This policy explains how MandoBox processes the personal data of people who visit mandobox.eu, buy in the shop or contact us, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: Joseya Peter Amissah Amissah (trading as “MandoBox”), NIF 03212229A.
- Address: C/ Miguel de Cervantes, 20, 19209 Villanueva de la Torre (Guadalajara), Spain.
- Email: info@mandobox.eu
2. What data, for what purposes and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Managing orders: payment, preparation, shipping, invoicing, guarantee and returns | Name, billing and delivery address, email, telephone, VAT number if the invoice is issued to a business, order and payment details (we do not keep card details) | Performance of a contract (Art. 6.1.b GDPR) |
| Meeting tax and accounting obligations | Billing and order data | Legal obligation (Art. 6.1.c) |
| Answering enquiries and complaints | Name, email and content of the message | Consent or legitimate interest in replying (Art. 6.1.a and 6.1.f) |
| Preventing payment fraud | Order and device data processed by the payment platform | Legitimate interest (Art. 6.1.f) |
| Maintaining the session and basket | Technical cookies (see the Cookie Policy) | Legitimate interest / technical necessity |
To buy, you must provide the mandatory data in the form; without it the order cannot be processed. If you create a customer account, your data is kept to make future purchases easier and to let you view your orders.
3. Commercial communications
MandoBox does not send commercial communications without prior, express consent. If a subscription is offered in the future, you will be informed and can unsubscribe at any time.
4. Recipients
Data is only disclosed where necessary to provide the service or under a legal obligation:
- Stripe Payments Europe Ltd. (Ireland), which processes payments as an independent controller of the payment data.
- Carriers (MRW, InPost and UPS depending on the destination), with the data needed for delivery.
- Website and email hosting provider (Appexpres), as processor.
- Tax or accounting advisers, for invoicing and tax obligations.
- Public authorities, judges and courts, where the law requires.
Data is not sold to third parties.
5. International transfers
Stripe may process data outside the European Economic Area; it does so with the safeguards provided by the GDPR (standard contractual clauses or adequacy decisions). More information is available in Stripe’s privacy policy.
6. Retention
Order and invoice data is kept for the periods required by tax and commercial regulations (up to 6 years). Enquiry messages are kept for as long as necessary to handle them, and then for the limitation periods of any liabilities. Customer accounts are kept until the customer asks for them to be deleted.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to info@mandobox.eu and identifying yourself (with a copy of an ID document, only to verify your identity). We will reply within one month at most. If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence (in Ireland, the Data Protection Commission, www.dataprotection.ie).
8. Security
The Website uses an encrypted connection (HTTPS) and MandoBox applies reasonable technical and organisational measures to protect data. Card details are entered directly on the payment platform and do not pass through our servers.
9. Minors
The Website is not aimed at children under 14 and we do not knowingly collect their data.
Last updated: October 2026.