Privacy policy

1. Information for users

KUDO CANARIAS S.L., as data controller, informs you that we process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), in connection with browsing, purchasing products and providing services through https://kudo-shop.com (Kudo Shop) and related channels.

This policy describes what data we collect, for what purposes, how long we keep it, the legal bases, and your rights.

2. Data controller

Controller: KUDO CANARIAS S.L.. Activity: retail of cycling goods and related services (KUDO Rent / Kudo Shop brands). Address: Av. Quinto Centenario, 26, 38683 Puerto de Santiago, Santa Cruz de Tenerife, Spain. Privacy contact email: contact@kudo-rent.com.

3. Data we process

Identification and contact data (name, phone, email). Order and billing data (delivery or pickup address, purchase history). Payment data: card and wallet payments are processed by payment providers (e.g. Stripe or PayPal); we do not store full card numbers on our servers when payment is tokenised by those providers.

Technical and browsing data (IP address, device identifiers, cookies —see the Cookie policy—) when you accept them or when they are strictly necessary for secure operation of the site.

If you subscribe to a newsletter or agree to marketing, we process your email and preferences as stated at signup.

4. Purposes and legal bases

Order management, payment, shipping or preparation for store pickup; customer service and warranties: performance of a contract (Art. 6(1)(b) GDPR).

Compliance with tax, accounting and consumer law obligations (Art. 6(1)(c) GDPR).

Site security, fraud prevention and service improvement: legitimate interests (Art. 6(1)(f) GDPR), balanced against your rights.

Statistical analysis and, where applicable, personalised advertising only if you have given consent via the cookie banner or relevant forms (Art. 6(1)(a) GDPR).

Commercial communications: consent or, where applicable, legitimate interest in accordance with e-privacy rules — you may object at any time.

5. Retention

We keep data for as long as necessary for the purposes above and, in any case, for statutory retention periods (e.g. commercial and tax records). Marketing data is kept until you withdraw consent or object.

6. Recipients and processors

We may share data with service providers acting as processors (hosting, email, payment gateways, analytics if you accept them), under GDPR-compliant agreements or standard clauses.

International transfers may occur when a provider is outside the EEA; we apply appropriate safeguards (standard contractual clauses, adequacy decisions, or other mechanisms under the GDPR).

We do not sell your personal data. We may disclose information to authorities when legally required.

7. Your rights

You may exercise rights of access, rectification, erasure, restriction, objection and portability by emailing us at the address below, proving your identity where needed.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You have the right to lodge a complaint with a supervisory authority (in Spain: www.aepd.es).

8. Minors

Our services are aimed at adults with legal capacity. If you are a parent or guardian and believe a child has provided data to us, contact us to request deletion.

9. Returns and withdrawal (summary)

Under applicable EU consumer rules for distance contracts, you generally have 14 calendar days to withdraw without giving reasons, subject to legal exceptions. Refunds will be processed in line with our sale terms and statutory time limits once the goods or required documentation are received.