Privacy policy

1. Data controller

ISG Petrol S.L.
NIF: B43500750
Registered office: carretera de Castellón, km 6, bajos, Polígono Industria, 50013 Zaragoza, Spain.
Zaragoza Commercial Registry: section 8, sheet Z 78691, entry 4.
Email: hello@lupiki.es

This policy describes data processing on lupiki.es and its forms. Contact the controller by email or at the address above.

2. Data and sources

We receive the details you provide directly: name, email and message; retailer enquiries also include shop and city, and a phone number if supplied. Newsletter records include email, language, request and confirmation dates and consent version. Required fields are needed to handle your request. We do not request bank details or special categories of personal data.

Connections generate technical information, such as IP address, time, requested resource and browser details, used by hosting infrastructure to provide and protect the service. Forms temporarily use an identifier derived from the IP address to limit abusive submissions.

3. Purposes and legal bases

Answering enquiries

We answer general enquiries based on our legitimate interest in communicating with people who request information (GDPR Article 6(1)(f)). When you request steps before entering a contract to which you would be a party, the basis is that pre-contractual request (Article 6(1)(b)). For retailer representatives, our legitimate interest is maintaining a relationship with the represented business.

Sending news

We send LUPIKI launch, collection and marketing news only with your consent (Article 6(1)(a)), through a separate, confirmed subscription.

Protecting the service

We prevent spam, abuse and incidents based on our legitimate interest in website security and availability (Article 6(1)(f)), limiting data to this purpose.

Meeting obligations and rights requests

We handle data protection requests and applicable legal obligations (Article 6(1)(c)). Where necessary, we retain evidence to establish, exercise or defend claims under the applicable legal bases and exceptions.

We do not sell your data, build marketing profiles or make automated decisions with legal or similarly significant effects on you.

4. Recipients and hosting

Authorised ISG Petrol S.L. staff handle requests. We use Hostinger for hosting, infrastructure and email; these providers may process data to provide their services under applicable data protection terms. We do not share data for third-party advertising. We may disclose it to authorities where legally required.

Provider infrastructure and subprocessors may involve processing outside the European Economic Area. The Hostinger data processing agreement provides for international transfer safeguards, including standard contractual clauses where applicable. You may request information about the applicable safeguards or a copy by email.

5. Retention

We keep enquiries for as long as needed to address and follow them up. Once resolved, we delete unnecessary data; where an obligation or potential liability exists, we retain only necessary information, with restricted access or blocking where required, for the applicable statutory period.

Active subscriptions are kept until you unsubscribe or withdraw consent. Limited evidence of consent and withdrawal may be retained to demonstrate compliance and prevent further messages. Confirmation links expire after 48 hours; expired pending records and old abuse-prevention records are cleared by automatic maintenance accompanying new requests. Hosting technical logs are retained according to their security purpose and the provider’s terms.

6. Your rights and how to exercise them

You may request access, rectification, erasure, objection, restriction and portability where legally applicable. You may object to legitimate-interest processing on grounds relating to your particular situation and withdraw newsletter consent at any time without affecting the lawfulness of previous processing.

Email hello@lupiki.es or write to our registered office, explaining your request and providing the details needed to locate it. Do not send an identity document initially: we will only request proportionate additional information if there are reasonable doubts about identity. We respond within one month; if complexity or the number of requests requires a lawful extension, we will inform you within that first month.

If you believe processing infringes your rights, you may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

7. Children and security

Although products are aimed at families, forms and the newsletter are for adults only. Do not subscribe a child or include children’s details in messages. Tell us if children’s data has been sent by mistake so we can review and remove it where appropriate. We use HTTPS, restricted record access and controls against abusive submissions.

8. Policy changes

We will update this information when processing changes and request fresh consent where necessary. See also our cookie policy and newsletter and unsubscribing information.