Last updated: September 3, 2026.
Data controller
Controller: CAR1MILLON. The controller’s complete legal identity and business address are stated in the Legal Notice.
Privacy: privacidad@car1millon.com
Data we process
We may process identification and contact details, the content of enquiries, configuration preferences, order, billing, payment and shipping details, communication history, information required to prevent fraud and technical browsing data. We do not request special categories of personal data.
Purposes and legal bases
- Enquiries and private access: taking requested pre-contractual steps and our legitimate interest in responding.
- Commissions and purchases: preparing, entering into and performing the contract.
- Payment, invoicing, delivery, warranty and after-sales service: performing the contract and complying with legal obligations.
- Marketing communications: consent or another basis permitted by law, with the option to unsubscribe.
- Security and fraud prevention: legitimate interests and legal obligations.
Service providers and recipients
Data may be processed by providers required to deliver the service: Shopify as the e-commerce platform; Google Workspace as the email service; payment providers available during checkout; carriers, insurers and logistics operators confirmed for each shipment; professional advisers; and, where their functions are active and a valid legal basis exists, Meta tools connected through the Facebook & Instagram channel.
Shopify Network Intelligence is enabled on the store. Its use for personalisation, measurement and advertising is subject to the available privacy and consent controls. You can consult Shopify's privacy information.
Where a provider processes data outside the European Economic Area, safeguards recognised by law will apply, such as adequacy decisions or standard contractual clauses, as appropriate.
Retention
Order and invoicing data will be retained for the duration of the contractual relationship and the applicable statutory periods. Enquiries that do not result in a contract will be retained for as long as necessary to respond and, as a general rule, for no more than 24 months, unless they must be kept to comply with a legal obligation or to establish, exercise or defend legal claims.
Your rights
You may request access, rectification, erasure, restriction, objection or portability, and withdraw consent where processing is based on it, by writing to privacidad@car1millon.com. We may request reasonable information to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency.
Automated decisions and minors
CAR1MILLON does not make decisions based solely on automated processing that produce legal effects for the customer. The service is not directed at minors, and we do not knowingly collect their data without the required authorisation.
Security and changes
We apply reasonable measures to protect information and will review this policy whenever processing activities, service providers or legal requirements change.
Usage analytics and request emails
With your consent, we use Microsoft Clarity to understand how visitors use the site: pages visited, clicks, scrolling and technical information about the device. Text typed into forms is masked and is not recorded. If you decline analytics cookies, Clarity operates without cookies and cannot link your visits over time. Microsoft processes this data under its own Privacy Statement.
When you send a private request from the atelier or the commission page, your name, email address and the composition you selected are used to send you a confirmation email. This email is sent through Resend, from a service hosted on Railway, and is used only for that purpose.