Privacy Policy

1. Data controller

The controller responsible for personal data processed through this website is Stephanie Álvarez Jiménez, a self-employed professional registered in Spain and operating under the publishing name Tofis Creations.

Privacy requests: tofiscreations@gmail.com

2. Personal data we process

The website may process:

• technical connection data, such as IP address, browser information, requested pages, timestamps and security or error logs;
• information you choose to send by email, including your email address, name, message and attachments;
• administrator account data, including email, hashed password, role and account timestamps;
• temporary password-reset and session security data.

The public website has no account registration, contact form, newsletter, advertising tracker or audience-measurement tool. It does not receive customer order or payment details from Amazon.

3. Purposes and legal bases

4. Recipients and service providers

Access is restricted to the authorised administrator and providers that need data to operate or secure the service. These may include:

• Hostinger International Limited, for hosting, technical logs and backups;
• Google Gmail, when you contact the publisher by email;
• professional advisers or public authorities where access is legally necessary.

Personal data is not sold.

5. International data locations

Hostinger stores the website on a server in the United Kingdom and automated backups in Germany. The European Commission currently recognises the United Kingdom as providing an adequate level of protection under the GDPR.

Email providers may process data in other countries. Where required, those transfers must rely on an adequacy decision or other safeguards recognised by data-protection law.

6. Retention

• Technical logs are retained only for the operational, diagnostic and security periods applied by the hosting provider.
• Automated hosting backups are created daily and replaced according to the hosting plan's rolling backup schedule.
• Email correspondence is kept only while needed to answer and follow up on the enquiry, or longer where required for legal claims or compliance.
• Administrator account data is retained while the account is required.
• Password-reset requests expire after 30 minutes and are removed after successful use.

Retention needs are reviewed periodically and data is deleted or anonymised when it is no longer required.

7. Your rights

Depending on the circumstances, you may request access, rectification, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests.

Send a request to tofiscreations@gmail.com . You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority in the EU country where you live or work.

8. Children

The website does not knowingly request or collect personal data from children. A parent or guardian who believes that a child has sent personal data may contact the publisher to request its deletion.

9. Security and policy updates

Reasonable technical and organisational measures protect the website, including restricted administration access, hashed passwords, CSRF protection, secure cookie settings and regular backups. No system can guarantee absolute security.

This policy may be updated when the website, providers or legal requirements change. The latest version and its update date will remain available on this page.