Last updated: 8 November 2026
1. Data controller
- Controller: Federico Nicolás Bitonte, trading as “Coiaca”
- Tax ID (NIF): Y8510002Q
- Address: Av. Camino de Santiago 45, 28050 Madrid, Spain
- Privacy contact: hello@coiaca.com
2. What data we process, why and on what legal basis
| When | Data | Purpose | Legal basis | How long |
|---|---|---|---|---|
| Shop purchases | Name, billing and shipping address, email, phone, products and payment (we do not see card details) | Manage the order, shipping, returns and warranty | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and then 6 years (Spanish Commercial Code) and as long as tax rules require |
| Invoicing | Billing details | Meet tax and accounting obligations | Legal obligation (Art. 6(1)(c)) | Legal periods (4 to 6 years) |
| Customer account | Username, email, encrypted password, saved addresses, order history | Let you buy faster and check your orders | Contract (6(1)(b)) | Until you delete the account; orders as in the row above |
| Contact form and support | Name, email, subject, message | Answer your enquiry | Your request: pre-contractual steps or contract (6(1)(b)), or legitimate interest in answering enquiries (6(1)(f)) | Until resolved and 3 years afterwards (the legal guarantee period). If it relates to an order, it is kept with the order |
| Coiaca Cloud HA waitlist | Email, language, date and proof of confirmation | Notify you when Cloud HA launches | Your consent (6(1)(a)), with double opt-in | Until you unsubscribe. After the launch we will invite you to join the newsletter; if you do not confirm, we delete your email 6 months after the launch |
| Coiaca Cloud HA subscription | Name, email, country and billing address, plan, region, payment and subscription history (we do not see card details) | Provide and charge for the service, send you service notices (trial, charges, maintenance, changes, end of service) and give you support | Performance of the contract (6(1)(b)) and tax obligations (6(1)(c)) | For the duration of the subscription and then the periods in the “Invoicing” row |
| Content of your Cloud HA instance | What you store in Home Assistant: configuration, devices, history, automations, files and logs, which may include data about the people in your home | Only to provide the service, following your instructions. We do not use it for anything else | Performance of the contract (6(1)(b)). If you are a business customer, we process it as a processor on your behalf | For the duration of the subscription; deleted 30 days after it ends (7 days if you cancel during the trial) |
| Back-in-stock alert | Email and product | Notify you when the product is back in stock | Your consent (6(1)(a)) | Until the alert is sent or you unsubscribe |
| Comments | Name, email, website (optional), comment, IP | Publish and moderate comments, and prevent spam | Legitimate interest (6(1)(f)) | While the comment is published |
| Statistics (Google Analytics 4) | Pseudonymised browsing data (pages, device, approximate country), identifier in a cookie | Understand how the site is used and improve it | Your consent (6(1)(a)) in the cookie banner | 14 months |
| Spam and abuse protection (hCaptcha) | Technical browser and interaction data, IP | Prevent spam and automated access on forms and at login | Legitimate interest in protecting the site (6(1)(f)) | According to hCaptcha’s policy |
| Server security | IP, date and time, requested page, browser | Keep the site secure and detect attacks | Legitimate interest (6(1)(f)) | 14 days in the server logs |
We do not make automated decisions with legal effects on you or build commercial profiles.
Marketing emails: we only send you news or promotions if you expressly sign up (for example, to the waitlist or the newsletter). Buying in the shop does not subscribe you to any list. Emails about your orders are not marketing.
3. Cookies
We use technical cookies needed for the shop to work (cart, login, language) and, only if you accept them, Google Analytics statistics cookies. Embedded YouTube videos only load if you accept the corresponding cookies. Full details, and how to change your choice at any time, are in the cookie policy.
4. Who we share your data with
We do not sell your data. We share it only when necessary:
- Carriers (Correos), to deliver your order: name, address and phone.
- Public authorities, when required by law (for example, the Spanish Tax Agency).
And these providers process it on our behalf, under a data processing agreement:
| Provider | Purpose | Where |
|---|---|---|
| DigitalOcean, LLC | Hosting of the site and the database | United States (New York) |
| DigitalOcean, LLC (Cloud HA instances) | Hosting of your Coiaca Cloud HA instance | In the region you choose when subscribing (for example, Frankfurt, Amsterdam or London). If you choose a region outside the European Economic Area, your data is hosted there |
| Stripe Payments Europe, Ltd. | Payments and management of the Coiaca Cloud HA subscription (billing portal, receipts) | Ireland (EU) and United States; Stripe is also a controller of the data it processes for its own purposes, such as fraud prevention |
| Google Ireland Ltd. / Google LLC | Email (Google Workspace), sending the site’s and the waitlist’s emails, statistics (Google Analytics) and embedded videos (YouTube) | EU and United States |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payments with PayPal, card and Google Pay | EU; PayPal is also a controller of the data it processes for its own purposes |
| Intuition Machines, Inc. (hCaptcha) | Spam and bot protection | United States |
| Automattic Inc. (Gravatar) | Show the profile picture in comments (a hashed version of the email is sent) | United States |
| Cloudflare, Inc. | Domain DNS management | United States (DNS only; it does not process visitors’ data) |
The waitlist is managed with MailPoet on our own server: MailPoet does not receive your data.
5. International transfers
Some providers are in the United States. Transfers rely on the EU-US Data Privacy Framework, where the provider participates (Google, DigitalOcean, PayPal, Stripe, Automattic, Cloudflare), or on the European Commission’s standard contractual clauses (hCaptcha).
6. Your rights
You can exercise, at any time and free of charge, your rights of:
- access to your data;
- rectification of inaccurate data;
- erasure;
- objection to processing based on legitimate interest;
- restriction of processing;
- portability of the data you gave us;
- withdrawal of consent, without affecting processing carried out before you withdrew it.
Write to us at hello@coiaca.com stating which right you are exercising. If we cannot confirm your identity, we will ask for some additional information. We will reply within one month.
To unsubscribe from the waitlist, just use the link in each email. To cancel Coiaca Cloud HA, use the billing portal; you can download the content of your instance with a backup at any time (right to portability). To delete your customer account, write to us (orders are kept for the legal periods).
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority of your country in the EU.
7. Minors
The site is not aimed at children under 14, and you cannot make purchases if you are under 18.
8. Security
We apply reasonable technical and organisational measures:
- encrypted connection (HTTPS);
- encrypted backups;
- two-factor authentication on administrator accounts;
- restricted access to data.
No system is completely secure: if a breach affecting your data occurred, we would act in accordance with the GDPR.
9. Changes
We may update this policy to reflect changes to the site or the law. We will publish the new version with its date and, if the change is significant, we will announce it visibly.