Legal

Privacy policy

What FLOFUM, S.L. holds about you, why it is held, who else sees it, and when it is deleted. Ordering here runs on email and ends in cash at your door, so the file on you is short — and this page lists all of it.

Last updated: 11 September 2026

The controller is FLOFUM, S.L.

FLOFUM, S.L. decides what is collected and what it is used for. That makes it the controller of every item described on this page, under the General Data Protection Regulation, Regulation (EU) 2016/679, and Spanish Organic Law 3/2018 of 5 December (LOPDGDD).

FLOFUM, S.L.
Calle Parcerisa 13, Local 1
08014 Barcelona, Spain
CIF: B75621250
support@voskis.com
https://voskis.com

Voskis is a trading name of FLOFUM, S.L. Contact is in writing only — the enquiry form or support@voskis.com — Monday to Saturday, 9 to 6 CET. Write to support@voskis.com about anything on this page and the message reaches the people who run the orders.

No data protection officer is appointed. Article 37 does not require one at this scale, and nobody sits between you and the file.

Everything we hold, itemised

This site has no basket, no checkout, no account and no card field. No page on voskis.com collects anything by itself. Every personal detail we hold arrived inside an email you chose to send. There are six items.

• Your email address. You wrote from it and the reply goes back to it. It is the reference the whole order hangs on.
• Your name. As you sign it, and as it has to appear on the parcel label.
• The delivery address. Street, number, floor or door. The driver has to find it and hand the box to a person.
• The order. The items, the quantities, the one figure we quoted, the dispatch date, the tracking reference, and whether the driver was paid or the box was refused at the door.
• The correspondence. Your emails and our replies, kept as the thread they were written in.
• Photographs, only if you send them. Pictures of a fault, a breakage or a wrong item, attached to a return or a guarantee claim. We ask for photographs of the goods and of nothing else, never of a person.

That list is complete. One thing on it is optional: a telephone number. Some carriers use one to warn you of the delivery window. Put a number in your email and we pass it to the carrier; leave it out and the order still runs. The other five items cannot be dropped, because without them the box cannot be addressed and the figure cannot be quoted.

We do not ask for a date of birth, a DNI or NIE number, a passport, an income figure, a card number or an IBAN. Nothing here is a special category of data under Article 9. Do not send health, political, religious or biometric information; if any arrives in a message it is deleted rather than filed.

The web server

Serving these pages writes an ordinary access log: an IP address, the browser string your software announces, the page requested and the time. It exists so an outage or an attack can be traced, and nobody opens it unless something has broken. Whatever is stored in your browser is dealt with separately in the cookie policy.

No card or bank data is processed for payment

One exception exists, and it only arises after a return. If you are owed money back there is no card payment to reverse, so we ask you in writing for an IBAN in your own name to send the transfer to. Those details are used to make that one transfer, are recorded on the accounting entry the transfer creates, and are used for nothing else.

The purpose and the lawful basis, line by line

Each purpose needs a named basis in Article 6. These are ours.

Purpose	What it uses	Lawful basis
Reading your list, checking stock and quoting one figure	Email address, the list itself	Contract, Article 6(1)(b)
Packing the box and getting it to your door	Name, delivery address, optional telephone number	Contract, Article 6(1)(b)
Handling a return, a refund or a guarantee claim	Order record, correspondence, any photographs, IBAN for a refund	Contract, Article 6(1)(b)
Issuing the invoice and keeping the accounts	Name, address, the figure, the date	Legal obligation, Article 6(1)(c)
Answering an enquiry that never becomes an order	Email address, correspondence	Legitimate interests, Article 6(1)(f)
Keeping the site up and tracing faults or abuse	Server access logs	Legitimate interests, Article 6(1)(f)
Any cookie beyond the ones that make the page work	As set out in the cookie policy	Consent, Article 6(1)(a)

Where the basis is legitimate interests, the interest is a working website and a mailbox that can answer you. Two sentences of an email thread and a line in a server log are the whole of it. No profile is built, nothing is scored or ranked, and no decision about you is taken from it. You can object to either of those two purposes at any time, and we stop unless we can demonstrate grounds that override yours.

Where the basis is consent, it is asked for before anything is set, and it is as easy to withdraw as it was to give.

There is no mailing list and no marketing. We do not sell, rent, swap or share personal data for anyone else’s advertising, and no advertising pixel or third-party analytics account is attached to your order. This shop is for adults; we do not knowingly hold data on anyone under 14, the age of consent set by Spanish law.

Four parties outside this company, and what each one gets

• The carrier. It gets your name, the delivery address, the sum to collect and the telephone number if you gave one. A driver cannot complete the job without them. The carrier keeps its own delivery records as a controller in its own right, under its own terms.
• The hosting and mailbox provider. It holds the site, the email thread and the backups. It acts as a processor under a written Article 28 contract that forbids any use of the data for its own ends.
• Our accountant. Sees the invoices, bound by professional confidentiality and by a processor contract.
• A public authority, where the law compels it. The Agencia Tributaria for tax records, and a court, the police or a consumer authority where a valid order requires it. Only the part that is asked for, never the file entire.

Nobody else. There is no data broker, no advertising network, no CRM platform and no AI training use on this list, because none of those things is used here.

When each record is deleted

Record	Deleted after	Why that long
An enquiry that never became an order	12 months from the last email	So a returning customer need not write the list out twice
Order file and correspondence	3 years from the delivery date	The 2-year guarantee, plus a year for anything raised at the end of it
Invoices and accounting records	6 years from the close of the financial year	Spanish Commercial Code. The tax limitation period is 4 years; the longer duty governs
Refund bank details	With the accounting entry, then deleted with it	They exist only as part of the transfer record
Server access logs	Overwritten at 30 days	Security and fault tracing
Cookie consent record	12 months	Evidence of what you agreed to and when

At the end of a period the record is deleted. A copy can survive a short while inside a backup set; those sets rotate, and the copy goes out with the rotation. Nothing is held back in case it turns out to be useful later.

The data stays in the European Economic Area

The servers holding the site, the mailbox and the backups sit inside the European Union. Deliveries go to street addresses in the 27 member states and nowhere else. On the ordinary run of an order, nothing crosses the border of the European Economic Area.

If that ever changes — a supplier relocates, or a carrier routes its support desk outside the EEA — the transfer is made only to a country the European Commission has ruled adequate under Article 45, or under the Commission’s standard contractual clauses with the checks Article 46 requires. Email support@voskis.com and we will name the suppliers in use on the day you ask.

Eight rights, and how to use each one

Eight rights are exercised with us. A ninth — complaining to a supervisory authority — is exercised elsewhere, and is set out in the next section.

• Access, Article 15. A copy of everything held about you, and a plain explanation of what each item is for.
• Rectification, Article 16. A misspelt name or a wrong door number corrected. This is the fastest of the eight: send the correction and it is done the same working day.
• Erasure, Article 17. Deleted, except where an invoice must legally be kept. That record is restricted instead: it stays on the accounting file and is used for nothing but the accounts.
• Restriction, Article 18. Processing paused while a dispute about accuracy, or an objection, is settled.
• Portability, Article 20. The data you gave us returned in a structured, machine-readable file, or sent directly to whoever you name.
• Objection, Article 21. Against anything resting on legitimate interests, which here means the enquiry thread and the server logs.
• Withdrawal of consent, Article 7(3). For anything running on consent, a non-essential cookie above all. Withdrawing does not unmake what was lawful before you withdrew it.
• No automated decision-making, Article 22. Nothing about you is decided by machine and no profiling is carried out. Every list is read and priced by a person.

How to make a request

Email support@voskis.com and name the right you want to use. Write from the address the order was sent from and no further identification is needed. If you have to write from a different address, quote the order reference or the tracking number instead. We do not ask you to send a copy of your ID.

There is no charge. The answer comes within 1 month. A genuinely complicated request can take up to 2 months longer; if it does, you are told inside the first month, and told why.

Complaining to the Agencia Española de Protección de Datos

Start with us. Email support@voskis.com and say what went wrong — a wrong record is usually corrected the day it is reported. You are not obliged to. You can go to the Spanish supervisory authority directly, and you can still go after we have answered.

Agencia Española de Protección de Datos
C/ Jorge Juan 6
28001 Madrid, Spain
www.aepd.es

If you live in another member state, your own national supervisory authority will take the complaint instead. Neither route removes your right to take the matter to court.

How the data is kept safe

The site is served over HTTPS. The mailbox and the hosting account are protected by two-factor authentication, and backups are encrypted. Access to the order file is limited to the people who process orders and to the accountant.

If a breach ever puts your rights at risk, we notify the Agencia Española de Protección de Datos within 72 hours, as Article 33 requires, and we email you directly where Article 34 applies. You would hear it from us rather than read it somewhere else.

Changes to this notice

This notice is rewritten when the way we work changes: a new carrier, a different host, a new retention duty. Changes are made in the open. The text says what now applies, the date under the title moves to match, and that version replaces every earlier one. If this matters to you, read the current version before you send a list.