Privacy policy

Last updated: October 20, 2026

The short version

We collect only what we need to sell you the kit, deliver it, and keep the records the law requires.
We never see what you write in the kit. Your binder and your copy of the Family Hub stay with you.
We don’t send newsletters or marketing emails.
We don’t sell your personal data.
We use ad and analytics cookies only if you say yes in our cookie banner.

1. Who is responsible for your data

The data controller is Jose Enrique Ruiz Navarro, trading as The Folks File, a private individual (persona física) in Spain.

Address: Calle Alcalá y Ortí 20, 41002 Sevilla, Spain
Email for privacy questions: thefolksfile@gmail.com

Because we’re based in Spain, the EU General Data Protection Regulation (GDPR) and Spanish data protection law apply to how we handle your data, wherever you live.

2. What data we collect

When you buy (through Shopify’s checkout):

Your name, email address and billing address, and your phone number if you give it.
What you bought, the price, the order number and date, and whether the payment went through.
Technical data that Shopify collects to run the checkout and check for fraud, such as your IP address, browser and device type.

We don’t receive your full card number. Payment details go straight to the payment provider.

When you email us or use our withdrawal page:

Your name, email address, order number and what you write to us.

When you visit the store:

Data from cookies that the store needs to work (for example, to keep your cart).
Only if you accept them: analytics cookies (to see how people use the store) and marketing cookies, including the Meta pixel (to measure our ads on Facebook and Instagram). The Meta pixel runs in your browser. It records what you do in the store, such as the pages you view and whether you buy, together with technical data such as your IP address and browser. See section 9.

What we never collect:

Anything you write in the binder, the plan or your copy of the Family Hub. Those files stay on your devices or in your own Google account.

Please don’t send us passwords, full account numbers, Social Security numbers or other private details about your family. We never need them.

3. Why we use your data, and our legal basis

What we do	Data used	Legal basis (GDPR)
Process your order, deliver your files, send order emails and file updates through Dec. 31, 2027	Order data	Performing our contract with you (Art. 6(1)(b))
Handle refunds, withdrawals and file problems	Order data, your messages	Performing our contract (Art. 6(1)(b)) and meeting our legal duties as a seller (Art. 6(1)(c))
Answer your emails	Your messages	Our legitimate interest in answering you (Art. 6(1)(f))
Keep accounting and tax records	Order data	Legal obligation under Spanish tax and commercial law (Art. 6(1)(c))
Prevent fraud and keep the store secure	Order data, technical data	Our legitimate interest in preventing fraud (Art. 6(1)(f))
Measure our ads and see how people use the store	Cookie and Meta pixel data (what you do in the store, technical data)	Your consent (Art. 6(1)(a)), which you can withdraw at any time
Deal with legal claims	The records needed	Our legitimate interest in defending our rights (Art. 6(1)(f))
Answer your privacy requests	Your request	Legal obligation (Art. 6(1)(c))

You need to give your order data to buy the kit. Without it, we can’t complete your order.

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects. Shopify’s fraud checks may mark an order for review, and then we review it ourselves.

4. Who we share your data with

We share your data only with these companies, and only as needed:

Shopify (Shopify International Limited, Ireland), which runs our store, checkout, file delivery and order emails. Shopify handles your data on our behalf under a data processing agreement. Shopify also uses some data for its own purposes, such as fraud prevention across stores, Shop Pay and, where it applies, its Network Intelligence services. Shopify explains this in its Consumer Privacy Policy: https://www.shopify.com/legal/privacy/app-users. If you’re in the EU, the UK or Switzerland, you can object or withdraw consent at https://privacy.shopify.com.
Payment providers: Shopify Payments and its payment partners. If you pay with Shop Pay, Apple Pay, Google Pay or PayPal, that company also handles your data under its own privacy policy.
Meta (Meta Platforms Ireland Limited), only if you accept marketing cookies, and only through the Meta pixel in your browser. When the Meta pixel runs on our store, we and Meta are joint controllers for collecting that data and sending it to Meta. Meta is responsible for what it does with the data afterwards. See Meta’s Privacy Policy at https://www.facebook.com/privacy/policy.
Google (Google Ireland Limited), which provides our Gmail inbox, thefolksfile@gmail.com.
Our accountant or tax adviser in Spain, who keeps our books.
Public authorities, such as the Spanish tax authorities, when the law requires it.

If you make your own copy of the Family Hub in Google Sheets, it lives in your Google account under Google’s terms. We can’t open it.

We don’t sell your personal data.

5. Transfers outside the EU

Some of these companies handle data outside the European Economic Area:

Shopify transfers data to Canada, which has an EU adequacy decision, and to other countries, including the US, under the European Commission’s Standard Contractual Clauses.
Meta transfers data to the US under the EU-US Data Privacy Framework and Standard Contractual Clauses.
Google transfers data to the US under the EU-US Data Privacy Framework and Standard Contractual Clauses.

You can ask us for more information about these safeguards at thefolksfile@gmail.com.

6. How long we keep your data

Order and invoice records: 6 years, because Spanish commercial and tax law requires it.
Emails and requests you send us: up to 2 years after your last message, or longer if we need them for a legal claim or a legal duty.
Cookies: for the time shown in section 9, or until you delete them.

After that, we delete your data or make it anonymous. When Spanish law requires it, we first keep the data blocked, available only to courts and authorities, until any possible claims expire.

7. Your rights

You can ask us to:

Give you a copy of your data (access).
Correct data that’s wrong (rectification).
Delete your data (erasure), unless the law requires us to keep it.
Limit how we use your data (restriction).
Send your data to you or to another company in a common format (portability).
Stop using your data based on our legitimate interests (objection).

You can also withdraw your consent to cookies at any time, using “Cookie preferences” at the bottom of every page. Withdrawing consent doesn’t affect what happened before.

How to ask: email thefolksfile@gmail.com with the subject “Privacy request.” We may ask for information to confirm it’s you, such as your order number. We reply within one month. It’s free.

Complaints: if you think we haven’t handled your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, https://www.aepd.es. If you live in another EU country, you can also complain to the data protection authority there. We’d be grateful if you contacted us first, so we can try to fix it.

8. If you live in the US

Some US states have their own privacy laws. Most of them apply only to businesses above certain size limits, which may not include us. We give everyone the rights in section 7, wherever they live.

We don’t sell your personal data. Some US state laws call ad cookies and pixels “sharing” or “targeted advertising.” We use them only with your OK.
To opt out of the sale or sharing of your data and of targeted advertising, use Your privacy choices or turn on Global Privacy Control (GPC) in your browser. Our store treats a GPC signal as a request to opt out.
You can also say no to ad cookies in our cookie banner, or change your mind later in “Cookie preferences.”
We don’t treat you differently for using your rights.

9. Cookies

Cookies are small files a website saves in your browser. We use:

Type	Who sets it	What for	How long	Needs your OK?
Necessary	Shopify	Keep your cart, run checkout, remember your cookie choice, keep the store secure	Session to 1 year	No
Analytics	Shopify	See how people use the store, in summary form	Up to 1 year	Yes
Marketing	Shopify	Ad-related data for the store	Up to 1 year	Yes
Marketing	Meta (Meta pixel, for example the _fbp cookie)	Measure our ads on Facebook and Instagram and show them to people more likely to find them useful	Up to 90 days	Yes

The first time you visit, our banner asks you to accept, decline or choose. Declining is as easy as accepting. Until you accept, only necessary cookies run. You can change your choice at any time with “Cookie preferences” at the bottom of every page, or by deleting cookies in your browser.

10. Children

The kit is for adults. We don’t knowingly collect data from anyone under 18.

11. Security

Shopify runs our store and checkout on secure, encrypted connections. We protect our own accounts with strong passwords and two-step sign-in. No system is perfectly secure, so please don’t email us sensitive details.

12. Changes to this policy

If we change this policy, we post the new version here and update the date at the top.

13. Contact

Jose Enrique Ruiz Navarro, trading as The Folks File
Calle Alcalá y Ortí 20, 41002 Sevilla, Spain
thefolksfile@gmail.com