🚂 Free shipping over €30 · Free museum pick-up · 30-day returns
← Back to shop
Privacy Policy

How we handle your data

Last updated: July 2026

1. Data Controller

"A.P.P.F.I." Associació per a la Preservació del Patrimoni Ferroviari-Industrial de Móra la Nova
NIF: G-43683523
Estació de Renfe s/n · 43770 Móra la Nova (Tarragona)
info@museuferrocarril.cat · 977 401 705

2. What data we collect

During the purchase process we collect the data necessary to manage your order and its delivery:

  • Full name
  • Email address (to send your order confirmation)
  • Phone number
  • Delivery address (for home delivery orders)
  • Postal code and city
  • Transaction data (amount, date, payment reference)
  • Purchase IP address (for security and fraud prevention)

We do not collect card data. Payment is processed entirely through Redsys (Red de Medios de Pago, S.L.U.), acting as an independent payment processor.

3. Purpose and legal basis

Manage the order and process payment
Legal basis: Contract performance
Send order confirmation and status updates
Legal basis: Contract performance
Manage shipping or museum pick-up
Legal basis: Contract performance
Fraud prevention and security
Legal basis: Legitimate interest
Comply with accounting obligations
Legal basis: Legal obligation

4. Data retention

Purchase data is retained for 5 years from the transaction date, in compliance with applicable accounting regulations (Spanish Commercial Code, art. 30). After this period, data will be deleted or anonymised.

5. Data sharing

Your data will not be shared with third parties except where legally required. To process payment, transaction data is transmitted to Redsys (Red de Medios de Pago, S.L.U., NIF B-82387770), supervised by the Bank of Spain. For home delivery orders, delivery details will be shared with the relevant courier service. We do not use your data for marketing.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by emailing:

info@museuferrocarril.cat

If you believe the processing of your data does not comply with regulations, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the Catalan Data Protection Authority (apdcat.cat).

7. Cookies

This website only uses technically necessary cookies: a session cookie (to maintain the cart and navigation) and a language cookie (to remember the selected language). No tracking, analytics or advertising cookies are used. No explicit consent is required for strictly necessary cookies.

📄 Legal notice →