How we handle your data
Last updated: July 2026
1. Data Controller
NIF: G-43683523
Estació de Renfe s/n · 43770 Móra la Nova (Tarragona)
info@museuferrocarril.cat · 977 401 705
2. What data we collect
During the purchase process we collect the data necessary to manage your order and its delivery:
- Full name
- Email address (to send your order confirmation)
- Phone number
- Delivery address (for home delivery orders)
- Postal code and city
- Transaction data (amount, date, payment reference)
- Purchase IP address (for security and fraud prevention)
We do not collect card data. Payment is processed entirely through Redsys (Red de Medios de Pago, S.L.U.), acting as an independent payment processor.
3. Purpose and legal basis
4. Data retention
Purchase data is retained for 5 years from the transaction date, in compliance with applicable accounting regulations (Spanish Commercial Code, art. 30). After this period, data will be deleted or anonymised.
5. Data sharing
Your data will not be shared with third parties except where legally required. To process payment, transaction data is transmitted to Redsys (Red de Medios de Pago, S.L.U., NIF B-82387770), supervised by the Bank of Spain. For home delivery orders, delivery details will be shared with the relevant courier service. We do not use your data for marketing.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by emailing:
info@museuferrocarril.catIf you believe the processing of your data does not comply with regulations, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the Catalan Data Protection Authority (apdcat.cat).
7. Cookies
This website only uses technically necessary cookies: a session cookie (to maintain the cart and navigation) and a language cookie (to remember the selected language). No tracking, analytics or advertising cookies are used. No explicit consent is required for strictly necessary cookies.