Privacy policy

Last updated: 25 October 2026.

1. Who processes your data

Aspigo Producciones SL ("The Gulag"), tax ID (NIF) B88705181, registered in the Madrid Companies Register, sheet M-882847. Address: calle Azuela 31, oficina 36, 28400 Collado Villalba (Madrid), Spain. Email: gulagfight@gmail.com. Phone: +34 633 738 923.

The Gulag is not required to appoint a data protection officer; for any question about your data, write to the email above.

2. What we use your data for, on what basis and for how long

Purpose	Data	Legal basis (GDPR)	Period
Managing your orders: payment, preparation, shipping and order communications	Name, email, phone, shipping and billing address, products bought. Card details are handled by the payment gateway; we never see or store them.	Performance of the contract (art. 6.1.b)	For the duration of the relationship and then the legal periods in the next row
Meeting accounting and tax obligations (invoices, books)	Order and billing data	Legal obligation (art. 6.1.c)	6 years (art. 30 of the Spanish Commercial Code) and 4 years for tax purposes (art. 66 of the General Tax Law)
Handling returns, withdrawals and guarantees	Order data and whatever you tell us	Performance of the contract and legal obligation (arts. 6.1.b and 6.1.c)	Up to 3 years from delivery (legal guarantee period)
Replying to people who write to us (email, WhatsApp or contact form)	Name, contact details and the message	Pre-contractual steps at your request or legitimate interest in replying (arts. 6.1.b and 6.1.f)	The time needed to reply and at most 1 year
Reviewing sponsorship and partnership proposals ("Do you have a brand...?" form)	First name, last name, phone, email, company and sector	Pre-contractual steps at your request (art. 6.1.b)	For the duration of the conversation or partnership and, if there is no agreement, 1 year
Sending you news about our events and merchandise by email and, if you agree, by SMS (newsletter, prize wheel and the checkout box)	Email; your mobile number, if you give it for SMS; and, if you play the wheel, the prize you won	Your consent (art. 6.1.a and art. 21 of Law 34/2002), which you can withdraw at any time	Until you unsubscribe
Giving out the wheel prizes (the discount code, valid for 7 days, which we remind you of by email if you haven't used it after 3 days, and the ticket for the next event) and preventing anyone from playing more than once	Email, the prize and its code, and an encrypted fingerprint of the connection (not the IP address) for one hour to prevent abuse	Performance of the wheel rules (art. 6.1.b) and legitimate interest in preventing fraud (art. 6.1.f)	Until the prize is delivered and then 1 year
Analytics and marketing cookies	Browsing data	Your consent (art. 6.1.a)	As set out in the cookie policy

We do not make automated decisions with legal effects on you or build profiles for that purpose. The wheel prize is drawn at random with the odds published in its rules.

We do not knowingly collect data from children under 14 (art. 7 of Organic Law 3/2018). You must be of legal age to buy.

3. Who we share your data with

Shopify (Shopify International Ltd., Ireland), which hosts the shop and processes data on our behalf.
The payment gateways you choose at checkout (Shopify Payments, PayPal, Bizum, Apple Pay or Google Pay), to take payment.
The carrier that delivers your order: your name, address and phone.
Supabase (Supabase Inc.), which hosts our management system, where we keep the wheel entries and the contact list, on servers in the European Union (Paris); as a US company, it is bound by the European Commission's standard contractual clauses.
Our accountants, to keep the books and file taxes.
Public authorities (for example, the Spanish Tax Agency) when the law requires it.

Transfers outside the European Union. Shopify and PayPal may process data in Canada and the United States. Canada has an adequacy decision from the European Commission; for the United States, these companies are certified under the EU-US Data Privacy Framework or use the standard contractual clauses approved by the Commission (art. 46 GDPR). You can ask us for more information at the email above.

4. Your rights

You can ask us at any time to access your data, rectify it, erase it, restrict or object to its processing, for portability of your data and to withdraw your consent (without affecting what was done before). Write to gulagfight@gmail.com saying which right you want to exercise. We will only ask you to prove your identity if we have reasonable doubts that it is you (art. 12.6 GDPR).

To unsubscribe from the newsletter, just click the "unsubscribe" link in any of our emails or write to us.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

5. Security

We apply appropriate technical and organisational measures to protect your data (the shop always runs over an encrypted connection), and only the people who need it for the purposes above can access it.