Privacy policy

Last updated: 19 August 2026

1. Data controller

The controller of the personal data collected through this website is:

Email: kneexfit@gmail.com
Trade name: KneeXFIT

This Privacy Policy describes how KneeXFIT collects, uses, discloses, retains and protects the personal data of users and customers, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD).

2. Scope

This Policy applies to data processed when the user browses the website, makes a purchase, creates an account, contacts customer service, subscribes to commercial communications, interacts with advertisements, uses forms or any other service offered by KneeXFIT.

By using the website or making a purchase, the user declares that they have read and understood this Privacy Policy.

3. Personal data we process

Depending on how you interact with KneeXFIT, we may process the following categories of data:

Identification data: first name, surname and, where necessary, tax/ID number for invoicing.
Contact data: email address, telephone number, billing address and shipping address.
Purchase data: products viewed, added to cart, purchased, returned or cancelled, order history and incidents.
Payment data: payments are handled by secure external gateways. KneeXFIT does not store your full bank card number.
Communications data: messages sent to customer service, enquiries, complaints, requests, replies and incidents.
Technical and browsing data: IP address, device, browser, operating system, identifiers, pages visited, browsing events, cookies and similar technologies.
Marketing data: newsletter subscription, commercial preferences, interaction with campaigns, advertisements, discounts or promotions.
Security data: information necessary to prevent fraud, promotion abuse, chargebacks, improper access or unlawful use of the site.

KneeXFIT does not request specially protected data, such as health data. We recommend not sending diagnoses, medical reports, detailed injury information or health documentation. If the user voluntarily provides sensitive information in an enquiry, it will be processed solely to respond to that request and will not be used for commercial purposes.

4. Source of the data

Data may come from:

Information provided directly by the user when purchasing, contacting us, creating an account or subscribing.
Activity generated while browsing the website.
Cookies and similar technologies, in accordance with the Cookie Policy and the consent given where necessary.
Payment, logistics, ecommerce, customer service, analytics, advertising or fraud prevention providers.
External platforms when the user interacts with KneeXFIT through social media, advertisements or third-party services.

5. Purposes and legal bases

KneeXFIT will process personal data for the following purposes:

Managing orders and the contractual relationship. Processing purchases, payments, confirmations, shipments, deliveries, returns, refunds, warranties, customer service and incidents.
Legal basis: performance of the contract.

Complying with legal obligations. Invoicing, accounting, tax obligations, consumer law, warranties, complaints, requests from authorities and document retention.
Legal basis: legal obligation.

Customer service. Responding to enquiries, handling incidents, complaints, exchanges, returns, product questions or user requests.
Legal basis: performance of the contract, legitimate interest or consent, depending on the case.

Commercial communications. Sending newsletters, offers, promotions, discounts or KneeXFIT news.
Legal basis: the user's consent, or legitimate interest in respect of existing customers regarding similar products, always with an opt-out option.

Abandoned cart and purchase reminders. Sending reminders relating to purchase processes that have been started, where legally applicable.
Legal basis: consent or legitimate interest, depending on the applicable configuration.

Analytics and site improvement. Analysing operation, browsing, performance, errors, preferences and user experience.
Legal basis: consent for non-essential cookies, or legitimate interest for essential technical analytics.

Personalised advertising and campaign measurement. Displaying personalised advertisements, measuring campaigns and creating advertising audiences, where the user has accepted the corresponding cookies or technologies.
Legal basis: consent.

Security and fraud prevention. Detecting fraudulent purchases, abuse, improper access, chargebacks, technical errors, attacks or unlawful use.
Legal basis: legitimate interest and, where applicable, legal obligation.

Defence of rights. Handling complaints, proceedings, evidence, legal requests or defence against liabilities.
Legal basis: legitimate interest and legal obligation.

6. Mandatory data

Data marked as mandatory during purchase, contact or a request is necessary in order to process the order, provide the service or respond correctly.

If the user does not provide the necessary data, KneeXFIT may be unable to process the order, ship it, issue an invoice or handle the request properly.

7. Shopify and ecommerce platform

The KneeXFIT online store may be hosted and operated using Shopify technology, which makes it possible to run the store, display products, process orders, manage payments, security, analytics, privacy preferences and purchase-related features.

Shopify may process certain personal data as KneeXFIT's technology provider and, in some cases, as an independent controller where it uses data for its own services, security, platform improvement, advanced features, Shop, advertising or privacy preferences, in accordance with its own policies.

For more information on how Shopify processes personal data, the user may consult Shopify's Privacy Policy: https://www.shopify.com/legal/privacy and Shopify's Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers

8. Recipients of the data

KneeXFIT does not sell personal data. We may disclose data only where necessary to:

Shopify or other ecommerce providers.
Payment gateways, banks and financial institutions.
Logistics providers, fulfilment centres, warehouses, carriers and delivery operators.
Email, customer service, technical support, hosting, security, invoicing and accounting providers.
Analytics, advertising, measurement or marketing tools, where legally applicable.
Tax, accounting, legal or administrative advisers.
Public authorities, official bodies, courts, law enforcement or administrations where there is a legal obligation.

Providers that process data on behalf of KneeXFIT shall act as data processors and must apply appropriate confidentiality and security measures.

9. Fulfilment centres and international shipping

In order to prepare and deliver orders, some data necessary for shipping may be disclosed to logistics operators, fulfilment centres, carriers, warehouses or customs authorities located inside or outside the European Economic Area.

This data is usually limited to name, address, telephone number, email address, order number and information necessary to manage delivery, tracking, customs or logistics incidents.

Where the shipment is destined outside the European Union, certain data may be processed in the destination country or by international logistics intermediaries in order to properly perform the purchase contract.

10. International transfers

Some technology, logistics, payment, analytics, marketing, advertising or ecommerce providers may process data outside the European Economic Area.

Where this occurs, KneeXFIT will endeavour to ensure that safeguards recognised by applicable law are in place, such as adequacy decisions, European Commission Standard Contractual Clauses, additional contractual measures or other legally valid mechanisms.

11. Retention periods

KneeXFIT will retain personal data only for as long as necessary to fulfil the purpose for which it was collected and, thereafter, for the periods required by applicable law or to address potential liabilities.

As a guide:

Order and customer data: for the duration of the contractual relationship and the legal periods for warranty, claims and liability.
Invoices, accounting and commercial documentation: for the periods required by tax, accounting and commercial law.
Customer service data: for as long as necessary to handle the enquiry or incident and any potential liabilities.
Marketing data: until the user withdraws consent, unsubscribes or objects to the processing.
Cookies and browsing data: as set out in the Cookie Policy.
Security and fraud prevention data: for as long as necessary to investigate incidents, prevent abuse or defend rights.

When data is no longer necessary, it will be deleted, anonymised or blocked in accordance with applicable law.

12. User rights

The user may exercise the following rights:

Access: to know what data we process.
Rectification: to correct inaccurate or incomplete data.
Erasure: to request deletion of data where applicable.
Objection: to object to certain processing, including direct marketing.
Restriction: to request that processing be restricted in certain cases.
Portability: to receive the data in a structured format where applicable.
Withdrawal of consent: to withdraw consent given at any time.
Not to be subject to automated decisions with legal or similar effects.

To exercise these rights, the user may write to: kneexfit@gmail.com. KneeXFIT may request additional information to verify the identity of the applicant before handling the request.

If the user considers that their rights have not been properly addressed, they may lodge a complaint with the Spanish Data Protection Agency: https://www.aepd.es

13. Commercial communications

KneeXFIT will only send commercial communications where there is a valid legal basis.

The user may unsubscribe at any time using the link included in each communication or by writing to kneexfit@gmail.com. Withdrawal of consent shall not affect the lawfulness of processing carried out before that withdrawal.

14. Cookies and similar technologies

KneeXFIT uses first-party and third-party cookies for site operation, analytics, personalisation, advertising and marketing.

The user may accept, reject or configure non-essential cookies from the banner or configuration panel available on the website. For more information, please consult the Cookie Policy.

15. Personalised advertising and opt-out

Where the user has given the corresponding consent, KneeXFIT may use cookies, pixels, identifiers and third-party tools to display personalised advertising, measure campaigns or create advertising audiences.

The user may withdraw their consent from the cookie panel, from browser settings or through the privacy tools available in the store, where enabled. If the store provides a data-sharing opt-out page, the user may use it to manage certain personalised advertising preferences.

16. Automated decisions and profiling

KneeXFIT does not take automated decisions that produce legal effects on the user or similarly significantly affect them.

Basic commercial profiling relating to browsing, purchases, preferences or campaign interaction may be carried out, in particular through cookies or advertising tools, provided there is a legal basis for it.

17. Minors

The website is not directed at minors. To buy from KneeXFIT it is necessary to be of legal age and to have the legal capacity to enter into contracts. We do not knowingly collect data from minors.

If a parent or guardian discovers that a minor has provided personal data, they may contact KneeXFIT to request its deletion.

18. Security

KneeXFIT applies reasonable technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure or destruction.

These measures may include restricted access, secure providers, encryption of communications, technical controls, anti-fraud measures and incident review.

No system is completely infallible. We therefore recommend not sending sensitive data, medical data, passwords, banking codes or specially protected information through insecure channels.

19. Security breaches

In the event of a security breach that may affect personal data, KneeXFIT will take the necessary measures to assess it, mitigate its effects and, where legally required, report it to the Spanish Data Protection Agency and/or the affected users.

20. Social media and external platforms

If the user interacts with KneeXFIT through social media, advertisements, messaging applications, marketplaces or other external platforms, those platforms may also process their data in accordance with their own privacy policies.

KneeXFIT will only process the data received through those channels in order to manage the corresponding interaction, enquiry, order, incident or communication.

21. Third-party links

The website may include links to pages, applications, payment gateways, logistics services, social media or other platforms managed by third parties.

KneeXFIT neither controls nor is responsible for the content, security, availability or privacy policies of such third parties, except as legally required.

22. Updates to this Policy

KneeXFIT may amend this Privacy Policy due to legal, technical, commercial, operational or security changes.

The version in force shall be the one published on the website at any given time, indicating the date of last update.

23. Contact

For any enquiry about privacy or data protection, the user may contact KneeXFIT at:

Email: kneexfit@gmail.com
Support hours: Monday to Friday, 8:00 to 20:00, Madrid time.

We aim to reply within approximately 24-48 business hours.