Privacy policy

1. Data controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), we inform you that the controller of the personal data you provide through the website https://extrapy.com is:

• Identity: Bluvia Water SL (Extrapy)
• Tax ID (CIF): B25884602
• Address: Avenida de la Hispanidad, 8, 29700 Vélez-Málaga (Málaga), España
• General email: info@extrapy.com
• Data protection contact: privacidad@extrapy.com
• If you comment on our campaign videos: your public username on that network and what you wrote.

2. What data we process

Depending on how you interact with us, we may process the following categories of data:

• Identification and contact details: name and surname, email, telephone, delivery and billing address.
• Purchase data: products bought, amounts, dates, chosen payment method, order history and incidents.
• Business data (company name, tax ID, sector, estimated volume) when you request an invoice or ask about our business and wholesale conditions.
• Communications: the content of the messages you send us by form, email, telephone or WhatsApp.
• Technical browsing data: IP address, browser and device type, access and error logs, needed for the security and operation of the site.
• Audience measurement: the page you open, the website and campaign you came from, the language, the type of device, whether your basket holds something, and what you search for when the shop finds nothing (dropping anything that looks like an email or a phone number), and on offer pages how long you keep the page in view (in steps of seconds) and how far down it you get, and whether you are shown the cookie notice and what you choose in it, kept by the hour. Your IP address and browser are used on the spot to form a key that changes every day, and are not stored.
• Where your visit came from: the campaign tags (utm) of the link you arrived from and, only if you accept marketing cookies, the ad click identifier (fbclid, ttclid, gclid). They are stored with your order. If you do not accept them and place a cash-on-delivery order on the page a Meta advert took you to, that click's identifier (fbclid) is read from the page's address when the order is sent, never from your device, and kept with the order for a few days to report the confirmed purchase (section 3).
• Data from analytics or marketing cookies, only if you have accepted them. Tools active now: Meta (Meta Platforms Ireland Ltd.), Taboola (Taboola.com Ltd., Israel, and Taboola, Inc., United States; its privacy policy).

Fields marked as mandatory in each form are needed to handle your request; without them we cannot process it. You guarantee that the data you provide is accurate and undertake to tell us about any changes.

3. Purposes and legal bases

We process your data for the following purposes, each with its legal basis:

We do not make decisions based solely on automated processing that produce legal effects on you or significantly affect you, nor do we create profiles for that purpose.

4. Recipients

We do not sell or transfer your data to third parties for commercial purposes. Only the providers needed to deliver the service access it, as processors and under contract in accordance with Article 28 GDPR:

• Carriers: the courier making the delivery receives your name, address, telephone and email in order to deliver the parcel and notify you.
• Web hosting and infrastructure: the hosting and storage providers on which the shop runs.
• Email delivery: Resend, Inc. (United States), which sends on our behalf the transactional emails (order confirmations and updates, the link to manage your subscription to The Box, restock alerts, the codes to sign in to your account). The transfer to the United States relies on the safeguards described in section 5.
• Newsletter and marketing email: Brevo SAS (formerly Sendinblue SAS; France, European Union), which keeps the list of people who asked us for our news, with when and how they signed up, and sends on our behalf the newsletter and, if you signed up, the emails that follow an order of yours once it is confirmed.
• Advertising and analytics platforms, only if you accept the matching category in the cookie banner. Active now: Meta (Meta Platforms Ireland Ltd.), Taboola (Taboola.com Ltd., Israel, and Taboola, Inc., United States; its privacy policy). Each also processes the data under its own privacy policy.
• Meta Platforms Ireland Ltd., also if you do not accept marketing cookies, but only the confirmed purchase of a cash-on-delivery order, to measure our adverts (section 3). Under Meta's terms for its business tools, we are joint controllers with Meta for that transmission, and Meta is the controller of what it does with the data afterwards; it may transfer them to the United States with the safeguards in section 5. You can object with the link in your order email, on WhatsApp or by writing to us.
• Tax and accounting advisers, for compliance with legal obligations.
• Calls and WhatsApp with an AI assistant: Retell AI, Inc. (United States), which makes and answers the calls, transcribes them and, if they are recorded, keeps the recording; the telephone operator that carries the calls; Meta Platforms Ireland Ltd. (WhatsApp Business), which delivers the messages; and Anthropic, PBC (United States), which drafts the replies on WhatsApp. The transfer to the United States relies on the safeguards described in section 5.

We will also disclose data to public authorities, courts or banks when required to do so by law.

5. International transfers

Some of our technology providers (hosting, email, advertising and analytics platforms) may process data outside the European Economic Area, mainly in the United States. In those cases we make sure the transfer is covered by appropriate safeguards: an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified entities) or the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914), together with any supplementary measures required.

The AI assistant for calls and WhatsApp uses providers in the United States (Retell AI and Anthropic), with the same safeguards: an adequacy decision or the standard contractual clauses.

You can request a copy of those safeguards at privacidad@extrapy.com.

6. Retention periods

• Orders and invoices: for the duration of the contractual relationship and, afterwards, for the period required by commercial and tax law: 6 years from the last entry (art. 30 of the Spanish Commercial Code) and in any case until tax obligations (4 years, art. 66 of the General Tax Law) and contractual liabilities are time-barred.
• Guarantees and complaints: for the legal guarantee period of the products and the limitation period of the corresponding actions.
• Newsletter: until you unsubscribe or withdraw consent. We keep proof of your subscription and unsubscription to demonstrate compliance.
• Contact forms and B2B requests: 12 months from the last communication if no commercial relationship is established.
• Browsing data and security logs: a maximum of 12 months, unless needed to investigate an incident.
• Audience measurement: the detail of each visit, by the hour, up to 30 days (the daily keys are deleted within the hour after midnight; backup copies keep them until they are renewed, under 12 months); daily totals, 25 months. On a day with very few visits those totals can describe a single person.
• Where the order came from (campaign tags and click identifier): with the order, for the same periods. What the advertising and analytics platforms receive is kept under their own policies.
• Confirmed purchase reported to Meta without marketing consent: the click identifier, your IP address and your browser are kept only until the purchase is sent or it is decided not to send it, and 7 days at most; then they are deleted and all that remains, with the order, is whether it was sent. Your objection, until you withdraw it. What Meta receives is kept under its own policy.
• Cookies and local storage: the periods stated in the Cookie policy.
• Calls and messages with the AI assistant: recordings and transcripts, 90 days; the outcome of the call and what you accepted for an order, with the order and for the same periods. If you left your phone on the cash-on-delivery form and did not finish the order, 30 days. If you ask us not to contact you, we keep only an encrypted fingerprint of your number, which cannot be read back, so that we never call or message you again.
• Miga's army: comment text, 30 days; names, until 90 days after the last episode and 31 May 2027 at the latest. The count stays, without names.

Once these periods have elapsed, data will be deleted or anonymised. While a legal retention obligation persists, data will be kept blocked and available only to the competent authorities.

7. Your account

If you sign in to My account (with your email and a code we send you, no password), besides the data of your orders and boxes we keep:

• The sign-in codes we email you, stored as an encrypted fingerprint and never as the code itself, for at most 48 hours after they expire (the daily clean-up deletes them once 24 hours have passed). Each code expires after 15 minutes and works once.
• The devices you are signed in on: the browser and system as your device sends them (a text of up to 200 characters) and the date of your last visit, so you can see them in My details and sign out of any of them.
• Your favourites, if you mark them while signed in, so you have them on all your devices.

Purpose and legal basis: letting you see and manage your orders, boxes, invoices and addresses. It is the performance of your contract with us (art. 6.1.b GDPR).

Retention: each session ends 60 days after you last sign in or change something in My account and never lasts more than one year from when you signed in; after that you sign in again with a code. Your favourites and the rest of your account data are kept until you delete the account.

Your rights, without writing to us: in My details you can download a copy of your data (rights of access and portability) and delete your account (right to erasure). Deleting it removes your name, phone, addresses, favourites and sessions; orders and invoices are kept without your name for the period the law requires (section 6). If you have a paid order that has not left yet or an active box, you can delete the account once the order leaves or you cancel the box.

The cookie that keeps you signed in is described in the Cookie policy.

8. Your rights

You can exercise the following rights at any time:

• Access: find out which of your data we process and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed. Invoices already issued are not deleted: they are kept, blocked, for the period required by tax and commercial law (art. 17.3.b GDPR).
• Objection: object to processing based on legitimate interest, including commercial communications.
• Restriction: ask us to restrict processing in the cases provided for by law.
• Portability: receive your data in a structured, commonly used format, or have it transmitted to another controller.
• Withdraw consent given, without affecting the lawfulness of prior processing.
• Not to be subject to automated decisions that produce legal effects or significantly affect you.

To exercise them, write to privacidad@extrapy.com stating the right you are exercising.

You can also do so by post to Avenida de la Hispanidad, 8, 29700 Vélez-Málaga (Málaga), España.

If we have reasonable doubts about your identity we may ask for a document proving it. We will reply within one month, extendable by two further months in complex cases, of which we would inform you.

You can object to the audience measurement without writing to us: turn on "Global Privacy Control" or "Do Not Track" in your browser and you will not be counted. Once the daily keys are deleted (within the hour after midnight), the visit records carry nothing that identifies you. Until then, on a day with a single order they could be linked to it by the hour; we never cross them.

So that we do not share your purchases with Meta: press “Do not share my purchase with Meta” in your order email, or tell us on WhatsApp or at privacidad@extrapy.com, whenever you like. From then on we send Meta no purchase of yours made without accepting marketing cookies, nor those of other orders with your email or phone. What was sent before cannot be withdrawn from Meta.

If you believe we have not handled your rights correctly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, or through its electronic office at www.aepd.es. We would appreciate the chance to resolve it first.

So that we stop calling or messaging you: say so during the call or reply STOP (or BAJA) on WhatsApp, and we will not contact you that way again. On any call you can ask to speak to a person from the shop.

9. Security measures

We apply technical and organisational measures appropriate to the risk of the processing, in accordance with Article 32 GDPR: encrypted communications (TLS), access control to systems, minimisation of the data collected, backups, access logging and processing agreements with all our providers.

In the event of a security breach posing a high risk to your rights and freedoms, we will inform you without undue delay, in addition to notifying the AEPD.

10. Minors

The website is not aimed at children under 14 and we do not knowingly collect data from them. You must be over 18 to make purchases. If we discover that we have received data from a minor without the authorisation of their parents or guardians, we will delete it. If you are a parent or guardian and believe a minor in your care has given us data, please contact us.

11. Social media

Extrapy has profiles on social networks (Instagram, Facebook, TikTok, YouTube). The processing of data of those who interact with those profiles is governed by each platform's privacy policy; Bluvia Water SL only accesses the information the platforms make available to business accounts and uses it to reply to your comments and messages and, in the campaigns that announce it, for Miga's army.

Miga's army. If you comment on a video of the series «Miga contra 10.000 hormigas», we show your username on Miga's army next to your soldier, its weapon and the network you commented on. From Facebook, only your first name and the initial of your surname. We do not keep your photo or links to your profile, and we do not publish what you wrote. We read public comments with each network's tools or copy them by hand; on YouTube, with the YouTube API Services, to which the YouTube Terms of Service and the Google Privacy Policy apply. To take your name off the map, delete your comment or write to us at info@extrapy.com, also for any other right.

12. Changes to this policy

We may update this policy to adapt it to regulatory changes or changes in our processing. We will publish the current version on this page with its update date and, if the change is substantial, we will let you know through the usual channels.