Privacy policy

Last updated: July 2026

✍️

Note: it is advisable to have a professional review this text before opening the shop, especially the list of data processors once Stripe payments are live.

At RUUUTS we take your privacy seriously. This policy explains what personal data we process, for what purpose, on what legal basis, who we share it with and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

RUUUTS VENTURES, S.L. — Tax ID (NIF) B-19853886 — registered office at c/ Vallfogona, 10, 08012 Barcelona (Spain). Privacy contact email: info@ruuuts.com.

2. What data we process

Identification and contact details: name, surname, email and phone number.
Account details: login credentials managed through Firebase Authentication (email/password or Google sign-in). We do not store your password in plain text.
Order and shipping details: delivery and billing address, products, amount and order status.
Payment details: payment is processed through Stripe. RUUUTS does not store your full card details; Stripe acts as processor/controller of the payment.
Label designs: if you customise your label, the design is stored on your own device and is only sent to RUUUTS when you confirm the order, in order to print the labels for your purchase.
Professional/wholesale account details: in addition to the above, company name, address, contact person and role, to assess and manage the registration.
Technical data: the minimum required for the site to work (see the Cookie Policy). We do not use advertising or tracking cookies.

3. Purposes and legal basis

Purpose	Legal basis
Managing your account, orders, payment, shipping and customer service	Performance of the contract (Art. 6(1)(b) GDPR)
Issuing invoices and meeting tax and accounting obligations	Legal obligation (Art. 6(1)(c) GDPR)
Storing and printing the label design of your personalised order	Performance of the contract (Art. 6(1)(b) GDPR)
Assessing and managing professional or wholesale registration requests	Pre-contractual measures / legitimate interest (Art. 6(1)(b) and 6(1)(f))
Issuing and verifying the CO₂ offset certificates associated with your order	Performance of the contract and legitimate interest
Sending you commercial communications, if you subscribe	Consent (Art. 6(1)(a) GDPR)

4. Retention periods

We keep your data for as long as the contractual relationship exists and, once it ends, for the legally required periods (for example, tax and accounting regulations require invoicing records to be kept). Data processed with your consent is kept until you withdraw it.

5. Recipients and data processors

To provide the service, we share data with suppliers acting as data processors, under the appropriate contractual safeguards:

Google (Firebase / Google Cloud): site hosting, account authentication and database.
Stripe: payment processing.
Google Maps Platform (Places): address autocomplete.
Transport / logistics company: order delivery.
CNaught and Tree-Nation: CO₂ offsetting and certificate issuance/verification.
Email provider: sending confirmations and notices.

We do not disclose your data to third parties for purposes other than those described, except where legally required.

6. International transfers

Some of the above providers (for example, Google or Stripe) may process data outside the European Economic Area. In such cases, transfers are covered by the safeguards provided for in the GDPR (European Commission standard contractual clauses and/or adequacy frameworks such as the EU-US Data Privacy Framework).

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to info@ruuuts.com stating the right you wish to exercise. If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Minors

The website and the sale of its products are aimed exclusively at persons aged 18 or over. We do not knowingly process data of minors.

9. Security

We apply appropriate technical and organisational measures to protect your data. Access keys to external services live on the server and are never exposed in the browser; payment takes place in a secure environment managed by Stripe.

10. Changes to this policy

We may update this policy to reflect regulatory or service changes. The current version will be published on this page with its update date.