Legal
Privacy Policy
Last updated: 30 July 2026
This policy explains what happens to the personal data you give us when you reserve a bed kit. We have tried to write it in plain language rather than the usual fog.
Who is responsible for your data
The data controller is [TO BE COMPLETED: registered company name], registered at [TO BE COMPLETED: address], company number [TO BE COMPLETED], VAT number [TO BE COMPLETED].
You can reach us about anything in this policy at [TO BE COMPLETED: contact email].
What we collect, and why
When you submit the reservation form, we collect only what that form asks for:
| Data | Why we need it |
|---|---|
| Name | To address you properly in email. |
| Email address | To tell you when ordering opens. This is the only thing we genuinely need. |
| Whether you are a student, parent or residence | So we send you relevant information rather than all of it. |
| University and residence | To match the correct bed size, since Madrid residences vary between 90, 105 and 120 cm. |
| Kit and cloth preference | To hold the right stock and estimate demand before manufacturing. |
| Monogram initials (optional) | To prepare your embroidery if you order. |
We do not collect payment details on this site. Nothing is charged at reservation.
Our lawful basis
Consent, under Article 6(1)(a) of the UK/EU General Data Protection Regulation. You gave it by ticking the box on the form. You can withdraw it at any time and that is not a hassle for us — see your rights below.
Who else sees it
We use two processors, and no one else:
- MailerLite — stores the mailing list and sends the emails.
- Cloudflare — hosts this website and passes your form submission to MailerLite.
Both may process data outside the European Economic Area. Where they do, they rely on the European Commission's Standard Contractual Clauses to keep the protection with your data. [TO BE VERIFIED before launch: confirm the current transfer mechanism in each provider's data processing agreement.]
We do not sell your data, share it with advertisers, or hand your email to anybody else. If we ever run ads, they are targeted by location, not by uploading your details.
How long we keep it
Until you unsubscribe, or until 24 months pass with no interaction from you — whichever comes first. Then we delete it. If you unsubscribe we keep a minimal record of the fact you opted out, so that we do not accidentally email you again.
Your rights
Under the GDPR you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct it if it is wrong;
- delete it;
- restrict or object to how we use it;
- send it to another provider (portability);
- and withdraw your consent, at any time, for any reason.
Every email we send has a one-click unsubscribe link, which is the fastest route for most of these. Otherwise just write to us. We will respond within one month.
We do not make automated decisions about you and we do not profile you.
If you are unhappy with us
Please tell us first — we would rather fix it. But you have the right to complain to a data protection authority regardless:
- Spain — Agencia Española de Protección de Datos (AEPD), aepd.es
- Poland — Urząd Ochrony Danych Osobowych (UODO), uodo.gov.pl
Cookies
This site sets no cookies and runs no analytics or tracking scripts. There is nothing to consent to, which is why you were not shown a banner. [If analytics or advertising pixels are added later, this section must be updated and a consent banner added — under Spanish law (LSSI Article 22.2) non-essential cookies require prior consent.]
Changes
If we change this policy we will update the date at the top. If the change is significant and we hold your email, we will tell you by email.