Privacy policy
Last updated: 13 November 2026
1. Who we are
AERACE ENGINEERING, S.L. (“AE Race Engineering”, “we”) is the controller of the personal data processed through this store.
- Registered address: Carrer Gaietà Buigas 19, 08320 El Masnou (Barcelona), Spain
- Tax ID (NIF): B19839661
- Email: management@aeraceengineering.com
We have not appointed a Data Protection Officer, as the law does not require it for our activity. For any question about your data, write to the email above.
2. What data we collect
We only collect what we need to sell you our parts, deliver them and look after you afterwards.
- Contact and delivery details: name, email address, phone number, billing address and shipping address.
- Order details: the products and options you buy, prices, taxes, shipping costs, order history, returns and warranty claims.
- Payment details: payments are handled by Shopify Payments, with the method you choose at checkout: card, Shop Pay, Apple Pay, Google Pay, Klarna or another local method shown there, such as Bizum. We receive the payment status, the method used and, at most, the last digits of your card. We never see or store your full card number or your bank details.
- Customer account: if you create one, your email address and your order history. Sign-in uses a one-time code sent by email, so we hold no password. You can always buy without an account.
- Messages: what you send us through the contact form, by email or by phone.
- Newsletter: your email address, if you subscribe.
- Device and browsing data: IP address, browser, device and the pages you visit, collected through cookies and similar technologies as described in section 6.
We get this data directly from you, automatically when you use the store, and from Shopify and the payment providers (for example, whether a payment went through). We do not ask for any special category of data, such as health or beliefs.
3. Why we use your data, and for how long
Each use has its own legal basis under the GDPR and its own retention period. When a period ends, we delete the data or anonymise it.
| Purpose | Legal basis | How long we keep it |
|---|---|---|
| Processing your order: payment, manufacturing, delivery, returns and withdrawals | Performance of the contract (GDPR art. 6.1.b) | While the order is open; then as for invoicing |
| Legal guarantee and warranty claims | Contract and legal obligation (art. 6.1.b and 6.1.c) | 3 years from delivery, plus the legal period to bring a claim |
| Invoicing, accounting and tax | Legal obligation (art. 6.1.c) | 6 years, as required by Spanish commercial and tax law |
| Your customer account | Performance of the contract (art. 6.1.b) | Until you delete your account |
| Answering your questions | Our legitimate interest in replying, or steps before a purchase (art. 6.1.f and 6.1.b) | Until your query is resolved, and no longer than 2 years |
| Newsletter | Your consent (art. 6.1.a) | Until you unsubscribe |
| Emails about products similar to ones you bought | Our legitimate interest, as allowed by Spanish e-commerce law (LSSI art. 21.2) | Until you object; every email has an unsubscribe link |
| Preventing fraud and keeping the store secure | Our legitimate interest (art. 6.1.f) | As long as needed, and no longer than the order data |
| Statistics cookies | Your consent (art. 6.1.a and LSSI art. 22.2) | As set in the cookie banner, or until you withdraw consent |
The data marked as required at checkout is needed to sell to you; without it we cannot process the order. Subscribing to the newsletter is optional.
4. Who we share it with
We do not sell your personal data. We share it only with those who need it to provide the service, and only the part they need.
- Shopify, which hosts the store, processes payments through Shopify Payments and sends our emails, including the newsletter, through Shopify Email, on our behalf. For some features, such as Shop Pay, Shopify acts as an independent controller; see the Shopify Consumer Privacy Policy.
- Apple and Google, if you pay with Apple Pay or Google Pay, under their own privacy policies.
- Klarna, if you choose to pay with Klarna (for example, pay later or in instalments). Klarna receives your name, contact details, billing and shipping address and the order details, may run its own identity and credit checks, and decides whether to offer you that payment option. For this, Klarna acts as an independent controller under its own privacy notice.
- Other payment providers you choose at checkout, such as Bizum through your bank, which receive what they need to process the payment, under their own privacy policies.
- The carrier that delivers your order, UPS or, if you choose it in Spain, Correos, and the app we use to create UPS shipping labels. They receive your name, address, phone and email to deliver it. For deliveries outside the EU, the carrier also passes them to the customs authorities of the destination country.
- Professional advisers, such as our accountants and lawyers, under a duty of confidentiality.
- Public authorities, when the law requires it.
5. Transfers outside the European Economic Area
Some of your data may be processed outside the European Economic Area (EEA) in two situations.
- Our service providers. Shopify may process data in Canada and the United States. These transfers rely on an adequacy decision of the European Commission, such as the one for Canada, or on the Commission’s Standard Contractual Clauses.
- Deliveries outside the EEA. If you order delivery to a country outside the EEA, such as the United Kingdom, the United States or Japan, we must send your delivery details to the carrier and to customs in that country. This transfer is necessary to perform your contract (GDPR art. 49.1.b).
6. Cookies
We use cookies and similar technologies in two groups.
- Strictly necessary: they keep your cart, run the checkout, protect the store and remember your cookie choice. They are always on, because the store cannot work without them.
- Statistics: Shopify’s own statistics on how the store is used, set only if you accept them in the cookie banner. We do not use advertising cookies, or analytics or tracking tools from third parties such as Meta or Google.
You can change your choice at any time from “Cookie preferences” at the bottom of every page. The cookies set by the store platform are listed in Shopify’s cookie policy.
7. Your rights
You can ask us at any time to:
- access the data we hold about you;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law;
- restrict how we use it;
- receive it in a portable format, or have it sent to another company;
- object to uses based on our legitimate interest, including marketing emails, which we stop as soon as you ask;
- withdraw any consent you gave, without affecting what we did before.
To exercise any of these rights, email management@aeraceengineering.com or write to the address in section 1. It is free. We may ask you to confirm your identity, and we will reply within one month, or within three for complex requests, telling you why.
If you are not satisfied, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the authority of your EU country of residence. For data that Shopify processes as an independent controller, you can also use the Shopify Privacy Portal.
8. Other information
- Children. The store is not intended for anyone under 14, the age of digital consent in Spain, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
- Fraud checks and automated decisions. Shopify automatically analyses each order for signs of fraud and may flag it as risky. That analysis decides nothing on its own: a person at AE Race Engineering reviews any flagged order before deciding whether to cancel it. We make no other decision about you based solely on automated processing.
- Security. We apply technical and organisational measures to protect your data. Card payments are handled entirely by certified payment providers.
- Changes to this policy. If we change it, we will update the date at the top. If the change is significant, we will also tell you by email or on the store before it applies.