting anything we did before you withdrew it

To use any of these rights, email support@businessstepbystep.co.uk. We may need to confirm your identity first. We will reply within one month, which we can extend by up to two further months for complex requests; if we do, we will tell you why. There is normally no charge.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment providers and Shopify may use automated checks to help detect fraudulent payments.

Complaints

If you are unhappy with how we have used your data, please contact us first so that we can try to put things right. We will acknowledge your complaint within 30 days and tell you what we are doing about it. You also have the right to complain to a data protection supervisory authority:

in the United Kingdom, the Information Commissioner's Office (ICO): ico.org.uk, helpline 0303 123 1113
in Spain, where we are based, the Agencia Española de Protección de Datos (AEPD): www.aepd.es, C/ Jorge Juan 6, 28001 Madrid
if you live elsewhere in the European Economic Area, you can also complain to the supervisory authority in your country

Security

We use reputable service providers and take appropriate measures to protect your personal data. Card payments are handled by our payment providers through Shopify's checkout, so your full card details never reach us. No method of sending data over the internet is completely secure, so please also keep your own email account and devices secure.

Children

Our shop is not aimed at children, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy, for example if we add new tools or if the law changes. The current version is always on this page.

Contact

Ismael Giménez Olmos, trading as Business Step by Step, Calle San Juan 29, 03190 Pilar de la Horadada (Alicante), Spain. Email: support@businessstepbystep.co.uk.