Privacy policy
Last updated: 15 September 2026
This is a translation for convenience. In the event of any discrepancy, the Spanish version shall prevail.
At Kaiju Group we take your privacy seriously. This policy explains which personal data we process when you visit kaiju.es, write to us or buy from our online shop, what we use them for, how long we keep them and how you can exercise your rights, in accordance with the General Data Protection Regulation, GDPR (Regulation (EU) 2016/679), the LOPDGDD (Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights) and the LSSI-CE (Spanish Law 34/2002 on Information Society Services and Electronic Commerce).
1. Data controller
- Owner: Kaiju Entertainment, S.L. (hereinafter, “Kaiju Group”)
- Tax ID (NIF): B93485449
- Registered address: Calle Marea Baja, 3, 29006 Málaga (Spain)
- Email for privacy matters: [email protected]
2. What data we process
- Contact forms (the one in the footer and the one on the contact page): name, email address, area of interest, the message you write to us and your acceptance of this policy. The date, time and page from which each submission was sent are also recorded.
- Emails you send us directly and any data you include in them.
- Purchases in the online shop: first name and surname(s), company and tax ID if you request an invoice, billing and shipping addresses, email, telephone number, the products you buy, their price and your order history. If you create an account, also your username and encrypted password. If you pay by card or another electronic payment method, the payment data are processed directly by the payment institution or gateway: Kaiju Group neither knows nor stores your full card number.
- Visit source data in the shop: if you accept it, where you came to the website from (search engine, social network, campaign or link) and the type of device, so that we know which channels generate orders.
- Browsing data for statistics: if you accept it, Google Analytics records, in pseudonymised form, the pages you visit, how long you stay, your type of device and browser and your approximate location (country and city).
- Technical security data: IP address, type of browser and device, and similar data needed to display the website to you, protect it against attacks and check that forms are submitted by a person and not by an automated program.
- Cookies and similar technologies: these are explained in the Cookie Policy.
We do not ask you for special categories of data (health, beliefs, ethnic origin, etc.). Please do not include them in your messages.
3. What we use your data for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiries and requests for information or quotes sent by form or email. | Your consent when you send us the enquiry (Art. 6(1)(a) GDPR) and, where you ask us for information in order to contract our services, the taking of steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). |
| Managing your online shop orders: payment, shipping or delivery, after-sales service, returns and, if you create one, your customer account. | Performance of the sales contract (Art. 6(1)(b) GDPR). |
| Issuing invoices and complying with our accounting and tax obligations. | Compliance with legal obligations (Art. 6(1)(c) GDPR), in particular the Spanish Commercial Code and tax legislation. |
| Compiling website usage statistics with Google Analytics in order to improve its content. | Your consent, which you give or refuse from the cookie panel (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). |
| Finding out which channel shop orders come from (order attribution). | Your consent, from the cookie panel (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). |
| Showing you the Google Maps map on the contact page. | Your consent, from the cookie panel (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). |
| Protecting the website, the shop and the forms against spam, bots and fraudulent use (Cloudflare and Cloudflare Turnstile). | Legitimate interest in ensuring network and information security (Art. 6(1)(f) and Recital 49 GDPR). |
| Responding to requests from the authorities and complying with other legal obligations applicable to us. | Compliance with a legal obligation (Art. 6(1)(c) GDPR). |
We also use Google Search Console to find out how kaiju.es appears in Google search results. This tool does not install cookies or collect data from website visitors: it shows aggregated search data.
We do not make automated decisions or carry out profiling with your data. We will not send you commercial communications unless you have expressly requested or authorised them.
4. How long we keep your data
- Enquiries by form or email: for as long as necessary to deal with your request and follow it up and, at most, 12 months from our last contact. If the enquiry leads to a business relationship, we will keep them for as long as it lasts and for the periods required by law.
- Orders and invoices: for as long as the contractual relationship lasts and, thereafter, for the statutory periods: 6 years for accounting records (Art. 30 of the Spanish Commercial Code) and 4 years for tax purposes (Art. 66 of the Spanish General Tax Law).
- Customer account: until you ask us to delete it, without prejudice to keeping your order data for the statutory periods above.
- Google Analytics statistics: 14 months.
- Technical security data: for the short periods applied by our hosting and security providers to prevent abuse.
Once these periods have ended, the data are blocked and kept available only to judges, courts and competent authorities for the limitation period of any possible liabilities (Art. 32 LOPDGDD). They are then deleted.
5. Who we disclose your data to
We do not disclose your data to third parties, except where required by law, for example to the Spanish Tax Agency or the courts, or where necessary to fulfil your order. To provide our service we rely on providers that process data on our behalf as data processors, under a contract that obliges them to protect the data and to use them only in accordance with our instructions (Art. 28 GDPR):
- Web hosting provider, where the website, orders and messages received through forms are stored.
- Email and email delivery providers, which deliver your messages to us and send you your order confirmations.
- Cloudflare, Inc., which provides content delivery network, security and anti-spam verification (Turnstile) services.
- Google Ireland Limited, which provides the Google Analytics statistics service if you accept it.
- Accounting and tax advisers, for invoicing management.
When you make a purchase, your data are also disclosed to the banks and payment gateways that process the payment and, where there is a shipment, to the carrier that delivers it, only to the extent necessary for that purpose.
If you accept third-party cookies, Google displays the map on the contact page and processes the data in accordance with its own privacy policy.
6. International transfers
Cloudflare, Inc. and Google LLC, the parent company of Google Ireland Limited, are based in the United States and may process data outside the European Economic Area. Both companies are certified under the EU-U.S. Data Privacy Framework, recognised by the European Commission in its adequacy decision of 10 July 2023, and also offer standard contractual clauses approved by the Commission (Arts. 45 and 46 GDPR).
7. Your rights
You may exercise the following rights at any time, free of charge:
- Access: to know whether we process your data and obtain a copy.
- Rectification of inaccurate or incomplete data.
- Erasure of your data when they are no longer necessary, among other cases.
- Objection to processing based on our legitimate interest.
- Restriction of processing in the cases provided for in the GDPR.
- Portability: to receive your data in a structured, commonly used format.
- Withdrawal of your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise them, write to us at [email protected] or by post to Calle Marea Baja, 3, 29006 Málaga (Spain), with the subject line “Data protection” and stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month, which may be extended by a further two months if the request is complex, in which case we will inform you.
If you believe that we have not processed your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es). We would be grateful if you contacted us first so that we can try to resolve the matter.
8. Minors
This website is not aimed at children under 14. If you are under 14, do not send us your data: ask your mother, father or guardian to contact us (Art. 7 LOPDGDD). You must be of legal age to buy from the online shop.
9. Accuracy and security of data
By sending us your data you guarantee that they are true and that you will notify us of any changes. We apply appropriate technical and organisational measures to protect your data against loss, alteration or unauthorised access, such as an encrypted connection (HTTPS) across the entire website and restricted access to information.
10. Social networks
Kaiju Group has profiles on Facebook, Instagram and LinkedIn. The links from this website to those networks are ordinary links: they do not load content from the networks or install their cookies until you click on them. If you follow us or interact with us on those platforms, we will process the data you provide to us there solely to interact with you on the network itself, and the terms and privacy policies of each platform will also apply.
11. Changes to this policy
We may update this policy to adapt it to legal changes or changes in our services. We will always publish the current version on this page, together with the date it was last updated.