Privacy Policy

Last updated: 13 August 2026

1. Data Controller

SAIVA MANAGEMENT, S.L. ("SAIVA") is the controller of the personal data processing described in this Policy where it operates the digital platform and acts as the seller of the products marketed through the online store. Certain third parties may process personal data for their own purposes as independent controllers, in which case their own privacy terms will also apply.

Controller SAIVA MANAGEMENT, S.L.
Tax ID B88091640
Registered address Calle Bruselas, 3, 28232 Las Rozas de Madrid, Madrid, Spain
Company register Madrid Commercial Registry, volume 37,625, folio 194, section 8, sheet M-670465, entry 2
General email admin@saivamanagement.com
Customer service and privacy support@carlossainz.es

2. Scope of this Policy

This Policy applies to personal data processing carried out through the official Carlos Sainz website, the online store and the digital services enabled by SAIVA from time to time, including purchasing and payment, order preparation and delivery, customer support, returns and warranties, forms, newsletter subscriptions, back-in-stock alerts, commercial communications, CRM and segmentation, analytics and advertising tools, embedded content, accessibility preferences and, where applicable, experiences or events organised by SAIVA.

The launch configuration does not include a user account or "My Account" area. If this feature is introduced later, SAIVA will update the relevant information before activation where necessary.

Third-party websites, platforms or forms to which users are redirected are governed by the third party's own privacy policy where that party independently determines the purposes and means of processing. In particular, where an event is organised and managed directly by a partner or promoter and registration takes place in that party's environment, the third party will be responsible for providing its own privacy information.

3. Where We Obtain Personal Data

• Directly from you when you use a feature that requires personal data, purchase a product, request information, contact customer support, subscribe, request a back-in-stock alert, manage a return or warranty, express interest in or register for an event organised by SAIVA, or exercise your rights.
• Automatically through technical logs, cookies, pixels, tags, identifiers and similar technologies, subject to the applicable configuration and to your consent preferences where consent is required.
• From service providers involved in the service you request, such as Shopify, payment providers, Bigblue, carriers, Klaviyo or support tools, where required to perform the purchase, delivery, return, support or communication.
• From partners or promoters only where there is a valid legal basis and you have been informed of the disclosure. A simple redirect to a third-party event does not mean that SAIVA receives the personal data you provide to that third party.

SAIVA does not routinely request special categories of personal data. Please avoid including health, disability or other sensitive information in open fields or communications unless it is strictly necessary for a specific request. If you voluntarily provide such information, its use will be limited to the relevant purpose and subject to the applicable legal basis and safeguards.

4. Categories of Personal Data We May Process

Identity and contact details: name, surname, email address, telephone number, postal address, country, language and order-recipient details.

Purchase and contractual data: products and variants, cart, order number, amounts, currency, taxes, charges, billing, acceptance of terms, pre-orders, returns, refunds and warranties.

Payment and fraud data: transaction identifiers, tokens, payment status and authentication, risk signals, IP address and data required for refunds or chargebacks. SAIVA does not intend to store full payment-card details or CVV where payment is processed by specialised providers.

Logistics and delivery data: delivery address, contact details, order contents and value, tracking, delivery status, incidents, customs and return data.

Customer support and claims: enquiry content, communications, documents or photographs necessary to resolve incidents, returns, warranties or claims.

Marketing, CRM and profile data: email address, subscription status and source, language, country or approximate location, preferences, purchase history, viewed products, interactions, opens, clicks, segments, tags, opt-outs and suppression status.

Browsing and device data: IP address, online identifiers, browser, operating system, device, date and time, URL, visited pages, clicks, scrolling, traffic source and technical or security events.

Events and experiences: identity and contact details, event of interest, registration, communications and, where relevant, data required to manage attendance or participation.

Accessibility data: technical accessibility preferences or widget settings and information provided in an accessibility support request.

5. Purposes, Legal Bases and Retention

5.1. Website operation, hosting, security and technical administration Purpose: Process technical data and logs to serve the website, maintain availability and integrity, manage DNS, hosting and CMS services, prevent unauthorised access, detect abuse, maintain backups and resolve incidents. Legal basis: SAIVA's legitimate interest in operating and protecting its services and, where applicable, compliance with legal obligations. Recipients/providers: Cloudflare, Vercel, Prismic, development providers and authorised personnel. Retention: For as long as strictly necessary for operations and security. Logs related to incidents may be retained while the incident is investigated and for the period required to establish, exercise or defend legal claims.

5.2. Cookie preference management and proof of choice Purpose: Record and respect accepted or rejected categories, allow consent withdrawal and demonstrate the choices made through the cookie panel. Legal basis: Consent for non-essential technologies and compliance with legal obligations regarding preference management and evidence. Recipients/providers: Cookiebot/Usercentrics and, only where applicable, providers activated according to your choice. Retention: According to the preference and evidence periods set out in the Cookie Policy and CMP configuration, without prejudice to the minimum evidence needed to demonstrate compliance.

5.3. Website analytics and audience measurement Purpose: Generate statistics, measure performance, analyse website use, attribute results and improve content, navigation and purchasing processes. Legal basis: Your consent for non-essential analytics cookies and technologies. Recipients/providers: Google Analytics and authorised agencies or personnel. Retention: For the periods configured in the relevant tools and described in the Cookie Policy. SAIVA applies data minimisation and avoids sending directly identifying data through URLs or analytics parameters.

5.4. Heatmaps, user experience and session recordings Purpose: Analyse clicks, scrolling, journeys and friction to detect issues and improve the user experience. Where recordings are enabled, exclusions and masking measures will be applied. Legal basis: Your consent. Recipients/providers: Hotjar and authorised personnel or agencies. Retention: For the shortest period compatible with the purpose and validated configuration. Checkout, payment, support and form areas should be protected from unnecessary capture of personal data.

5.5. Advertising, Meta Pixel and conversion measurement Purpose: Measure campaigns and conversions, attribute results and, where enabled and authorised, personalise advertising or create audiences. Legal basis: Your consent. Recipients/providers: Meta Platforms Ireland Limited, technology providers linked to the campaign and authorised agencies. Retention: For the period associated with campaigns, audiences and relevant settings, subject to periodic review. Special category data will not be deliberately used for advertising segmentation.

5.6. Purchases, orders, pre-orders, billing and transactional communications Purpose: Manage cart and checkout, conclude and perform the purchase, manage pre-orders, issue documentation, confirm orders and send communications strictly related to payment, preparation, shipping, delivery or pre-order updates. Legal basis: Performance of the contract and compliance with commercial, tax and consumer-protection obligations. Recipients/providers: Shopify, payment providers, Klaviyo where used for transactional messaging, Bigblue, carriers, advisers and authorities where applicable. Retention: For the duration of the contractual relationship and subsequently blocked or retained for the legal periods applicable to commercial and tax records, warranties, liabilities and claims.

5.7. Payments, authentication and fraud prevention Purpose: Process payments and refunds, authenticate transactions, prevent fraud and handle payment incidents or chargebacks. Legal basis: Performance of the contract, compliance with legal obligations and legitimate interest in fraud prevention and transaction security. Recipients/providers: Payment providers and wallets integrated with Shopify, banks, card networks and Shopify, depending on the payment method selected. Retention: According to payment-provider obligations and for the periods required for reconciliation, contractual records and claims. SAIVA will not retain full card details or CVV where these are processed directly by the payment provider.

5.8. Order preparation, shipping, delivery and logistics Purpose: Store, prepare, package, dispatch and deliver orders; provide operational tracking; and manage failed deliveries, customs, incidents and B2B operations where applicable. Legal basis: Performance of the contract and compliance with applicable legal obligations. Recipients/providers: Bigblue as 3PL logistics operator, the warehouse, carriers or postal operators used for each shipment, and customs authorities where necessary. Retention: During shipment and incident management and subsequently insofar as the information must remain linked to the order for applicable legal periods.

5.9. Withdrawal, returns, defective products, warranties and refunds Purpose: Manage statutory withdrawal, standard and high-value returns, receipt and inspection of products, conformity issues, warranties, refunds and claims. Legal basis: Performance of the contract, compliance with consumer-law obligations and legitimate interest in documenting product condition and establishing, exercising or defending claims. Recipients/providers: Shopify, Bigblue, carriers, payment providers, Gmail, advisers, consumer authorities and courts where applicable. Retention: During the handling of the request and subsequently for applicable warranty, record-keeping and limitation periods. Photographs or condition evidence will be limited to what is necessary to handle the return or claim.

5.10. Enquiries and customer support Purpose: Respond to questions, assist with products or orders, resolve incidents and take requested pre-contractual steps. Legal basis: Pre-contractual or contractual measures and SAIVA's legitimate interest in organising and documenting customer support. Recipients/providers: Google Workspace/Gmail, Shopify, Bigblue, Klaviyo if support functionality is integrated, and authorised personnel or advisers. Retention: For as long as necessary to resolve the enquiry and, where linked to a purchase, claim or dispute, for the corresponding legal periods.

5.11. Newsletter and commercial communications Purpose: Send news, content, launches, products, offers and other commercial communications relating to Carlos Sainz; manage sign-ups through double opt-in, confirmations, preferences, opt-outs and suppression lists; and operate the commercial calendar communicated for launch. Legal basis: Your consent. Where there is a prior contractual relationship and all requirements of the Spanish Information Society Services Act (LSSI-CE) are met, SAIVA may send communications concerning its own similar products or services, always providing an easy and free opt-out. Recipients/providers: Klaviyo, Shopify where synchronised, email providers and authorised personnel or agencies. Retention: Until consent is withdrawn or you object. Minimum information will be retained in suppression lists to respect the opt-out and demonstrate compliance. New subscriptions are subject to double opt-in and SAIVA will retain reasonable evidence of both the initial request and the confirmation. Inactive contacts may be reviewed and, where appropriate, suppressed or included in a re-confirmation campaign only where there is a valid basis to contact them.

5.12. "Back-in-Stock / Notify Me" alerts Purpose: Send the requested alert when a specific product becomes available again. Legal basis: Your consent or express request to receive that specific alert. Recipients/providers: Klaviyo, Shopify and email providers. Retention: Until the alert is sent, you withdraw the request or it is no longer reasonable to maintain it. A back-in-stock request does not by itself subscribe you to the general newsletter.

5.13. CRM, segmentation and active commercial flows Purpose: Organise the database and carry out basic segmentation necessary to manage the commercial newsletter and Welcome Email. At launch, the commercial flows communicated are limited to the general newsletter under the commercial calendar and the Welcome Email. A "Vault / code confirmation" flow may also be used to confirm or provide a code requested by the user; if that flow contains promotional content, it will be treated as a marketing communication and will be subject to the corresponding marketing legal basis. Legal basis: Consent for the newsletter, Welcome Email and any promotional content or related marketing profiling. Where the Vault/code-confirmation flow is strictly functional and limited to responding to a user request, processing will rely on steps requested by the user or performance of the relevant service. The existing-customer exception under the LSSI-CE will only be used where all of its requirements are fully met. Recipients/providers: Klaviyo, Shopify and authorised agencies. Retention: While the relevant legal basis exists and the data are necessary for the purpose. Withdrawal of consent or objection will prevent use of the profile for direct marketing and will trigger the relevant suppression. Data linked to a code confirmation or other functional request will be retained only for as long as necessary to provide and evidence that functionality and, where applicable, for relevant liability periods.

5.14. Events, experiences and expressions of interest Purpose: Manage information requests, interest lists, registrations, communications or attendance for events and experiences organised by SAIVA. Where final ticket sales or registration are handled by a promoter, SAIVA may redirect users to the third party's environment. Legal basis: Consent to receive alerts or communications about an event and, where SAIVA manages registration or contracting, pre-contractual or contractual measures. Applicable legal obligations may provide an additional basis. Recipients/providers: Service providers required for the event and, only where expressly disclosed and legally justified, partners or promoters. Retention: During event organisation and delivery and subsequently for periods required to address liabilities. Interest lists are retained until the alert is sent, consent is withdrawn or the purpose ends. If an event is organised directly by a partner and you register on its platform, the partner processes the data under its own policy.

5.15. Videos, sports information and embedded content Purpose: Display video and audiovisual content, calendars, results, statistics and other sports information. Legal basis: Legitimate interest in providing website content; consent where a third-party integration uses non-essential cookies or technologies. Recipients/providers: Vimeo, SportMonks and infrastructure providers. Retention: According to the configuration of each integration. SAIVA aims to keep third-party content involving non-essential technologies blocked until consent is available. SportMonks is used as a source of sports data and is not intended to create visitor profiles.

5.16. Accessibility Purpose: Provide accessibility adjustments and respond to accessibility-related incidents. Legal basis: Compliance with applicable obligations and legitimate interest in providing an accessible experience; consent where non-essential cookies are used. Recipients/providers: EqualWeb and authorised personnel. Retention: For as long as necessary to maintain the preference or resolve the incident, subject to tool configuration. Accessibility preferences will not be used for marketing or to deliberately infer health or disability profiles.

5.17. Rights requests, compliance and defence of claims Purpose: Handle data-protection rights, privacy complaints, authority requests and demonstrate compliance or defend legal claims. Legal basis: Compliance with legal obligations and legitimate interest in establishing, exercising or defending claims. Recipients/providers: SAIVA, advisers, providers required to implement data instructions, authorities and courts. Retention: During handling and subsequently for applicable limitation and liability periods, with restricted access.

6. Marketing, Consent and Right to Object

Newsletter subscription is voluntary and is not a condition for purchasing. In forms whose primary purpose is not marketing, any commercial-marketing consent will be requested through a separate, optional and unticked choice. In a form dedicated solely to newsletter subscription, the unambiguous subscription action may constitute consent where the wording clearly identifies the purpose and controller.

SAIVA uses double opt-in for new newsletter subscriptions. After the initial sign-up request, the user must complete the additional confirmation step before being added to the commercial mailing list. SAIVA will retain reasonable evidence of both actions, including, where available, the date, time, source, language and version of the notice presented. Silence or failure to respond will never be treated as consent.

Each commercial communication will include an easy and free mechanism to unsubscribe or object. The opt-out will be reflected in the relevant lists and flows, without prejudice to retaining minimum suppression information to prevent unwanted future messages.

Subscribing to Carlos Sainz communications does not automatically subscribe a user to separate newsletters from Fifty Five, Team Fifty5 or other brands. If separate marketing streams are introduced, the appropriate consent choices will be provided.

7. Profiling and Automated Decisions

SAIVA may carry out basic segmentation to organise its CRM and manage the communications that are active at any given time, for example by language, country, subscription status and campaign response or interaction. At launch, the previously assessed Abandoned Cart, Winback, Sunset/Unengaged, Post-Purchase Cross-Sell/Upsell, VIP and Birthday/Anniversary flows are not planned to be active unless subsequently enabled following the relevant review. Marketing profiling is not intended to produce legal effects or similarly significant effects.

You may object at any time to direct marketing and to profiling related to such marketing. At launch, SAIVA does not intend to make decisions based solely on automated processing that produce legal effects or similarly significantly affect users. If a system with those characteristics is introduced later, the information and safeguards required by the GDPR will be provided before use.

8. Recipients and Main Service Providers

SAIVA limits access to personal data to recipients that need it for the relevant functionality. The exact involvement of each provider depends on the services and configuration actually enabled. The main providers communicated for the project include:

Provider / category Function Associated data or activity Shopify E-commerce platform Checkout, orders, customer data, integrations and store functionality. Klaviyo CRM and email marketing Double opt-in, commercial newsletter, Welcome Email, Back-in-Stock, Vault code confirmations where applicable, and authorised transactional messages. Google Analytics Analytics Audience measurement and browsing events where consent is given. Meta Pixel / Meta Advertising and measurement Conversions, attribution and audiences where consent is available. Hotjar User experience Heatmaps, interactions and, if enabled, session recordings subject to masking. Cookiebot / Usercentrics CMP Cookie preference management and proof of choice. Prismic CMS Content management and publication. Vercel Hosting and infrastructure Hosting, delivery and technical application logs. Cloudflare DNS and security DNS resolution, security, performance and technical connection data. Bigblue 3PL logistics and returns Storage, order preparation, packaging, dispatch, operational tracking and physical returns handling. Google Workspace / Gmail Email and support Receipt and management of customer-service enquiries and communications. EqualWeb Accessibility Technical preferences and accessibility support depending on configuration. Vimeo Video Hosting or playback of audiovisual content; third-party cookies or connections are managed according to applicable consent. SportMonks Sports data Race calendar, results and data API; not intended to create visitor profiles. Payment providers Payments and fraud Chosen payment method, authentication, refunds and fraud prevention. Carriers and postal operators Delivery and returns Recipient data, tracking, incidents and logistics necessary for the order. Authorised agencies and advisers Development, strategy, content, media and advice Limited access to data required for their functions and according to the applicable legal role.

SAIVA may also disclose personal data to public authorities, law-enforcement bodies, courts or tribunals where required by law, pursuant to a valid request, or where necessary to establish, exercise or defend legal claims.

9. International Data Transfers

Some technology providers may be established outside the European Economic Area, use subprocessors in third countries or allow international access. Where an international data transfer occurs, SAIVA will rely on the mechanism permitted by the GDPR that applies to the specific situation.

Transfers may be based, as appropriate, on European Commission adequacy decisions; the EU-U.S. Data Privacy Framework where a U.S. recipient is certified and the transfer is covered by the Framework; European Commission Standard Contractual Clauses; Binding Corporate Rules; or other safeguards or derogations recognised by law. Where necessary, supplementary measures will be assessed to maintain an appropriate level of protection.

You may request additional information about the safeguards applicable to a specific transfer by writing to support@carlossainz.es.

10. Is it Mandatory to Provide Personal Data?

Fields marked as mandatory are required to provide the requested functionality, manage a purchase, process payment, deliver an order, handle a return or respond to a request. If you do not provide them, SAIVA may be unable to provide the relevant service.

Data used for newsletters, marketing, non-essential analytics, advertising, commercial profiling, voluntary alerts or optional features are not required in order to purchase. Consent for those purposes can be refused or withdrawn without affecting essential services already contracted.

11. Data Retention

Specific retention criteria are described alongside each purpose. As a general rule, SAIVA retains personal data while necessary for the relationship or requested service and subsequently blocks or restricts them where they must be kept for legal obligations, warranties, liabilities or claims. Marketing data will no longer be used for that purpose when consent is withdrawn or the user objects, without prejudice to minimum suppression information.

Data collected through cookies or similar technologies are retained for the periods described in the Cookie Policy and preference panel. SAIVA periodically reviews retention periods and applies minimisation and deletion when data are no longer necessary.

12. Your Data-Protection Rights

Where applicable, you may exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability; withdraw consent at any time without affecting the lawfulness of prior processing; and exercise rights relating to solely automated decisions where applicable.

In particular, you have the right to object at any time to the processing of your personal data for direct marketing, including profiling related to such marketing.

To exercise your rights, email support@carlossainz.es with "Data Protection" or "Privacy" in the subject line, or write to SAIVA MANAGEMENT, S.L., Calle Bruselas, 3, 28232 Las Rozas de Madrid, Madrid, Spain. Where there are justified doubts, SAIVA may request only the information reasonably necessary to verify identity and locate the relevant data.

If you believe your personal data have not been handled in accordance with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD), whose information and channels are available at www.aepd.es.

13. Children

The platform is not specifically directed at children under the age of 14. Children under that age should not provide personal data for subscription or consent-based features without the involvement of a parent or legal guardian. The ability to consent to certain data processing does not necessarily mean that a person has legal capacity to enter into a contract; purchases must be made by persons with the required legal capacity or authorisation.

14. Security and Confidentiality

SAIVA applies technical and organisational measures appropriate to the risk to protect personal data against destruction, loss, alteration, unauthorised disclosure or access. Access is limited to personnel, agencies and providers that need the data for their functions and are subject to the applicable confidentiality and data-protection obligations.

No Internet-connected system can be regarded as absolutely invulnerable. SAIVA will review integrations, permissions, security measures and incident-response procedures as the platform evolves.

15. Cookies and Similar Technologies

The website may use cookies, pixels, tags, local storage and similar technologies to provide technical functions, remember preferences and, where you consent, perform analytics, heatmaps, advertising measurement, campaign tracking and other non-essential functions.

You can accept, reject or configure non-essential categories and withdraw consent through the cookie panel that remains available on the website. The Cookie Policy provides more detailed information about the technologies, providers, purposes and applicable durations.

16. Changes to this Policy

SAIVA may update this Policy to reflect changes in law, regulatory guidance, features, providers or configurations. Where a change may materially affect users' rights or expectations, SAIVA will provide proportionate notice and, where required, seek new consent.

The current version will be published on the website and will indicate the date of its latest update.

17. Contact

General enquiries: admin@saivamanagement.com

Customer service and data protection: support@carlossainz.es

Postal address: SAIVA MANAGEMENT, S.L., Calle Bruselas, 3, 28232 Las Rozas de Madrid, Madrid, Spain.