Privacy Policy

Last updated: 11 August 2026.

This Privacy Policy explains how WOODKIT processes the personal data of customers, visitors, professionals, instructors, workshops, nodes and other people who interact with woodkit.pro, the WooCommerce store, My Account and our support channels.

1. Data controller

Controller: WOODKIT, a brand operated from Spain. The full legal entity name, tax ID and registered address must be added before the store opens to the public.
Privacy contact: info@woodkit.pro
Website: https://woodkit.pro

The controller’s legal identity and address are mandatory transparency information. Until those details are complete, the store must remain private or in “Coming soon” mode.

2. Data we collect

• Identity and contact: first name, surname, email, telephone number and account credentials.
• Billing and tax: legal name or company name, NIF/CIF/VAT ID, billing address, country and consumer or professional status.
• Order and logistics: products, configurations, notes, delivery address, carrier, incidents and related communications.
• Payment: status, amount, currency, identifiers and anti-fraud data. WOODKIT does not store full card numbers; payment is processed by the provider you select.
• Account and network: order history, files, addresses, Professional/B2B, Instructor or Node applications and documentation supplied to assess them.
• Technical use: IP address, device, browser, security logs, cookies and consent preferences.
• Support: messages, replies, photographs or files voluntarily provided to resolve a query or incident.

3. Purposes and legal bases

• Manage purchases, payment, production, delivery, returns, warranties and support: performance of a contract and pre-contractual steps.
• Issue invoices and comply with accounting, tax, customs and consumer obligations: legal obligation.
• Create and administer My Account: performance of a contract or the user’s request.
• Prevent fraud, abuse and unauthorised access and defend claims: legitimate interests and, where applicable, legal obligation.
• Assess Professional/B2B, Instructor or Node applications: pre-contractual steps requested by the applicant. Buying a product does not automatically grant any of these statuses.
• Send service communications: performance of a contract. These include confirmations, status updates, incidents, invoices, security notices and password resets.
• Send marketing: consent where required. Consent can be withdrawn at any time without affecting prior processing.
• Non-essential analytics and personalisation: consent managed through the cookie banner.

4. Required data

Fields marked as required are needed to process the order, verify tax identity, calculate taxes, issue an invoice or deliver the product. Failure to provide them may prevent the purchase. Professional billing requires a legal or company name and NIF/CIF/VAT ID. Customers are responsible for the accuracy of the information supplied.

5. Recipients and service providers

We may disclose strictly necessary data to providers acting as processors or independent controllers: website hosting and maintenance; WooCommerce and operational extensions; Stripe, PayPal or other payment providers; carriers, logistics operators and customs authorities; accounting, tax and legal advisers; transactional email, security, backup and fraud-prevention services; and public authorities where legally required. We do not sell personal data.

Each provider receives only the information needed for its role. Payment data is entered in the secure environment of the relevant payment provider and is also subject to that provider’s privacy policy.

6. International transfers

Some technology or logistics providers may process data outside the European Economic Area. Where this occurs, a valid GDPR mechanism will be used, such as an adequacy decision, Standard Contractual Clauses and, where appropriate, supplementary measures. Information about applicable safeguards may be requested at info@woodkit.pro.

7. Retention

• Orders, invoices and tax records: for applicable accounting, tax and statutory limitation periods.
• Account: while active and afterwards for the time needed to address liabilities.
• Queries and incidents: while they are handled and during applicable claim periods.
• Network applications: during assessment and, if rejected or withdrawn, for the minimum period required to document the decision.
• Marketing: until consent is withdrawn or an objection is made.
• Security logs: for limited periods proportionate to the risk.

8. Your rights

You may request access, rectification, erasure, restriction, objection and portability and may withdraw consent at any time. To exercise these rights, write to info@woodkit.pro, state the right requested and provide only the information strictly necessary to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the competent supervisory authority in your country.

9. Automated decisions

WOODKIT does not make decisions producing legal effects based solely on automated profiling. Payment and fraud-prevention providers may use their own automated controls to authorise, block or review transactions under their terms.

10. Security and confidentiality

We apply reasonable technical and organisational measures to protect data against loss, alteration, unauthorised access or disclosure. No system is infallible. Users must keep credentials confidential, use strong passwords and notify us immediately of unauthorised account use.

11. Cookies

Necessary cookies enable essential security, basket, checkout, language and session functions. Non-essential analytics, personalisation or marketing cookies will be activated only according to the preferences expressed through the Complianz-managed banner. Consent can be changed or withdrawn from the preference panel.

12. Minors

The store is not directed at minors and does not knowingly seek to collect their data. Anyone entering a contract confirms that they have sufficient legal capacity. If we identify a minor’s data processed without a valid legal basis, it will be deleted.

13. Service messages and marketing

Emails required to fulfil an order or protect an account are not advertising and cannot be disabled while an active transaction exists. Marketing messages will include a simple unsubscribe method. Marketing opt-out does not affect invoices, order notices, security, warranty or other contractual communications.

14. Changes to this policy

We may update this policy when processing activities, providers or legal requirements change. The current version is the one published on this page with its update date. Material changes will be communicated through an appropriate channel.

15. Contact

For privacy questions or rights requests: info@woodkit.pro. Use “Privacy” in the subject line to help us respond efficiently. Do not send passwords, full card details or unnecessary documents by email.