PrimePatio
Data protection
Privacy policy
What FLOFUM, S.L. records about a customer, why we are allowed to hold it, how long it stays on file and what you can make us do with it.
Last updated 10 September 2026The company answerable for your data
PrimePatio DIY is the trading name of FLOFUM, S.L., a company registered in Spain under CIF B75621250 and a registered office at Calle Parcerisa 13, Local 1, 08014 Barcelona, Spain. FLOFUM, S.L. is the controller of every piece of personal data described here, so the decisions about what is collected and why are ours, and so is the responsibility if we get them wrong.
Write to support@primepatio-diy.com if you want any of it explained or acted on. No data protection officer has been appointed, because our processing does not require one, and messages reach the person who deals with them. We work under the General Data Protection Regulation, Regulation (EU) 2016/679, and Spanish Organic Law 3/2018.
What ends up on file
Most of what we hold arrives because you typed it into the enquiry form on our contact page: a name, an email address, a telephone number, the town and country the goods are going to, and a message box describing the job. If the enquiry becomes a delivery, we then need the full street address, down to the door or flat number the courier will knock on.
After that the record grows the ordinary way. Emails stay in the mailbox with our replies attached. Calls are not recorded, but whoever answers notes what was agreed: the items, the total the driver will collect and the day the parcel should arrive. The carrier then returns a handover confirmation, giving the date and time of delivery, whether the parcel was accepted or refused, and the cash taken at the door.
The web server also keeps technical logs while you read the site: an IP address, the browser and device string your software announces, the page requested and the time. They exist so attacks and outages can be traced, and nobody reads them unless something has gone wrong. Whatever is stored in your browser is covered by the cookie policy.
We never ask for a date of birth, a national identity number, an IBAN or a card number. If one arrives anyway, it is deleted rather than filed.
Our grounds for holding it
The law wants a lawful basis named for each purpose. Here is ours.
To quote for and fulfil an order, we rely on performance of a contract, Article 6(1)(b). Pricing the job, confirming stock, directing the courier and handling a return or a warranty claim cannot be done without a name, an address and a way of reaching you.
To protect the business and the site, we rely on legitimate interests, Article 6(1)(f): checking that an address and telephone number look genuine before a driver carries goods across a border with cash to collect, blocking automated abuse of the form, and keeping the logs above. The data involved is minimal and builds no profile of you. Object at any time and the objection will be looked at properly.
For anything a cookie does beyond keeping the site working, the basis is consent, Article 6(1)(a), asked for before the cookie is set and as easy to withdraw as to give. We run no mailing list, send no marketing, and never sell or rent contact details.
To keep the accounts straight, the basis is legal obligation, Article 6(1)(c). Spanish tax and commercial law obliges us to issue and keep invoices, and that outranks a request to erase them.
There is no payment processor in this picture. Payment is cash handed to the courier at the door, so no bank, card scheme, gateway or terminal is involved at any stage. We hold no card number and no account details, because the site has no basket and no checkout to collect them with. The only financial record against your name is a line saying the driver collected the agreed sum.
Who else sees any of it
The carrier gets your name, street address, telephone number and the sum to collect, since a driver cannot finish the job without them, and it keeps its own delivery records under its own terms as well as ours. Our hosting provider holds the site, the mailbox and the backups as a processor, under a contract forbidding any use of the data for its own ends. Our accountant sees the invoices, and is bound by professional confidentiality.
Beyond those three, nobody. Data leaves that circle only where a court or a competent authority compels it, and only as far as the order goes.
How long it stays
| Record | Kept for | Reason |
|---|---|---|
| Enquiry that never became an order | 12 months from the last message | So a returning customer need not repeat it |
| Order, invoice and carrier confirmation | 6 years from the close of the financial year | Spanish commercial and tax record keeping |
| Return, refund and warranty correspondence | 3 years from the delivery date | The 2 year conformity period, and any later dispute |
| Server access logs | Up to 30 days, then overwritten | Security and fault tracing |
| Cookie consent record | Up to 12 months | Evidence of what you agreed to, and when |
When a period runs out the record is deleted, or where that would break a backup set, put beyond ordinary use and removed at the next rotation.
Where the data is held
The site, the mailbox and the backups sit on servers inside the European Union, and we deliver only to street addresses in the 27 member states, so an order never leaves the European Economic Area. If a supplier ever has to process data outside it, we transfer only to a country the European Commission has ruled adequate, or under its standard contractual clauses. Ask, and we will name the suppliers involved at the time.
What you can require of us
You may ask for a copy of what we hold and an explanation of its use, have wrong details corrected, and ask for erasure, which we carry out unless the tax rules oblige us to keep the record, in which case it is restricted instead and simply stored. You may also pause processing while a dispute over accuracy is settled, object to anything resting on legitimate interests, take your data away in a structured, machine readable file, and withdraw consent at any time without unpicking what was lawfully done beforehand.
Send requests to support@primepatio-diy.com. We ask only for what is needed to be sure the request comes from you, normally that you write from the address the order was placed from. There is no charge, and we answer inside one month. If a request is genuinely complicated we may take two months more, telling you why within the first. No decision about you is taken by automated means.
If you think we have handled it badly
Tell us first, because most of it is fixable the same week. If the answer does not satisfy you, you may complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos, at C/ Jorge Juan 6, 28001 Madrid, or through www.aepd.es. If you live in another member state, your own national authority will take the complaint instead, and none of this removes your right to go to court.
Updating this policy
This policy is rewritten whenever the way we work changes, for instance if we take on a different carrier or move the site to another host. The date at the top is the version in force and replaces anything published before it. A change that materially affects how your data is handled will be stated plainly here, not slipped quietly into the text.