Privacy policy

This page explains what personal data we process on thejokerhouse.com, where it comes from, what we use it for, on what legal basis, how long we keep it, who else receives it and how you can exercise your rights. It is written to be understood without legal training.

1. Who the data controller is

• Controller: Site Factory Digital Agency S.L.
• Spanish tax number (NIF): B88047444
• Registered address: Calle Velero 26, 3.º A, 28220 Majadahonda (Madrid), Spain
• Website: thejokerhouse.com
• Contact: contact form

Given the type and volume of data we process we are not required to appoint a Data Protection Officer and we have not appointed one. If we ever do, we will publish their contact details here.

2. What data we process and where it comes from

All the data we process is given to us by you, apart from what your own browsing generates. We do not buy lists and we do not obtain data from third parties.

• Identification and contact: first name, surname, email address and, if you provide it, phone number.
• Address: delivery and billing address, and the identity document number when customs or the invoice require it.
• Order: products, amounts, date, payment method, shipping and returns. We neither see nor store your full card number: it is handled directly by the payment gateway.
• Customer account: encrypted password, saved addresses, order history, wishlist and Joker Points balance.
• Enquiries: what you write to us through the contact form or by replying to our emails, together with the order it refers to.
• Reviews: the rating and comment you publish about a product, under the name you choose to display.
• Browsing: IP address, device and browser type, pages viewed and traffic source, as set out in the cookie policy.

3. What we use your data for and on what legal basis

Each purpose has its own legal basis. Those based on your consent can be withdrawn whenever you want, and those based on the contract are essential in order to buy.

• Managing your order —payment, picking, shipping, tracking, returns and warranty—. Basis: performance of the contract (Art. 6.1.b GDPR).
• Issuing and keeping the invoice and meeting our accounting and tax obligations. Basis: legal obligation (Art. 6.1.c GDPR).
• Managing your customer account and the Joker Points programme. Basis: performance of the contract.
• Customer service: answering your enquiry and giving you the support you ask us for, through the contact form or by replying to our emails. Basis: your own request, and the contract when the enquiry is about an order.
• Sending you the newsletter and commercial communications. Basis: your consent (Art. 6.1.a GDPR).
• Publishing your product review. Basis: your consent when you publish it.
• Measuring and improving the site with analytics and advertising cookies. Basis: your consent given in the cookie notice.
• Preventing fraud and keeping the shop secure. Basis: our legitimate interest in the shop working and not being used to defraud.

4. How long we keep your data

We do not keep anything "indefinitely". Every piece of data has its own period, and when it expires we delete or anonymise it.

• Orders and invoices: 6 years from the transaction, under Article 30 of the Spanish Commercial Code, and 4 years for tax purposes.
• Customer account: for as long as you keep it open. If you neither buy nor log in for 3 consecutive years, we delete it.
• Joker Points: points expire 12 months after being earned; the movement history is kept for as long as you have an account.
• Newsletter: until you unsubscribe. We keep the record of your consent for a further 3 years, because the law requires us to be able to prove it.
• Customer service enquiries: 1 year from the conversation being closed, or until any claim becomes time-barred if it leads to one.
• Reviews: for as long as the product remains published, unless you ask us to withdraw it.
• Email measurement: 12 months.
• Browsing data: the period of each cookie, detailed in the cookie policy.

Once the period has ended, the data is blocked and available only to judges, courts and public authorities to deal with any liabilities still alive, until those too become time-barred.

5. Who else receives your data

We neither sell nor transfer your data to anyone to use on their own account. It is shared with the companies that provide services to us, which may only process it on our instructions and under a signed data processing agreement.

• Shipping: Packlink and Correos Express, to deliver your order and give you the tracking.
• Payment: PrestaShop Checkout and PayPal, which process payment by card, Google Pay or PayPal. If you pay by bank transfer, your own bank.
• Email: Amazon Web Services (Amazon SES), from servers located in the European Union.
• Web hosting and backups, on servers located in the European Union.
• Measurement and advertising: Google (Analytics, Ads and Tag Manager), Microsoft (Clarity), Metricool and Pinterest, only if you accept the corresponding cookies.
• Accountants and administration for our accounting and tax obligations.

We will also disclose your data to public authorities, courts or law enforcement where a legal rule requires us to.

6. Transfers outside the European Union

Hosting and email delivery are in the European Union, so your order and account data does not leave it.

The measurement and advertising services in the previous section may transfer data to the United States. Those transfers rely on the EU-US Data Privacy Framework, on the Standard Contractual Clauses approved by the European Commission, or on both. If you reject analytics and advertising cookies, those transfers do not take place.

7. Measurement in the emails we send you

Our emails may include a one-pixel image that tells us whether the message has been opened, and links that record whether you have clicked them. We use this only to check that our communications are arriving and to improve their content.

This data is not shared with third parties, is not combined with your advertising profile and is kept for 12 months. If you would rather avoid it, most email programs let you block images from loading automatically.

8. Joker Points programme

If you place orders using your account we process the data needed to run the programme: your customer identifier, the amount of your orders and the points movements (credits, redemptions and expiries). It serves to calculate your balance and let you redeem it, and the basis for the processing is the contractual relationship itself.

The full rules are in the programme terms.

9. Commercial communications and how to unsubscribe

If you tick the relevant box, we use your email address to send you news, releases and offers. It is a consent separate from the purchase: you can buy without accepting it.

When you subscribe to the newsletter we send you an email so you can confirm the subscription with one click. Until you confirm we do not write to you, which is how we make sure the address is yours.

If you also allow browser notifications, we can send you push alerts about news and orders; they are switched off from your browser settings.

You can withdraw your consent whenever you want, without giving reasons and at no cost, from the unsubscribe link in every communication, from Consents in your customer area, or from the contact form. Unsubscribing does not affect the emails needed to manage your orders, which you will keep receiving.

10. Cookies and similar technologies

We use our own and third-party cookies. The strictly necessary ones allow the shop to work; the rest are only installed if you accept them, and you can change your decision whenever you want from "Manage cookies" in the footer.

The detail of every cookie, its purpose and its duration is in the cookie policy.

11. Security of your data

The site runs entirely over an encrypted connection (HTTPS), passwords are stored encrypted and access to the data is limited to the people who need it for their work. We take regular backups.

No system is infallible. Should a security breach occur that poses a high risk to your rights, we will inform you and notify the Spanish Data Protection Agency within the deadlines set by law.

12. Minors

This shop is aimed at people over 18. We do not knowingly collect data from minors; if we find that an account belongs to a minor without the authorisation of their parents or guardians, we will delete it.

13. Your rights and how to exercise them

Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD) give you these rights:

• Access: to know what data of yours we process and obtain a copy.
• Rectification: to correct data that is inaccurate or incomplete.
• Erasure: to ask us to delete it when it is no longer necessary.
• Objection: to object to processing based on our legitimate interest.
• Restriction: to ask us to keep it without using it while a disagreement is resolved.
• Portability: to receive your data in a commonly used format so you can take it to another provider.
• Withdraw your consent at any time, without that affecting the lawfulness of the earlier processing.
• Not to be subject to automated decisions with legal effects. We do not take decisions of that kind about you.

To exercise them, write to us from the contact form, or by post to Site Factory Digital Agency S.L., Calle Velero 26, 3.º A, 28220 Majadahonda (Madrid), Spain. Tell us which right you want to exercise; we may ask you to prove your identity if we cannot tell who we are talking to.

We will reply within one month, extendable to two if the request is complex, and we will let you know if we need that extension. Exercising these rights is free of charge.

If you have an account, from My personal data you can also download your data and request its deletion directly.

14. Complaining to the supervisory authority

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, aepd.es.

We would be grateful if you wrote to us first: in most cases we resolve it directly and in less time.

15. Updates to this policy

We may update this policy when the applicable rules, the services we use or the way the shop works change. The version in force is always the one published on this page.

Last updated: September 2026.

16. Where to read on

• Cookie policy
• Legal notice and terms of use
• General terms of purchase
• Returns policy
• Club Joker House terms