Privacy policy

Notice under the EU General Data Protection Regulation (GDPR) and the Personal Data (Privacy) Ordinance of Hong Kong. Last updated: 28 October 2026.

Data controller

SILVIA ROA FRANCO, registered office at C. de Antonio Pérez, 6, 28002 Madrid, Spain. Email: privacy@fixandfield.com.

In short

• The party responsible for your data is SILVIA ROA FRANCO, which is also the seller: every order comes directly to us.
• Data is used to confirm and deliver your order, handle returns and warranty, and reply to your messages. It is never sold and we send no newsletters.
• Advertising is measured with Google Ads and Meta; details on the Cookies page.
• You can access, correct or delete your data or object by writing to privacy@fixandfield.com: we answer within 30 days, free of charge.

What data we collect

• When you order: first and last name, phone, delivery address, any note for the courier, product, quantity and total, order date, and a label showing which advertisement or page you came from. Email only if you give one.
• During and after the confirmation call: the outcome (confirmed, changed, cancelled, not reached) and any correction you give us.
• When you write to us: name, email, message, date and time sent.
• For a refund: account holder and IBAN, used once for the transfer. We never ask for card numbers, PINs or passwords.
• When you browse: the hosting provider records brief technical data (IP address, time, page requested, browser) for security. Your browser keeps only the items listed on the Cookies page.

We do not profile people and no decision about them is taken by a machine alone. If an automated check wrongly refuses an order, write to us and a person will review it. The site is not aimed at children under 16.

Why we use it and on what basis

• To confirm and ship your order and give you support (performance of the contract and pre-contract steps you request).
• To comply with legal obligations, such as tax and accounting.
• For security and fraud prevention and to measure the results of our advertising (legitimate interest).
• For advertising cookies of Google, your consent, which you can give or refuse in the cookie notice and change at any time.

We do not use your data to send advertising without your consent and we do not sell it.

Advertising, Google and Meta

Our advertisements are run by us with Google Ads and Meta. On every page the Google tag loads in a limited mode: it sets no advertising cookies and shares no advertising identifiers until you accept cookies in the cookie notice. After an order, the confirmation page always reports the sale to Google Ads (without cookies if you refused) and to Meta (through the Meta Pixel and, with the same order code, from our server). They receive only the order value, currency, product, quantity and order code, plus technical data such as your IP address and browser type, never your name, address, phone or email. Details on the Cookies page.

Who we share data with

Only those needed to complete the order: the courier (name, address, phone, note and amount to collect; it acts as an independent controller for the carriage), our phone-confirmation (call center) and logistics providers, hosting and IT services — including Vercel Inc. (USA), which hosts the website and is the registrar of the domain name —, accountants and advisers, our bank for refunds, and authorities when the law requires it. We do not sell data, pass it to data brokers or share it with other online shops.

International transfers

We are based in Hong Kong, so your data is processed there. For customers in the European Union, the transfer of your data to Hong Kong is necessary for the performance of your contract with us (Article 49(1)(b) GDPR). Data held by Vercel Inc. in the United States is transferred under standard contractual clauses. We transfer data to no other country.

How long we keep it

• Delivered orders, invoices and refunds: 7 years (accounting and tax obligations).
• Cancelled, unconfirmed or uncollected orders: 90 days, then deleted or anonymised.
• Messages you send us: 24 months after our last reply (if about an order, the order’s period applies).
• IBAN for a refund: deleted within 30 days of the transfer.
• Server technical logs: up to 12 months, for security.

If a complaint, warranty claim or dispute is open, we keep what is relevant until it ends.

Your rights

You can ask us at any time to access, correct, delete, restrict, port or object to the use of your data by writing to privacy@fixandfield.com. You can also lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong, or with the data protection authority of the country where you live.

Providing the form data is necessary to complete the order: without it we cannot deliver.