Privacy and purchases
Privacy policy
Legal information for the catalog, accounts, forms, alerts and technologies used by the website.
3.1 Data controller
MASET DE RATERA, SOCIEDAD LIMITADA, NIF B13962725, with registered address at Camino de la Ratera, 22, 08732 Castellví de la Marca (Barcelona), España, is the controller of the processing described in this policy. Data protection contact: succulon@gmail.com.
3.2 Data processed, purpose, legal basis and retention
A. User account
The data processed are first name, surname, email address, a password protected by WordPress, optional telephone number, country, botanical preferences, newsletter and order-alert choices, and the date on which the privacy policy and terms were accepted. The purposes are to create and administer the account, authenticate access, store preferences and provide the requested functions.
The legal bases are taking pre-contractual steps or providing the requested account service, consent for optional communications, and legitimate interests in protecting the service. Data are retained while the account remains active and are subsequently restricted for the periods required to address obligations or liabilities.
B. Contact form
The data processed are name, email, subject, message, language and evidence of the acceptance displayed on the form. The purposes are to respond to the enquiry and manage the requested relationship. The legal basis is consent and, where an enquiry concerns a possible contractual relationship, taking pre-contractual steps. As a proposed operating policy, closed enquiries will be deleted or anonymized within a maximum of 12 months unless they must be retained because of an active relationship, complaint or legal obligation.
C. Alerts and marketing communications
The data processed are email address, language, interest categories and evidence of consent. The purpose is to send only the selected alerts. The legal basis is consent, which may be withdrawn at any time through the mechanism included in the communication or by writing to succulon@gmail.com. After an unsubscribe request, a minimal suppression record may be retained to prevent further messages and demonstrate compliance.
D. Security, operation and preferences
The data processed may include IP address, date and time, technical identifiers, browser, security events, language, session, cookie consent and locally stored browsing interests where the person authorizes this. The purposes are to maintain security, prevent abuse, remember preferences and measure the service only where consent is required and has been given. The legal bases are legitimate interests in security, legal compliance and consent for non-essential technologies. Security logs will be retained for the minimum period compatible with investigating incidents; an ordinary maximum of 12 months is proposed, subject to validation by counsel and the hosting provider.
E. Orders, payments and chat
To process purchases and provide support we use contact, billing and delivery details, products, amounts, taxes, payment references and states, plus messages and files you provide in the order chat. The bases are performance of the contract, legal obligations and legitimate interests in security and handling claims. Data is kept while handling the order and for applicable legal periods; closing the chat does not automatically delete it. WooCommerce manages orders, WooPayments processes payments and the site uses its existing email transport. Do not send full card details, security codes or unnecessary documents in the chat.
3.3 Mandatory data and consequences
Fields marked as mandatory are required for the requested function. If they are not provided, the account cannot be created, the enquiry cannot be sent or the relevant alert cannot be registered. Newsletter and marketing-preference options must be separate, voluntary and not preselected.
3.4 Recipients and processors
Existing WordPress/Elementor, maintenance, security, WooCommerce, WooPayments and email providers process the data needed for their functions. The agreed carrier receives the details needed for delivery. Information is disclosed to authorities when legally required. Marketing consent is not required to buy.
3.5 International transfers
Some technology providers or their subprocessors may operate outside the European Economic Area. Before this policy is published as final, SUCCULON must verify contracts, locations and applicable mechanisms, such as adequacy decisions or standard contractual clauses. No specific safeguard will be claimed without contractual evidence.
3.6 Rights
Data subjects may request access, rectification, erasure, objection, restriction and portability, and may withdraw consent without affecting prior lawful processing. Requests may be sent to succulon@gmail.com, stating the right being exercised and the information necessary to identify the account or interaction. Additional documentation will be requested only where necessary to verify identity.
A complaint may also be lodged with the Spanish Data Protection Agency at https://www.aepd.es. Exercising rights is free of charge, except for manifestly unfounded or excessive requests under the conditions permitted by law.
To request deletion of specific personal data without deleting your SUCCULON account, email succulon@gmail.com from the address associated with the account. Specify which data you want deleted and that you want to keep the account. Identity checks and handling follow the process in this section; data that must be retained remains subject to section 3.2.
3.7 Minors
The website is not specifically directed at minors and does not seek to obtain their data for marketing. If an account or consent that does not meet the legal requirements applicable to minors is detected, measures will be taken to verify the situation and restrict or erase the relevant data.
3.8 Security and automated decisions
Access control, authentication, logging, backup and data-minimization measures proportionate to the risk are applied. Personalizing the order of certain products may use interests stored in the browser, but it does not produce legal effects or decisions of similarly significant importance. No advertising profiling is carried out without consent.
3.9 Policy changes
Material changes will be published with a new version and date. Where a change affects the basis of processing or requires new consent, that consent will be requested before the change is applied.
Legal and privacy contact
For legal, privacy or policy enquiries: succulon@gmail.com.
3.10 SUCCULON customer app
Version 1.1 supplement · 21-10-2026. The app is being tested. If you choose to connect it through the website sign-in, it can read your name, email and your own orders. It receives no Studio permissions, other customers’ data or authority to charge you. Purchases are completed in the shop.
The device keeps session credentials and a dated copy of your orders in its protected storage. Short-lived access (15 minutes) may be renewed within a revocable session lasting no more than 30 days. Signing out clears the local copy and requests revocation of the server session. A password change or account block prevents further access.
This version includes no advertising or native analytics tracking SDK. Connecting your account does not grant marketing consent; communication preferences are managed separately. The account deletion option sends an authenticated request to SUCCULON’s existing privacy queue. It does not automatically delete the account or documents subject to applicable retention obligations. You can exercise your rights using the contact in this policy.
How to request account deletion
- In the SUCCULON app, open “Profile”, sign in through the existing website, choose “Request account deletion” and confirm the request.
- Without the app, email succulon@gmail.com from your account’s email address and request deletion of your SUCCULON account. We may ask you to verify your identity where needed.
The request enters the existing WordPress privacy queue and requires review; it does not mean immediate deletion. It covers the account and associated personal profile and contact data, including name and email, account preferences and app sign-in data. Order, payment, billing and accounting records that must be retained for obligations or liabilities remain subject to section 3.2, as do the minimal security or suppression records described there. No new retention period is introduced here.
Signing out clears the protected local order cache and requests revocation of the native session on the server; signing out does not delete the account. Favourites and interests stored only on the device are removed separately on that device.
We will process the account deletion request within one calendar month and confirm completion of the deletion by email to the address associated with the account. Required records are retained in accordance with section 3.2.