Privacy Policy

1. Controller

The controller for personal data processed through collafugas.com is the operator of this website. You can reach us, including for anything data-protection related, at [email protected]. Please put "Data protection" in the subject line so your message is routed correctly.

2. What we collect

• Technical data collected automatically by our hosting provider and content delivery network: IP address (usually truncated or hashed for analytics), user-agent string, device type, operating system, browser language, referring URL, requested pages, response codes and timestamps.
• Usage and measurement data: pages viewed, time on page, scroll depth, whether a promotional link was clicked, and an anonymous or pseudonymous identifier held in a cookie or in local storage.
• Campaign attribution data: click identifiers and campaign parameters appended to the URL by advertising networks such as Outbrain, Taboola, Meta or Google, used to establish which advert brought you here.
• Consent data: the choice you make in the cookie banner and the time it was made, stored in your browser.
• Correspondence: your email address and the content of any message you send us.

We do not ask for or knowingly collect payment card details, bank details, delivery addresses or account credentials on this website. If you buy a product, that information is collected by the seller under its own privacy notice, and we never see it.

3. Why we process it, and our legal basis

• Serving and securing the site — legitimate interests (Article 6(1)(f) UK GDPR): delivering pages, preventing abuse, fraud and bot traffic, and diagnosing faults.
• Analytics and audience measurement — consent (Article 6(1)(a)) where non-essential cookies or similar technologies are used; otherwise aggregated server logs under legitimate interests.
• Advertising measurement and conversion attribution — consent, so that we and our advertising partners can tell whether a campaign worked and can be paid correctly.
• Responding to your enquiries — legitimate interests, or performance of a contract where relevant.
• Meeting legal obligations — legal obligation (Article 6(1)(c)), for example retaining records needed for tax, advertising compliance or responding to a lawful request.

We do not carry out automated decision-making that produces legal effects for you, and we do not knowingly process special category data. Where we rely on consent you may withdraw it at any time; withdrawal does not affect processing that already took place.

4. Cookies and similar technologies

Strictly necessary cookies and local-storage entries are set without consent, including the record of your cookie choice. Analytics and advertising technologies are only activated if you accept them in the banner. Full details, including categories and typical lifetimes, are in our Cookie Policy.

5. Who we share data with

• Hosting and CDN providers, which process server logs on our instructions as processors.
• Analytics providers, for aggregated audience measurement.
• Advertising and native-ad networks, including Outbrain, which receive click and conversion signals to attribute campaign performance. Some of these act as independent controllers for their own measurement purposes under their own privacy notices.
• The advertiser or retailer whose page you visit after clicking a promotional link, which then processes your data under its own notice.
• Professional advisers, regulators or law enforcement, where we are legally required or permitted to disclose.

We do not sell personal data.

6. International transfers

Some providers are located outside the United Kingdom, including in the United States and the European Economic Area. Where data leaves the UK we rely on UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with additional technical and organisational safeguards such as encryption in transit and data minimisation.

7. Retention

• Raw server and security logs: typically up to 90 days.
• Aggregated analytics reports: up to 26 months, after which they are retained only in a form that cannot identify an individual.
• Advertising attribution identifiers: for the attribution window set by the network, commonly up to 30 days, and up to 12 months for billing reconciliation.
• Email correspondence: up to 24 months after the matter is closed, longer where needed for a legal claim.
• Consent records: up to 12 months, or until you change your choice.

8. Your rights

You have the right to be informed; to access a copy of your data; to rectification of inaccurate data; to erasure; to restrict processing; to data portability; to object to processing based on legitimate interests, including profiling for advertising measurement; and to withdraw consent at any time. To exercise any of these, email us at the address above. We respond within one month and may ask for information to verify your identity or to locate records, since most of what we hold is pseudonymous and cannot be linked to a named person without additional detail such as an IP address and timestamp.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113). We would appreciate the chance to resolve the issue first.

9. Security

The site is served over HTTPS. We apply access controls, keep software patched, minimise the data we collect, and prefer aggregated or pseudonymous reporting. No internet service can be guaranteed completely secure, and you send information to us at your own risk.

10. Children

This website is intended for adults aged 18 or over and is not directed at children. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes

We may update this notice to reflect changes to the site, our partners or the law. The date at the top of this page shows the current version, and material changes will be highlighted on the site.