PRIVACY POLICY

Last updated: 11 November 2026

At DISHESTONE, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit www.dishestone.com, contact us, request information, place an order or use any of our services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), and other applicable European and Spanish data protection legislation.

1. DATA CONTROLLER

The controller responsible for the processing of personal data through this website is:

Commercial name: DISHESTONE
Legal owner / Company: CRISTINA A. GUTIERREZ
Tax Identification Number (NIF/CIF): 45599660K
Registered address:POLIGONO INDUSTRIAL RUBIRA SOLA C/ CANTORIA N1
Country: Spain
Email: INFO@DISHESTONE.COM
Website: www.dishestone.com

For any question concerning privacy or the processing of your personal data, you may contact us using the email address above.

2. PERSONAL DATA WE MAY COLLECT

Depending on how you interact with DISHESTONE, we may collect personal information such as your name, surname, email address, telephone number, billing and delivery address, country, company name, VAT or tax information where applicable, order details, products purchased, communications with us and information relating to bespoke projects or quotation requests.

When you place an order, payment information is processed through authorised payment service providers. DISHESTONE does not need to store your complete payment card details.

We may also receive technical information generated when you use the website, such as IP address, browser type, device information, pages visited, approximate location derived from technical information and information collected through cookies or similar technologies, where permitted by law.

3. WHY WE PROCESS YOUR PERSONAL DATA

We may process personal data for the following purposes:

Orders and purchases.
To process purchases, confirm orders, manage payments, prepare products, arrange delivery, provide invoices and communicate with you regarding your order.

Bespoke projects and enquiries.
To respond to requests for information, quotations, customised products, professional projects and other enquiries.

Customer service.
To provide assistance before, during and after a purchase and to manage incidents, returns, transport claims or other customer requests.

Legal and accounting obligations.
To comply with applicable tax, accounting, consumer protection and other legal obligations.

Website security and operation.
To protect the website, prevent fraud or misuse, maintain technical security and ensure the proper functioning of our services.

Marketing communications.
To send information about DISHESTONE products, collections, launches, events or offers when permitted by applicable law and, where required, when you have given your consent.

Analytics and advertising technologies.
Where you have consented, we may use analytics or advertising technologies to understand how visitors interact with the website and to measure or improve advertising campaigns.

4. LEGAL BASIS FOR PROCESSING

The legal basis depends on the purpose for which your information is processed.

Processing necessary to manage an order, purchase, quotation or bespoke project is generally based on the performance of a contract or steps taken at your request before entering into a contract.

Processing required for invoicing, accounting, taxation or other mandatory requirements is based on compliance with legal obligations.

Certain activities necessary to protect our website, prevent fraud, improve our services or manage legitimate business operations may be based on our legitimate interests, provided that those interests do not override your fundamental rights and freedoms.

Marketing communications and non-essential cookies or tracking technologies will rely on consent whenever consent is required by applicable law.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. WHO MAY RECEIVE YOUR PERSONAL DATA?

We do not disclose personal data unnecessarily.

Where necessary for the operation of our business, the management of orders or compliance with legal obligations, personal data may be shared with trusted service providers and third parties such as:

  • Website, hosting and e-commerce service providers

  • Payment service providers and financial institutions

  • Transport and logistics companies

  • Accounting, tax and professional advisers

  • IT, cybersecurity and technical service providers

  • Analytics and digital service providers, where applicable and legally permitted

  • Public authorities where disclosure is required by law

Only the personal data reasonably necessary for each purpose will be shared.

For example, transport providers will receive only the information necessary to manage and deliver an order.

Our service providers are required to process personal data securely and in accordance with applicable data protection requirements.

Where a third-party service provider processes personal data outside the European Economic Area, appropriate safeguards will be applied where required by applicable data protection law.

6. INTERNATIONAL DATA TRANSFERS

Some technology or service providers may process personal data from countries outside the European Economic Area.

Where personal data are transferred internationally, appropriate safeguards will be used as required under the GDPR.

These safeguards may include a European Commission adequacy decision, Standard Contractual Clauses approved by the European Commission or other legally recognised transfer mechanisms.

Where necessary, additional technical or organisational safeguards may also be implemented.

7. HOW LONG WE KEEP YOUR DATA

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected.

Order, invoice and transaction information may be retained for the periods required by applicable tax, accounting and commercial legislation.

Information relating to enquiries or quotation requests may be retained for a reasonable period in order to manage the enquiry and any subsequent commercial relationship.

Information processed for marketing purposes will be retained until you withdraw your consent, unsubscribe or otherwise object to the processing, subject to any information that must be retained to demonstrate compliance with legal obligations.

Technical and cookie-related information is retained according to the applicable purpose and cookie configuration.

Once information is no longer required, it will be deleted, anonymised or securely blocked where required by law.

8. YOUR DATA PROTECTION RIGHTS

Under the GDPR and applicable data protection legislation, you may have the right to:

  • Access the personal data we hold about you.

  • Rectify inaccurate or incomplete personal data.

  • Request erasure of your personal data where legally applicable.

  • Request restriction of processing in certain circumstances.

  • Object to certain processing based on legitimate interests.

  • Object at any time to direct marketing.

  • Request data portability where the legal requirements are met.

  • Withdraw consent at any time where processing is based on consent.

  • Lodge a complaint with the competent data protection authority.

To exercise these rights, contact us at [EMAIL], clearly indicating the right you wish to exercise.

We may request reasonable information necessary to verify your identity before responding to a request.

If you believe that your personal data have not been processed in accordance with applicable law, you also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) or, where applicable, another competent European supervisory authority.

9. DIRECT MARKETING

We may send commercial communications regarding DISHESTONE products, collections, services or offers only where permitted by applicable law.

Where consent is required, such communications will only be sent after the appropriate consent has been obtained.

Every electronic marketing communication will provide an appropriate method to unsubscribe or object to future marketing communications.

Withdrawing consent or unsubscribing from marketing will not affect communications that are necessary to manage an existing order, transaction or customer service request.

10. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies.

Some cookies are technically necessary for the operation of the website, shopping cart, checkout, security or other essential functions.

Analytics, personalisation or advertising cookies that are not strictly necessary will only be activated where legally permitted and, where required, after obtaining the user's consent.

Users must be able to accept or reject non-essential cookies and change or withdraw their preferences.

Continuing to browse the website will not by itself be treated as valid consent to non-essential cookies.

More detailed information regarding cookies, their purposes, providers and duration should be provided in our Cookie Policy and through the website's cookie preference controls.

11. PAYMENT SECURITY

Online payments are handled through specialised payment service providers.

Depending on the payment method selected, payment providers may collect and process information necessary to authorise and complete the transaction, prevent fraud and comply with financial or regulatory obligations.

DISHESTONE does not require access to or storage of complete payment card credentials in order to process your purchase.

12. WEBSITE ANALYTICS AND ADVERTISING

Where analytics or advertising tools are enabled, information regarding website use may be processed to measure traffic, understand user interaction, evaluate advertising performance and improve our digital services.

Where these technologies require consent under applicable European law, they will not be activated until the user has provided valid consent.

Users may subsequently modify or withdraw their preferences through the available cookie settings.

13. SECURITY

We take reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, loss, destruction or disclosure.

Nevertheless, no internet transmission or electronic storage system can guarantee absolute security.

If a personal data breach occurs that is subject to notification requirements under applicable law, DISHESTONE will take the measures required by the GDPR and applicable legislation.

14. CHILDREN'S PRIVACY

DISHESTONE's products and services are not specifically directed at children.

We do not knowingly seek to collect personal data from minors for marketing purposes.

Where consent from a minor would require authorisation from a parent or legal guardian under applicable law, such processing will only take place in accordance with the applicable legal requirements.

15. AUTOMATED DECISION-MAKING

DISHESTONE does not intend to make decisions producing legal or similarly significant effects on customers solely through automated processing unless expressly disclosed and permitted by applicable law.

If such processing is introduced in the future, appropriate information and safeguards will be provided as required by the GDPR.

16. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites or services.

DISHESTONE is not responsible for the privacy practices of independent third parties.

We recommend reviewing the privacy information provided by those third parties before providing them with personal information.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy when necessary to reflect changes in our services, technologies, legal obligations or data protection requirements.

The current version will always indicate the date of its latest update.

Where changes are material and applicable law requires additional notification or consent, appropriate measures will be taken.

18. CONTACT

For privacy-related questions or to exercise your data protection rights, please contact:

DISHESTONE
Legal owner / Company: CRISTINA A. GUTIERREZ
NIF/CIF: 45599660K
Address: POLIGONO INDUSTRIAL RUBIRA SOLA C/ CANTORIA N1
Spain
Email: INFO@DISHESTONE.COM

DISHESTONE — Natural stone. Handcrafted in Spain.