The preview initially works on your device. The photograph is only sent with the order when you choose to share it to prepare the piece or display it with your authorization.
Data Controller
What data we process
Depending on the relationship you have with us, we may process:
For information requests received via links, QR codes, or NFC tags, we also record the country and city or, in Spain, the province or autonomous city selected, in order to handle each contact correctly.
- Name, surname, email address, phone number, and delivery address that you provide when placing an order.
- Name, surname, phone number, email address, and city when you request more information via a Mibol link, QR code, or NFC tag.
- The content of inquiries, requests, incidents or return requests, along with their reason, amount and traceability.
- The Instagram account and, optionally, the website you provide when requesting access to the affiliate program.
- If you submit an application: contact and location details, professional links, area of interest, answers about your proposal and the portfolio in PDF or via a link that you decide to provide us.
- Product, personalization, payment, preparation and delivery data necessary to manage the order.
- If you accept commercial communications: email address, source, date, version of consent, and subsequent opt-ins or opt-outs necessary to respect your preferences.
- Basic technical information necessary for the security and operation of the site.
- If you accept analytics: pseudonymous technical identifiers, pages visited, interactions, device, and approximate location derived from the connection.
Configurator photographs
The selected photo is initially processed in the browser. When you add a design to the cart, the photograph may be stored privately for up to 30 days so that you can retrieve the purchase on this or another device. It is deleted when the cart expires or when payment is confirmed. Its public use always requires separate, express authorization.
Customer stories
After receiving your order, you can, entirely optionally, send us a photograph of the finished product and expressly authorize its publication on the Mibol website. The image will be pending review and we will never show your name, address, email or other personal data alongside it. You can withdraw your permission at any time by writing to contacto@mibol.eu.
What we use the data for
- Handling queries, exceptional incidents and return requests related to a personalized order.
- Contacting people who request more information about Mibol via a link, QR code, or NFC tag.
- Receiving, evaluating, and responding to applications to participate in the Mibol affiliate program.
- Receiving and evaluating applications to collaborate or work with Mibol, reviewing the submitted proposal and portfolio, and contacting the candidate.
- Preparing requested quotes, designs, and orders.
- Confirming the purchase by email and communicating relevant information about its preparation and delivery.
- Manage the contractual relationship, after-sales service, and applicable administrative obligations.
- Protect the site against abusive use, fraud, or security incidents.
- Measure traffic, use of the configurator, and the purchase process in aggregate to improve the experience, only if you authorize it.
- Send stories, news, benefits, and other commercial communications only when you have expressly accepted them.
Mailing preferences
Subscribing is optional and does not condition the purchase. Each campaign will include a link to unsubscribe immediately. We will keep the unsubscribed status to exclude that address from future campaigns; if you later voluntarily opt in to communications again, we will record a new subscription. Commercial unsubscription does not prevent the sending of messages necessary to manage an order.
Legal basis
The processing will be based, as applicable, on the application of pre-contractual measures requested by you, the performance of a contract, compliance with legal obligations, your consent, or our legitimate interest in maintaining the security of the service and properly handling the communications received. Both Google Analytics analytics and commercial mailing are based on your consent, which you can withdraw respectively via the “Cookies” button or via the unsubscribe link included in each campaign.
Retention
We will keep the data for as long as necessary to fulfill the purpose for which it was collected. Baskets and their temporary photographs are kept for 30 days from the last activity; if you provide your email and accept the recovery notices, we may send you a maximum of two reminders, at 24 hours and at 7 days. Applications and portfolios will be kept while the proposal is being evaluated and for the time reasonably necessary to complete the process; afterwards they will be deleted or anonymized, unless there is another legitimate basis for keeping them. Data that must be retained to address possible legal liabilities will remain blocked for the applicable periods.
Recipients
We do not sell your data. Providers that supply us with technology, hosting, payment, transactional email, preparation and transport services may access it, under the applicable guarantees and contracts. They may also be disclosed to public administrations, courts or other authorities where there is a legal obligation.
If you authorise analytics, Google will provide the Google Analytics 4 service as a technology provider. We have disabled advertising signals and we do not send the personal data entered in forms.
If a provider were to process data outside the European Economic Area, the safeguards provided for by the regulations would apply, such as adequacy decisions or standard contractual clauses.
Your rights
You may request access to, rectification, erasure, objection to, restriction of and portability of your data, as well as withdraw your consent when the processing is based on it.
Write to contacto@mibol.eu, indicating the right you wish to exercise and providing the information necessary to verify your identity. If you consider that your rights have not been addressed, you can file a complaint with the Spanish Data Protection Agency.
Security and updates
We apply reasonable measures to protect the data against loss, unauthorized access, or alteration. This policy may be updated when the service, the processing activities, or the applicable obligations change.
Children under 14 years of age must not provide personal data without the authorization of their parents or guardians.
Last updated: October 7, 2026.