Privacy policy

Last updated: 26 August 2026

Who the controller is

The controller of any data you provide through this shop is CMOX VORTEX, S.L. (hereinafter, CMOX).

• Spanish tax number (CIF): B22543268
• Email: info@cmox.es
• Phone: 603 01 02 32

What data we process, and what for

This shop does not sell online: there is no basket, no payment gateway and no charging. What there is is a repair catalogue and a trade account that lets you see prices. There are five processing activities, and none of them collects more data than it needs.

1. Replying to your message

If you fill in the contact form, we process your name, your company name, your email address, your phone number, the subject and the message. They are used solely to read what you sent and reply to you.

The IP address it was sent from is recorded alongside the message. This is not for profiling: the form allows five submissions per hour from the same IP, and without storing it that limit cannot be applied.

• Legal basis: your consent when submitting the form (Art. 6(1)(a) GDPR) and pre-contractual steps where what you are asking for is a quotation (Art. 6(1)(b)).
• Where it ends up: in an email to info@cmox.es. It is not stored in any database and does not pass through any external form service.
• Retention: for as long as it is useful for handling the enquiry and any obligations arising from it.

2. Your trade account

Seeing prices requires an account, and to create one we ask for your first and last name, the company name, the tax number (CIF/NIF), the address, the phone number, the email address and a password.

The password is not stored. What is stored is a cryptographic hash that cannot be reversed: not even CMOX can read it.

We ask for the tax number and the address because the prices are business-to-business and those are the details an invoice is issued with. If you end up not buying anything, they are not used for anything else.

• Legal basis: performance of a contract, or pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Where it is stored: in our CRM database, on the same hosting as this shop.
• Retention: for as long as the account is active. Deleting it also deletes its open sessions. If there has been invoicing, the tax records are kept for six years by legal obligation (Art. 30 of the Spanish Commercial Code) and four for tax limitation purposes.

3. Checking that you work in the trade

A newly created account does not see prices. First, someone at CMOX checks that whoever registered is a company in the sector. In the meantime, the shop tells you the account is pending.

When someone registers, an internal notice is sent to info@cmox.es with the company name, the tax number, the person’s name, the email and the phone, so that the request does not sit there unseen. When it is approved, we let you know by email.

• Legal basis: CMOX’s legitimate interest (Art. 6(1)(f) GDPR) in not publishing trade prices to people who are not in the trade. It is a manual, one-off check: no profiling and no automated decisions.

4. Keeping you signed in, and stopping attacks

When you sign in to your account, a cookie called cmox_tienda is set on the .cmox.es domain. It is what saves you typing the password on every page.

• It lasts 30 days.
• It is HttpOnly: the page’s JavaScript cannot read it.
• It travels only over HTTPS and with SameSite=Lax.
• It is strictly necessary for a service you asked for, so it needs no prior consent and appears in no cookie banner.

On top of that, so that nobody can brute-force passwords:

• Sign-in keeps a counter of failed attempts per email address, in a temporary file and for one hour. The address is not stored in the clear, only a hash that cannot be reversed.
• The contact form uses our own security code — not a captcha from Google or anyone else — whose signed token expires after ten minutes.

5. Knowing how many people come in

If you accept it in the cookie banner, we use Google Analytics to know how many people visit the shop, which repairs they look for and where they arrive from.

If you do not accept, nothing is installed. Google’s script is not even downloaded: it is not that it loads and does not measure, it never exists on the page at all.

• Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• What is processed: browsing data — pages viewed, language, where you arrive from, device type — and a cookie identifier. The IP address is truncated before being stored.
• Who else sees it: Google Ireland Limited, as a processor. Google may process data outside the European Union on the basis of the Commission’s standard contractual clauses.
• Retention: whatever the Analytics property is configured for. The cookies expire after two years.
• The exact cookies are named one by one in the cookie policy.

What we do not do

Worth saying, because it is what most shops do do:

• No advertising. No social-network pixels, no remarketing, nothing that follows anyone from one site to another.
• No heatmaps and no session recordings of what you do on screen.
• No embedded social buttons, the kind that measure even when nobody clicks them.
• Nothing is loaded from outside except Google Analytics, and only if you accept: no fonts, no icons, no libraries pulled from another server.
• No newsletter, and no data is passed to anyone for commercial purposes.
• No online payment, so we process no bank or card details.
• No automated decisions and no profiling.

Who else sees your data

• OVH, which hosts the web server, the database and the email, as a processor. The servers we use are inside the European Union.
• Google Ireland Limited, only if you accept measurement, and only for that. Google may process data outside the European Union on the basis of the Commission’s standard contractual clauses.

Nobody else. If you refuse measurement, the only party involved is OVH.

Your rights

You may ask us at any time to give you access to your data, to rectify it, to erase it, to object to the processing, to restrict it, or to ask for portability. You may also withdraw any consent you have given, without that affecting what was done beforehand.

This is done by writing to info@cmox.es. We reply within one month. To delete your account it is enough to ask by that email: it is removed, and its sessions with it.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency.

Children

This shop is aimed at companies and professionals. It is not directed at minors and we do not knowingly collect their data.

Changes

If what we do with the data changes, this page changes, and the date above is updated.