Privacy policy

Last updated: 17 October 2026.

This policy explains which personal data we process when you buy from us or get in touch, what we use it for and what rights you have. We apply it in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection (LOPDGDD). The controller is the person shown under "Data controller". The Spanish version of this text prevails in case of doubt.

What data we process and why

When you buy on the website

• Data: name, email, phone, delivery address, invoice details if you ask for an invoice (tax ID and company), any note you leave us and what you buy.
• Why: to prepare and deliver your order, keep you informed, take payment, issue the invoice and handle exchanges, returns and guarantees.
• Legal basis: performance of the sales contract (Art. 6(1)(b) GDPR) and compliance with our legal, tax and accounting obligations (Art. 6(1)(c) GDPR).
• How long: six years from the purchase, which is how long the Spanish Commercial Code requires us to keep records. After that, we delete it.

The checkout details are required: without them we cannot process the order. Your card details never pass through our website: they are requested and processed directly by the bank's payment gateway (Redsys).

When you write to us or call us

• Data: whatever you give us by phone, by email or in the shop.
• Why: to reply, for example about sizes, stock or an order.
• Legal basis: your request and steps taken before a purchase (Art. 6(1)(b) GDPR).
• How long: as long as needed to help you and, at most, one year after our last conversation, unless it is part of an order.

When you withdraw from a purchase or make a complaint

• Data: name, email, order number and whatever you tell us.
• Why: to process the withdrawal, return or complaint.
• Legal basis: compliance with consumer law (Art. 6(1)(c) GDPR).
• How long: for as long as liability for the purchase can be claimed.

To keep the website running securely

• Data: your IP address and technical browser data.
• Why: to prevent abuse and fraud (for example, by limiting repeated payment attempts) and to keep the website running.
• Legal basis: our legitimate interest in protecting the shop and its customers (Art. 6(1)(f) GDPR).
• How long: attempt counters, a few minutes; technical server logs, a few days.

We do not make automated decisions or build profiles with your data, and we do not send you advertising by email.

Who we share it with

We do not sell your data. We only share it with those who need it to provide the service:

• Payment: Redsys Servicios de Procesamiento, S.L. and the banks, which process the payment details.
• Delivery: Packlink Shipping, S.L. and the carrier you choose at checkout receive your name, address, phone and email to deliver your parcel.
• Technology providers that process data on our behalf and following our instructions:
  • Vercel Inc., website hosting;
  • Google (Firebase), database, with data stored in the European Union;
  • Resend, sending order emails;
  • Upstash, protection against abuse.
• Tax advisers and public authorities: our accountants and the Spanish Tax Agency, to meet our tax obligations; and courts or authorities when required by law.

Some of these providers are US companies. In that case, the data transfer is covered by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission.

Your rights

You can ask us at any time to:

• access your data;
• rectify it if it is wrong;
• erase it when it is no longer needed;
• object to its processing or ask us to restrict it;
• receive it in a format you can take to another company (portability).

Email us at the address shown under "Data controller" or send us a letter at the shop, saying which right you want to exercise. We will reply within one month. If we need to verify your identity, we will tell you.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

Children

The website is not aimed at children under 14, and you must be an adult to buy.

Security

We use encrypted connections (HTTPS), password and two-step verification access to the shop's admin panel, and providers with security guarantees. Only shop staff who need your data to help you can access it.

Changes to this policy

If we change how we process your data, we will update this text and its date. If the change is significant, we will tell you clearly on the website.