Privacy Policy

Processing Summary

Below is a simplified overview of how EntasisType processes your personal data. For detailed information, please read the corresponding sections below.

1. Data Controller

The controller responsible for the collection, processing, and security of your personal data on this website is:

Data Controller

Guillermo Gil Cantalapiedra

Trading Name

EntasisType

Registered Address

Julián Gayarre, 16-2A. 28014 Madrid, Spain

Privacy Contact

info@entasistype.com

Website

entasistype.com

2. Scope of this Policy

This Privacy Policy governs the processing of personal data collected through the EntasisType website, customer portal, store checkout flows, support email channels, and registration forms. It does not apply to third-party services, external websites, or platforms linked from this website.

3. Personal Data We Collect

Depending on how you interact with EntasisType, we collect and process the following categories of personal data:

• Identification and Contact Data: First name, last name, email address, and billing address.
• Organization Details: Company name, tax registration number (VAT/NIF), and job title where necessary for business invoicing.
• Customer Account Data: Username, password hash, account status, and transaction history.
• Order and Licensing Data: Purchased font families, licenses, usage tiers, EULA confirmations, order numbers, and Final Beneficiary details.
• Delivery and Download Logs: minimised IP hash where technically available, browser user-agent hash, download tokens, file versions downloaded, and timestamp of download.
• Physical Shipping Data: Shipping address, delivery recipient name, telephone number (if required by carriers), shipping method, and tracking number.
• Contact and Support Data: Information sent via our contact email or support tickets, including message history and technical inquiries.
• Preference and Usage Data: Cookie consent preferences, and light/dark theme preference settings.

4. Why We Process Personal Data

We process your personal data for the following specific purposes:

1. To manage your customer account, enable secure access, and store order history.
2. To validate digital font licenses, deliver download links, and maintain EULA records.
3. To process payments, calculate tax rates, and issue legal invoices.
4. To prepare, package, ship, and track physical merchandise orders.
5. To respond to licensing inquiries, custom type quotes, and provide support.
6. To send newsletter updates and marketing communications, subject to consent.
7. To detect and prevent payment fraud, security breaches, and unauthorized font distribution.
8. To comply with tax, corporate, and billing obligations under Spanish and European law.

5. Legal Bases for Processing

We process your data under the following legal bases recognized by Article 6 of the General Data Protection Regulation (GDPR):

• Contract Performance: Processing is necessary to perform a contract to which you are party (e.g. delivering digital fonts under a license, shipping merchandise, managing account logins).
• Legal Obligation: Processing is required to satisfy statutory duties (e.g. keeping corporate records, calculating and reporting VAT, complying with corporate tax audits).
• Legitimate Interest: Processing is justified by our interest in protecting our platform and rights (e.g. preventing checkout fraud, enforcing font EULAs, logging digital downloads to verify license compliance, defending legal claims).
• Consent: Processing is based on your explicit, granular permission (e.g. optional marketing emails, non-essential tracking cookies). You may withdraw this consent at any time.

6. Customer Accounts and Billing Profiles

When you create a customer account, we process your contact credentials to maintain your profile. The billing profile stores your business name and VAT details to streamline future checkouts and ensure accurate tax computation. You are responsible for maintaining the confidentiality of your login credentials.

7. Orders, Invoices and Licence Records

When you place an order, we record your purchase details, compile EULA agreements, and generate commercial invoices. This data is critical to prove your lawful right to use the Font Software. Under Spanish tax law, invoice records must be kept to satisfy tax and audit compliance.

8. Digital Delivery and Download Logs

To deliver commercial Font Software, the system generates secure download links. We record details in access logs when files are requested.

Digital Download Logs: We record a minimised IP hash where technically available, timestamp, user-agent hash and license token associated with font file downloads. This processing is based on our legitimate interest to prevent unauthorized distribution, detect license abuse, and verify that the digital content was successfully delivered to the authorized buyer. Raw IP addresses should be kept in server logs only for the shortest security period configured by the hosting provider.

9. Physical Product Orders and Shipping Data

For prints, poster editions, and apparel orders, we collect and process the recipient's shipping address and contact details only if the physical Store is enabled. Carrier partner details are not determined in this local audit because physical checkout is blocked until shipping operations are confirmed.

10. Contact Forms and Support

Any message sent to our support email or via website forms is stored to help us address your inquiry. Pre-contractual inquiries (such as custom typeface design quotes) are processed to prepare commercial proposals, whereas post-sales technical support is processed to fulfill EULA delivery duties.

11. Newsletter and Commercial Communications

If you explicitly opt-in to our updates, we will use your name and email to send news about new typeface releases, updates, and specimens. You may unsubscribe or withdraw consent at any time by clicking the "unsubscribe" link inside any newsletter or by contacting us directly.

12. Cookies and Similar Technologies

We use essential cookies to maintain shopping cart states, user sessions, CSRF security tokens, and secure checkout integration. Optional analytical and marketing trackers are only loaded if you give explicit consent through our Cookie Preference Panel. When configured and you accept Marketing, Meta Pixel reports page visits and browser and device information to Meta for advertising measurement. You can withdraw this permission through Cookie settings. See Meta’s Privacy Policy. For details, see our Cookie Policy.

13. Payment Processing

Payment operations on this website are handled through our secure payment gateway provider (Stripe). EntasisType does not store, access, or record your complete credit card numbers or sensitive payment authentication details.

Payment Data: All credit card details, CVV codes, and billing credentials are submitted directly to the payment processor. EntasisType receives only transaction metadata (authorization status, payment token, transaction date) to validate the order status and complete the purchase.

14. Service Providers

EntasisType uses third-party service providers to maintain the website and deliver services. Confirmed or configured categories are: hosting and database provider (not determined in this local audit), Stripe for payment processing and tax/payment metadata, SMTP/email delivery provider (not determined in this local audit; configured through server SMTP settings), newsletter subscription storage/provider (not determined beyond the local subscription table), backup provider (not determined), and shipping couriers only if the physical Store is enabled (not currently determined). All processors must operate under data protection instructions and GDPR-compliant terms before production use.

15. International Transfers

We prioritize storing and processing personal data within the European Economic Area (EEA). Stripe and any future email, hosting, backup, analytics, newsletter or shipping providers may involve international transfers depending on their infrastructure. Where data is transferred outside the EEA, EntasisType must rely on an EU adequacy decision, Standard Contractual Clauses (SCCs), or another GDPR-compliant transfer mechanism before production use.

16. Data Retention

We keep personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention is mandated by law. The following schedules apply:

• Customer Account Data: Retained while the account is active, and deleted upon request, except where order history must be retained.
• Billing, Invoices, and Order Records: Retained for 6 years from the last commercial entry, in compliance with Spanish Commercial Code requirements.
• EULA and Font Licenses: Retained for the licence term and, where necessary, during applicable limitation periods to verify lawful use, support the customer and defend legal claims.
• Download Logs and IP Records: Minimised download evidence is retained for up to 6 years where needed for contract, delivery, fraud prevention and EULA enforcement. Raw server IP logs, if any, should be retained only for a short security period set by the hosting provider.
• Newsletter Subscriptions: Retained until the user opts out or withdraws consent.
• Contact History: Stored for up to 6 years to reference ongoing inquiries or defend against contractual claims.

17. Security Measures

We implement appropriate technical and organizational measures to prevent accidental loss, unauthorized access, destruction, or disclosure of personal data. All data transmissions are secured using SSL/TLS encryption. We restrict data access only to authorized personnel who need the details to perform their work.

18. User Rights

Under the General Data Protection Regulation (GDPR), you hold the following statutory rights regarding your personal data:

Your GDPR Rights:
• Right of Access: Request a copy of the personal data we hold about you.
• Right of Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure (Right to be Forgotten): Request deletion of your data when it is no longer needed.
• Right to Restriction: Request that we limit how we process your data in specific scenarios.
• Right to Object: Object to processing based on our legitimate interests or direct marketing.
• Right to Portability: Receive your data in a structured, machine-readable format.
• Right to Withdraw Consent: Withdraw permission for consent-based updates at any time.

19. How to Exercise Rights

To exercise any of your rights, please submit a written request via email to our privacy contact at info@entasistype.com. To protect your privacy, we may ask you to provide proof of identity before resolving your request.

20. Complaints to Supervisory Authority

If you believe that EntasisType has processed your personal data in violation of data protection laws, you have the right to file a complaint with the competent supervisory authority. In Spain, this is the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD), located at Calle Jorge Juan 6, 28001 Madrid (aepd.es).

21. Changes to this Policy

We may update this Privacy Policy as our services, payment processors, carriers, or legal frameworks evolve. We encourage you to review this page periodically to remain informed about how we protect your information.