Last updated July 2026
Draft — needs legal review before launch
This policy was drafted from the shop's actual practices, but Spanish consumer and e-commerce law requires specific mandatory disclosures and the company's registration details. Have a Spanish lawyer or gestor check it, fill in the [TO CONFIRM] items, then remove this banner by passing reviewNote={false}.
Who we are
Golf City Sports S.L. ("we", "us") operates this website and the golf shop at Urb. El Pilar, Edificio Notaría Bajo, Km 168, A-7, 29688 Estepona, Málaga, Spain. Company registration number (CIF/NIF): [TO CONFIRM].
For any question about your data, or to exercise any of the rights described below, contact us at mario@golfcitysports.com or call +34 952 896 710. We are the data controller for the information described here.
What we collect
We only collect what we need to sell you something, book you an appointment, or answer your question. Specifically:
- Orders: your name, email address, phone number and delivery address.
- Appointments: your name, email, phone number, and optionally your handicap, whether you are right or left handed, and any notes you choose to add.
- Enquiries and affiliate applications: your name, email, phone number and the content of your message.
- Technical data: your IP address and basic request information, kept in server logs for security and troubleshooting.
Payment information
We never see, handle or store your card details. Card payments are processed entirely by Stripe on their own hosted checkout page. Stripe is PCI-DSS compliant and acts as an independent data controller for the payment data you give them — their privacy policy applies to that part of the transaction.
If you pay by bank transfer, we see only what appears on our bank statement. If you pay in the shop, card details are handled by our card terminal provider and not recorded by us.
Legal basis for processing
Under Article 6 of the GDPR we rely on: performance of a contract, for processing orders, appointments and rentals; legitimate interests, for answering your enquiries, keeping our records straight and preventing fraud; and legal obligation, for retaining invoices and tax records as Spanish law requires.
We do not rely on consent for marketing because we do not run a marketing list. If that ever changes you will be asked to opt in explicitly, and opting in will never be a condition of buying anything.
Who we share it with
We do not sell your data and we do not share it for advertising. We share the minimum necessary with:
- Stripe — to take card payments (payment data only).
- Our courier — name, address and phone number, so they can deliver your order.
- Our email provider — to deliver order confirmations and reply to your enquiries.
- Our accountant and the Spanish tax authorities — invoice records, as legally required.
How long we keep it
Order and invoice records are kept for the period Spanish tax law requires, which is currently a minimum of four years and up to six for accounting records. Appointment records are kept for two years so we can look up your previous fitting specifications — genuinely useful when you come back for a new set. Enquiry emails are kept for twelve months. Server logs are kept for 30 days.
Cookies and analytics
This website sets no advertising cookies and runs no third-party tracking or advertising scripts. Your basket is stored in your browser's own local storage on your device, not on our servers, and is never transmitted anywhere until you check out.
If we add analytics in future, it will be a privacy-respecting, cookie-free tool, and this section will be updated before it goes live. [TO CONFIRM: update this section if any analytics or advertising pixel is added.]
Your rights
Under the GDPR you have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. Email us and we will action it within one month, usually far sooner — we are a small shop, not a call centre.
If you are not happy with how we have handled your data you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at aepd.es.
Security
This site is served over HTTPS. Order and appointment data is transmitted encrypted. We keep access to customer information limited to the people in the shop who need it to do the job.
No system is perfectly secure. If a breach ever affected your data we would tell you and the AEPD within the timeframes the GDPR requires, rather than hoping nobody noticed.