Privacy Policy

Last updated: 11 September 2026

This Privacy Policy explains how OASIS ECOMMERCE, S.L. collects, uses, retains and protects the personal data of individuals who visit or use the oaseeds.com website, create an account, make a purchase, subscribe to marketing communications or contact us.

Personal data is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), and all other applicable Spanish and European legislation.

1. Basic information on data protection

  • Data controller: OASIS ECOMMERCE, S.L.
  • Main purposes: managing user accounts, orders, payments, deliveries, returns, customer service, legal obligations, platform security and, where consent has been given, marketing communications.
  • Legal bases: performance of a contract or pre-contractual measures, compliance with legal obligations, consent of the data subject and the legitimate interests of the controller.
  • Recipients: technology providers, payment providers, transport companies, professional advisers and public authorities where necessary.
  • International transfers: some technology providers may process data outside the European Economic Area subject to the safeguards provided for under the GDPR.
  • Rights: access, rectification, erasure, objection, restriction, portability, withdrawal of consent and the right not to be subject to certain decisions based solely on automated processing.
  • Contact channel for exercising rights: privacy@oaseeds.com.

2. Data controller

The controller responsible for processing personal data is:

OASIS ECOMMERCE, S.L.
Tax ID (NIF): B75523894
Calle Cardenal Benlloch, 11 bajo
46920 Mislata (Valencia)
Spain

Privacy email address: privacy@oaseeds.com

Website: https://oaseeds.com

Hereinafter, OASIS ECOMMERCE, S.L. may also be referred to as “Oaseeds” or “the controller”.

3. Personal data we process

Depending on the relationship with the user and the services used, Oaseeds may process the following categories of data:

  • Identification data: first name, surname and, where necessary, additional identification details.
  • Contact details: email address, telephone number and postal address.
  • Shipping and billing data: delivery address, billing address, country, province, city, postcode and information required for issuing invoices.
  • Account data: email address, encrypted password, preferences, saved products and account activity history.
  • Contractual and transactional data: products purchased, order number and date, amount, currency, discounts, returns, incidents and order status.
  • Payment-related data: payment method, payment status, amount, transaction reference and, where provided by the payment provider, partial information identifying the payment method.
  • Communications data: messages sent to customer service, requests, complaints, returns and requests concerning the exercise of data protection rights.
  • Technical and security data: IP address, date and time of access, browser, operating system, technical identifiers, server logs and information required to prevent abuse, fraud or unauthorised access.
  • Marketing data: email address, consent given, subscription date, unsubscribe date and evidence required to manage subscriptions to marketing communications.
  • Confirmation of legal age: information required to confirm that the user declares that they are at least 18 years old.

Oaseeds does not intentionally request data falling within special categories of personal data, such as information concerning health, racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetic data, biometric data or information concerning a person's sex life or sexual orientation. Please do not provide this type of information through forms or free-text communications.

4. Sources of personal data

Personal data may be obtained from the following sources:

  • Directly from the user when registering, placing an order, completing a form, subscribing to the newsletter or contacting Oaseeds.
  • From activity carried out through the user's account and the management of orders.
  • From payment providers in connection with the confirmation, rejection, refund or status of a transaction.
  • From transport companies and postal operators in connection with the status or delivery of a shipment.
  • From the person making a purchase where that person provides the details of another individual as the recipient of the shipment.
  • From the technical systems, servers and security tools used for the operation and protection of the website.

Oaseeds does not purchase personal databases for the indiscriminate sending of advertising.

5. Purposes and legal bases for processing

5.1. Creation and management of user accounts

Data is processed to register the user, authenticate access, manage their profile, retain saved products and allow them to view their order history.

Legal basis: performance of a contract or steps taken at the user's request prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

5.2. Order management and contractual relationship

Data is processed to process purchases, confirm orders, prepare products, manage incidents, amendments, cancellations, returns, refunds, warranties and after-sales support.

Legal basis: performance of the contract of sale and steps taken prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

5.3. Payment management

The necessary data is processed to handle the selected payment method, verify the outcome of the transaction, manage refunds and deal with issues relating to payment.

Legal basis: performance of the contract, pursuant to Article 6(1)(b) of the GDPR and, where applicable, compliance with legal obligations and fraud prevention.

5.4. Preparation, transport and delivery of orders

Identification details, contact details and the delivery address are disclosed to the transport company, postal operator and, where applicable, destination operator or customs authority necessary to complete delivery.

Legal basis: performance of the contract, pursuant to Article 6(1)(b) of the GDPR, and compliance with legal obligations where customs procedures or requests from a competent authority apply.

5.5. Customer service and enquiry management

Data is processed to respond to enquiries, resolve incidents, manage complaints and maintain communications relating to orders or services.

Legal basis: performance of the contract or steps taken prior to entering into a contract where the enquiry relates to a purchase, and Oaseeds' legitimate interest in responding to and managing other enquiries received.

5.6. Invoicing and compliance with legal obligations

Data is processed to issue and retain invoices, maintain accounting records, submit tax returns, comply with tax, commercial, administrative and fraud-prevention obligations, and respond to lawfully issued requests.

Legal basis: compliance with legal obligations applicable to Oaseeds, pursuant to Article 6(1)(c) of the GDPR.

5.7. Security, fraud prevention and platform protection

Technical and transactional data may be used to protect accounts, detect unauthorised access, prevent fraudulent activity, limit abuse, safeguard infrastructure and ensure the availability of the service.

Legal basis: the legitimate interests of Oaseeds and its users in maintaining the security of the shop, preventing fraud and protecting transactions, pursuant to Article 6(1)(f) of the GDPR.

The user may request further information about this legitimate interest and object to the processing on grounds relating to their particular situation.

5.8. Marketing communications and newsletter

Where authorised by the user, Oaseeds will use their email address to send news, updates, promotions, discounts and marketing communications relating to its products and services.

Legal basis: the data subject's consent, pursuant to Article 6(1)(a) of the GDPR and the legislation applicable to electronic marketing communications.

Consent is voluntary and may be withdrawn at any time using the unsubscribe link included in each communication or by writing to privacy@oaseeds.com.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Unsubscribing from marketing communications does not prevent Oaseeds from sending operational messages necessary to manage an account, order, payment, shipment, return or incident.

5.9. Analytics and website improvement

Oaseeds uses Plausible Analytics to obtain aggregated statistics about the use of the website, understand page performance and improve navigation and the services offered.

Plausible Analytics is configured not to use analytics cookies or create individual profiles of visitors.

Legal basis: Oaseeds' legitimate interest in proportionately measuring the performance of the website and improving its services, pursuant to Article 6(1)(f) of the GDPR.

5.10. Exercise of rights, complaints and legal defence

Oaseeds will process the data necessary to identify, register and respond to requests concerning data protection rights, complaints, requests from authorities and potential legal liabilities.

Legal basis: compliance with legal obligations, pursuant to Article 6(1)(c) of the GDPR and, where applicable, the legitimate interest in establishing, exercising or defending legal claims, pursuant to Article 6(1)(f) of the GDPR.

6. Mandatory nature of the data

Fields identified as mandatory in forms are necessary in order to provide the requested service.

If the user does not provide the data necessary to create an account, process an order, manage payment or arrange delivery, Oaseeds will be unable to complete the relevant transaction.

Data requested for receiving marketing communications is voluntary. Refusal to provide such data or subsequent withdrawal of consent will not affect the user's ability to make purchases or use the shop's standard services.

7. Retention periods

Data will be retained only for as long as necessary to fulfil the purpose for which it was collected and, thereafter, for the periods necessary to comply with legal obligations or address potential liabilities.

  • User account: for as long as it remains active or until the user requests its closure, without prejudice to the limited retention of information required for legal obligations or potential liabilities.
  • Orders and contractual relationship: for the duration of order management, the commercial relationship and any applicable warranty, complaint and liability periods.
  • Invoices and accounting documentation: for the periods required under tax, accounting and commercial legislation. As a general rule, commercial documentation must be retained for six years from the date of the last entry made in the relevant books and records, without prejudice to any longer specific periods that may apply, including those relating to VAT or the One Stop Shop scheme where applicable.
  • Enquiries and customer service: for the time necessary to resolve the enquiry or incident and, subsequently, for the period during which liabilities may arise.
  • Marketing communications: until the user withdraws their consent or unsubscribes.
  • Marketing suppression list: where necessary, the minimum information required to demonstrate that the user has unsubscribed and to prevent further unauthorised communications may be retained.
  • Technical and security logs: for the period strictly necessary to ensure security, investigate incidents, prevent abuse or comply with legal obligations.
  • Requests concerning rights and complaints: for the duration of their handling and, subsequently, for the period necessary to demonstrate Oaseeds' compliance with its obligations and address potential liabilities.

Where erasure is appropriate but the data must be retained due to a legal obligation or potential liability, it will be duly restricted and will not be used for ordinary commercial or operational purposes.

Data that remains temporarily in backup copies will be subject to the technical rotation cycle of those backups and will not be used for ordinary purposes. In the event of restoration following a technical incident, any applicable erasure requests will be reapplied.

8. Data recipients and service providers

Oaseeds does not sell databases or otherwise commercialise its users' personal data.

However, in order to provide its services, certain service providers may access or receive the data strictly necessary for that purpose.

8.1. Service providers supplying services to Oaseeds

  • Hetzner: web hosting, servers and technological infrastructure.
  • Cloudflare: content delivery network, protection against attacks, security and website optimisation.
  • MailerLite: subscription management and sending of marketing communications.
  • Holded: business management, invoicing and accounting.
  • Plausible Analytics: preparation of aggregated website usage statistics.
  • Email and corporate communications providers: management of messages, customer service and privacy requests.
  • Maintenance and technical support providers: only where their intervention requires access to systems that may contain personal data.

These providers will be subject to the corresponding confidentiality, security and data protection obligations and, where acting as processors, will process the information in accordance with Oaseeds' instructions.

8.2. Payment providers and financial institutions

The data necessary to complete a transaction may be disclosed to the payment provider or financial institution selected by the user, including, where applicable, Fibonatix and Nopayn.

These providers may act as independent controllers in relation to certain processing activities associated with payments, fraud prevention, regulatory compliance, customer identification or retention of financial records. In such cases, their own privacy policies will apply.

8.3. Transport companies and postal operators

Identification details, contact details and the delivery address may be disclosed to transport companies, postal operators, destination-country operators and logistics partners required to deliver the order.

For international shipments, the strictly necessary data may also be disclosed to customs, tax, postal or security authorities where required by applicable law.

8.4. Professional advisers and authorities

Where necessary, data may be disclosed to:

  • tax, accounting and legal advisers and auditors;
  • insurance companies, where applicable;
  • tax and customs authorities;
  • courts, tribunals and law enforcement authorities;
  • data protection authorities;
  • other public authorities where there is a legal obligation or a valid request.

9. International data transfers

Some technology providers may be established outside the European Economic Area or may use infrastructure, group companies or support teams located in third countries.

Where an international transfer of personal data takes place, Oaseeds will verify that it is covered by one of the mechanisms provided for under the GDPR, such as:

  • an adequacy decision issued by the European Commission;
  • Standard Contractual Clauses approved by the European Commission;
  • Binding Corporate Rules or other appropriate safeguards;
  • one of the exceptional circumstances permitted by law.

The user may request further information about international transfers and the applicable safeguards by writing to privacy@oaseeds.com.

10. Payments and financial data

Where payment is processed through an external payment gateway, Oaseeds does not directly store the full card number or its security code.

Oaseeds may retain the transaction reference, payment method, amount, currency, status of the transaction and any partial information supplied by the provider for the purpose of identifying or managing the payment, a refund or an incident.

11. Marketing communications

Subscription to the newsletter and other promotional communications is voluntary.

Each marketing communication will include a simple and free mechanism for unsubscribing. The user may also withdraw their consent by writing to privacy@oaseeds.com.

Oaseeds may retain evidence of consent and, following an unsubscribe request, the minimum information necessary to demonstrate that request and prevent further unauthorised communications.

12. Cookies and similar technologies

The website uses technical cookies that are necessary to enable browsing, maintain the session, manage the shopping basket, ensure security and provide services expressly requested by the user.

Cookies or technologies that are not strictly necessary will only be used where there is a valid legal basis and, where required, after obtaining the user's consent.

Detailed information about cookies, their purposes, providers, duration and mechanisms for accepting, rejecting or withdrawing consent can be found in the Cookie Policy.

13. Automated decision-making and profiling

Oaseeds does not make decisions based solely on automated processing, including profiling, which produce legal effects concerning the user or similarly significantly affect them.

Automated technical mechanisms may be used to detect anomalous activity, protect the website or identify potentially fraudulent transactions. These mechanisms are used for security and prevention purposes.

Payment providers may apply their own fraud-prevention, authentication or transaction-assessment systems under their own responsibility and in accordance with their own privacy policies.

14. Rights of data subjects

The user may exercise the following rights:

  • Access: to determine whether Oaseeds is processing their data and to obtain information about and a copy of the data being processed.
  • Rectification: to request the correction of inaccurate or incomplete data.
  • Erasure: to request the deletion of their data where the legal requirements are met.
  • Restriction: to request that processing be restricted in the circumstances provided for by law.
  • Objection: to object to processing based on legitimate interests on grounds relating to their particular situation.
  • Objection to direct marketing: to object at any time to the processing of their data for marketing communications.
  • Portability: to receive the data provided in a structured, commonly used and machine-readable format and request its transmission to another controller where legally and technically possible.
  • Withdrawal of consent: to withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
  • Automated decision-making: not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them, where applicable.

14.1. How to exercise your rights

Requests may be sent to:

Email: privacy@oaseeds.com

Postal address:
OASIS ECOMMERCE, S.L.
For the attention of: Privacy
Calle Cardenal Benlloch, 11 bajo
46920 Mislata (Valencia)
Spain

The request must include at least:

  • the data subject's first name and surname;
  • the email address or other information that enables their account to be located;
  • the right they wish to exercise;
  • a clear description of the request;
  • the means by which they wish to receive the response.

Where there are reasonable doubts concerning the identity of the person making the request, Oaseeds may request additional proportionate information in order to verify their identity. It is not necessary to initially attach a copy of an identity document unless it is expressly requested for the purpose of carrying out such verification.

The exercise of these rights is free of charge. As a general rule, Oaseeds will respond within one month of receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, provided that the data subject is informed of the extension within the first month.

14.2. Complaint to the supervisory authority

If the user believes that their data is not being processed in accordance with applicable legislation or that their rights have not been properly addressed, they may lodge a complaint with the Spanish Data Protection Agency:

Spanish Data Protection Agency (Agencia Española de Protección de Datos)

15. Data relating to minors

Oaseeds is a website intended exclusively for persons over the age of 18. Minors are not permitted to register or place orders.

If Oaseeds becomes aware that data relating to a minor has been provided, it will take reasonable measures to close the account, prevent the transaction and erase any data that is not required to be retained pursuant to a legal obligation.

16. Data relating to third parties

If the user provides personal data relating to another person, for example in order to send an order to a different recipient, the user declares that they are authorised to do so and that they have informed that person about the processing of their data.

The user must provide only the third-party data strictly necessary to manage the requested service.

17. Security and confidentiality

Oaseeds implements appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or access.

These measures include, where applicable:

  • access controls and access restrictions;
  • individual management of permissions;
  • protection and encryption of credentials;
  • secure communications;
  • backups and recovery mechanisms;
  • protection of infrastructure against unauthorised access;
  • confidentiality obligations for staff and service providers;
  • regular review and updating of security measures.

However, no system connected to the Internet can guarantee absolute security. Users must protect their credentials, use secure passwords and immediately report any suspected unauthorised access.

18. Accuracy and updating of data

The user guarantees that the data provided is accurate, complete and up to date. Where the user has an account, they may amend certain information through their profile or request its rectification by contacting Oaseeds.

19. Changes to this Privacy Policy

Oaseeds may update this Privacy Policy in order to adapt it to legal, technical or organisational changes or changes relating to its services and providers.

Where changes are material, they will be prominently communicated on the website and, where legally required, affected users will be informed directly or new consent will be requested.

The date shown at the beginning of this page indicates when the Privacy Policy was last updated.

20. Contact

For any enquiries relating to this Privacy Policy or the processing of personal data, please contact:

OASIS ECOMMERCE, S.L.
Calle Cardenal Benlloch, 11 bajo
46920 Mislata (Valencia)
Spain
Email: privacy@oaseeds.com

Product added to wishlist