Privacy Policy

Last updated: October 2025

This Privacy Policy describes how ELITEX ECOMMERCE, S.L. (“Elitex Training,” “we,” “us,” “our,” or “the company”) processes the personal data of users of elitextraining.eu, in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI).

1. Data Controller

ELITEX ECOMMERCE, S.L.
Tax ID No.: ESB09895806
Registered address: Calle del Sargo 14, 11510 Puerto Real, Cádiz, Spain
Contact: data protection contact details.

2. Personal Data Processed and Collected

We may collect and process the following categories of personal data:

  • Identification and contact details: first name, last name, address, telephone number, and email address.

  • Order and billing data: order number, items purchased, amount, payment method (without retaining full banking details).

  • Technical data: IP address, device identifiers, cookies or trackers (see Cookies Policy).

  • Preference, browsing, and behavioral data.

  • Consent, opt-out, and log data associated with marketing or transactional communications.

Data may be collected through:

  • Purchase and account creation forms.

  • Contact or subscription forms.

  • Interaction with electronic correos or SMS messages.

  • Cookies and similar technologies (with prior consent).

3. Purposes and legal bases

Purpose Legal basis Data processed Retention period
Order management, shipping, and customer service Performance of a contract Identification, contact, order, payment, and delivery data Contractual relationship + 6 years (legal obligations)
Creation and maintenance of a user account Performance of a contract Registration data (name, email, address, password) Until account deletion is requested
Email and SMS marketing (sending promotions, news, reminders, or gifts) Express consent Contact details, interaction or purchase history Until consent is withdrawn or after 24 months of inactivity
Web analytics, performance, and non-essential cookies Consent IP address, session ID, browsing behavior According to the Cookies
Compliance with legal and tax obligations Legal obligation Billing and accounting data Applicable statutory periods
Management of ARCO rights and claims Legal obligation / legitimate interest Identification, request, logs Up to 3 years after the case is closed
Shipping and returns logistics management (Outvio) Performance of a contract Name, email, telephone number, address, order, delivery status Contractual relationship + associated statutory periods
Billing and accounting (Holded) Legal obligation Billing and accounting data 6 years or longer statutory periods
Post-purchase surveys and reviews (Loox / Trustpilot) Legitimate interest of the Data Controller (Art. 21 LSSI) Email, name, order number, products, language/country Until objection or 24 months after purchase

4. Contact and forms

When a user contacts us through elitextraining.eu, forms, we process the data to respond to the request.
Data processed: first name, last name, email, message, and other data provided.
Legal basis: the user's consent when submitting the form.

Data processing in lead generation campaigns

When you participate in forms or promotional campaigns through TikTok, Meta (Facebook/Instagram) , or other platforms, the personal data you provide (first name, last name, email address, and/or telephone number) will be processed by ELITEX ECOMMERCE, S.L. (VAT No. ESB09895806) for the purpose of:

  • Managing your participation in the campaign or promotion.

  • Sending you information about discounts, news, or product launches from Elitex Training.

  • Contacting you by email or SMS if you have given us your express consent.

Legal basis: consent of the data subject (Article 6(1)(a) of the GDPR).
Retention: the data will be retained for as long as you remain subscribed or until you request its deletion.
Data processors: TikTok Technology Limited, Meta Platforms, Inc., Shopify, and in-house marketing tools (for example, internal spreadsheets or YSMS for SMS marketing).
Rights: you may access, rectify, or erase your data, as well as withdraw your consent, by following the procedure in section 12.

5. Commercial communications and marketing

a) Email marketing (Shopify Email)

Promotional correos are sent via Shopify Email (Shopify Inc.), which acts as a data processor.
The data is hosted in Canada and Ireland, countries covered by an adequacy decision and Standard Contractual Clauses.
Each email includes a visible, free link to unsubscribe.

b) SMS Marketing (YSMS)

SMS messaging is managed through YSMS, owned by InkOfPixel Srl, with the following details:

InkOfPixel Srl
Piazza Castello 26, 20121 Milan (Italy)
VAT: 09287730965 – REA MI-2081233
Email: info@inkofpixel.com
Website: https://ysms.me
Privacy Policy: https://ysms.me/privacy

YSMS acts as a data processor for contact management, messaging, analytics, and segmentation.
Each SMS includes a free method to unsubscribe (by replying “STOP” or via a link).
Technical consent and unsubscribe logs (date, IP address, and version of the accepted text) are retained to demonstrate GDPR compliance.

6.Digital Analytics and Advertising

We may use tools to analyze web traffic and optimize advertising campaigns:

  • Meta Events Manager / Meta Pixel (Meta Platforms Ireland / Inc.)

  • TikTok Remarketing (TikTok Information Technologies UK Limited)

  • Google Ads / Analytics (Google Ireland Limited)

These services may install cookies or identifiers to measure conversions or conduct remarketing. Their use requires prior consent (cookie banner).

7. Platform, Hosting, and Management Services

Our store operates on Shopify (Shopify International Limited / Shopify Inc.), which enables hosting and running elitextraining.eu, processing orders and managing databases, users, and payments.

Other services with access to data:

  • Outvio: shipping, returns, and delivery notification management.

  • Holded: accounting management and invoicing.

  • Loox and Trustpilot: sending surveys and collecting post-purchase reviews.

All act as data processors, under GDPR-compliant contracts and with appropriate technical measures (encryption, access control, logs, and limited retention).

8. Posting reviews and testimonials

If you submit a review through Loox or Trustpilot, we may publish it on the website and official profiles (name/alias, text, rating, and photo, if included).
You may request its editing or removal through the data protection contact channels.
We reserve the right to moderate offensive or illegal content.

9. International transfers and safeguards

  • Shopify hosts data in Ireland and Canada (adequacy decision).

  • YSMS (InkOfPixel Srl) operates in the EU (Italy) and may rely on providers using Standard Contractual Clauses (for example, AWS Germany or Mailchimp USA).

  • Outvio, Holded, Loox, and Trustpilot may carry out transfers outside the EEA under SCCs and supplementary measures (encryption and access controls).

  • Google, Meta, and TikTok also apply SCCs approved by the European Commission.

You may request information about the specific safeguards through the data protection contact channels.

10. Minors

Elitex Training does not direct its services to children under 14 years of age. If we identify data relating to a minor without valid consent, we will delete it immediately.
If you believe that a minor has provided us with data, please contact us.

11. Retention periods

Data type Period
Contracts, orders, and billing Contractual relationship + 6 years (legal requirements)
Customer accounts Until a deletion request is submitted
Marketing (email/SMS) Until consent is withdrawn or after 24 months without interaction
Consent and opt-out logs Up to 3 years to defend against claims
Reviews and surveys Until an objection is raised or the post is deleted
Data subject rights requests / complaints Up to 3 years after the case is closed

Once these periods have elapsed, the data is securely deleted or anonymized.

12. User Rights

You may exercise the rights granted under the GDPR:

  • Access: find out what data we process.

  • Rectification: correct inaccurate or incomplete data.

  • Erasure (right to be forgotten): delete your data when it is no longer required.

  • Right to object: object to processing (for example, review or marketing emails).

  • Restriction: restrict processing in certain cases.

  • Data portability: receive your data in a structured format.

  • Withdrawal of consent: at any time, without affecting prior processing.

How to exercise them: send your request through the contact channels in section 17, indicating the right you wish to exercise. Using the chat is not mandatory, nor will a request be rejected solely because another method is used.
We may ask you to provide proof of identity.
Response time: a maximum of 1 month, which may be extended by an additional month in complex cases.
If you are not satisfied, you may file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

13. Objection to review or marketing communications

If you no longer wish to receive correos inviting you to review a purchase, use the “do not receive again” link included in each message or submit your objection through the data protection contact channels.
Your objection will not affect necessary communications (e.g., invoices, incident notifications, or shipment tracking).

14. Security

Elitex Training applies appropriate technical and organizational measures to protect personal data against loss, alteration, unauthorized access, or disclosure, including:

  • TLS encryption of communications,

  • role-based access control,

  • multi-factor authentication (MFA) in systems containing personal data,

  • activity logging,

  • backups and limited retention policies.

15. Additional Information and System Logs

For operational and security reasons, technical records (logs) may be retained, including IP addresses, server events, and action traces.
This data is used exclusively to ensure security and technical maintenance.

16. Changes to This Policy

We may update this Privacy Policy at any time.
If the changes affect the purposes or the consent granted, notification will be provided through a prominent notice and, where appropriate, new consent will be requested.

17. Contact Details

Data Controller: ELITEX ECOMMERCE, S.L.
Tax ID: ESB09895806
Postal address: Calle del Sargo 14, 11510 Puerto Real, Cádiz, Spain
Email contact: you can submit data protection requests to the email address published in our legal contact details, indicating “Data Protection” in the subject line, if you wish.
You may also send them in writing to the postal address above. For general inquiries about orders and products, please use the website chat, available via the chat bubble whenever possible.