PRIVACY POLICY

1. DATA CONTROLLER

In accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and other applicable data protection legislation, the controller of your personal data is:

• Owner: Gomez y Tudela S.L.
• Tax ID (NIF): [COMPANY NIF]
• Trading name: [BRAND NAME]
• Registered office: Calle Serafín Álvarez Campana 7, 11500 El Puerto de Santa María, Cádiz, Spain
• Contact email: soporte.tiendaonline@outlook.es

We are not required to appoint a Data Protection Officer. All privacy matters are handled through the email address above.

2. SCOPE

This Policy governs the processing of the personal data we obtain through this online shop: browsing the website, making purchases, contacting customer service and subscribing to marketing communications.

It also applies to the data we collect when you reach our site from an advert placed on a third-party website, as explained in section 9.

3. WHAT DATA WE PROCESS AND WHERE IT COMES FROM

Data you give us directly:

• First name and surname.
• Delivery and billing address.
• Email address.
• Telephone number, where you provide it for delivery of your order.
• Body measurements in centimetres, where you send them to us to choose a size or arrange an exchange.
• Photographs of the product or its packaging, where you send them to us so we can handle a return or a problem with your order.
• The content of your communications with customer service.

Data generated by your use of the website:

• Order, return and incident history.
• IP address and technical data about your device and browser.
• Pages visited, time spent on the site, clicks and scrolling.
• The source you arrived from (advert, search engine, direct link).
• Identifiers generated by cookies and similar technologies.

About measurements and photographs: we use them solely to recommend a size or to check the condition of a returned product. They are not health data, we do not link them to any medical condition and we do not use them for any other purpose.

We do not intentionally collect special categories of personal data (health data, ethnic origin, beliefs, biometric data or sexual orientation). Please do not include information of this kind in your messages: we do not need it in order to help you.

4. WHY WE USE YOUR DATA AND ON WHAT LEGAL BASIS

Purpose	Legal basis
Managing your order, taking payment and sending it to you	Performance of the contract (Art. 6(1)(b) GDPR)
Handling returns, size exchanges and warranties	Performance of the contract and legal obligation
Answering your questions and providing customer service	Performance of the contract and legitimate interest
Issuing invoices and meeting tax and accounting obligations	Legal obligation (Art. 6(1)(c) GDPR)
Preventing order fraud and protecting the security of the site	Legitimate interest (Art. 6(1)(f) GDPR)
Analysing browsing behaviour to improve the shop	Consent (analytics cookies)
Measuring how well our adverts work and showing you advertising	Consent (advertising cookies)
Sending you marketing communications	Consent, or legitimate interest where you are already a customer and the communications relate to similar products (Art. 21.2 LSSI)

Where processing is based on your consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out beforehand.

5. HOW LONG WE KEEP YOUR DATA

Type of data	Retention period
Order and billing data	6 years from the transaction (Spanish Commercial Code) and 4 years for tax purposes
Warranty and returns data	3 years from delivery, plus the limitation period for any claims
Customer service emails	3 years from the last communication
Marketing subscription data	Until you withdraw your consent or unsubscribe
Browsing and cookie data	As stated in the cookie banner, up to a maximum of 24 months

Once these periods have passed, the data is deleted or anonymised.

6. WHO ELSE HAS ACCESS TO YOUR DATA

We only share data where it is necessary in order to provide the service, and always limited to what is strictly required:

• Shopify Inc. — shop platform and hosting of order data.
• Payment providers — Shopify Payments, PayPal and the other methods available at the time of purchase. They process your payment data in accordance with their own policies. We do not store your full card details.
• Fulfilment and logistics provider — receives your name, address, telephone number and order contents so that your order can be prepared and dispatched.
• Carriers — for delivery and tracking of your parcel.
• Omnisend — sending marketing communications by email.
• Microsoft (Clarity) — aggregate analysis of browsing behaviour.
• Advertising networks and measurement platforms — browsing data and identifiers only, and only if you have accepted advertising cookies (section 9).
• Authorities and public bodies — where there is a legal obligation.

We do not sell your personal data, and we do not pass it to third parties for those third parties' own commercial purposes.

7. INTERNATIONAL TRANSFERS

Some of the technology and logistics providers we use may process personal data outside the European Economic Area.

Where this happens, the transfer relies on one of the mechanisms set out in Chapter V of the GDPR:

• Adequacy decisions issued by the European Commission.
• Standard Contractual Clauses approved by the European Commission.
• Other legally recognised safeguards, together with any applicable supplementary measures.

You can ask us for information about the safeguards in place by writing to soporte.tiendaonline@outlook.es.

8. MARKETING COMMUNICATIONS

If you give us your consent, or if you have already made a purchase and we write to you about similar products, you may receive information about new arrivals, promotions, offers and campaigns.

You can unsubscribe at any time:

• using the unsubscribe link at the bottom of every email, or
• by writing to soporte.tiendaonline@outlook.es.

Unsubscribing takes effect immediately. Emails relating to an order in progress (confirmation, dispatch, problems with your order) are not marketing communications, and you will continue to receive them while the order is active.

9. ADVERTISING, MEASUREMENT AND PROFILING

We promote our products through adverts placed on third-party websites, social media and search engines.

To find out which adverts work, we use measurement tools that record whether a visit coming from an advert ended in a purchase. This measurement may be carried out using cookies in your browser or through server-to-server transmissions, in which information about the transaction is sent to the relevant advertising platform. Where those transmissions include any contact details, they are encrypted beforehand, so that the platform cannot read them directly.

These tools also allow advertising platforms to show you our adverts, or adverts for similar products, while you browse other sites.

All of this processing is only activated if you accept advertising cookies in our cookie banner. If you decline them, you can still shop as normal: the site works exactly the same.

We do not make automated decisions that produce legal effects concerning you, other than as described in section 11 on fraud prevention.

10. COOKIES

This site uses its own cookies and third-party cookies. We group them into three categories:

• Necessary: essential for the basket, the checkout process and the security of the site to work. These do not require consent.
• Analytics: these help us understand how the shop is used and spot points of friction. They include Microsoft Clarity, which records clicks, scrolling and browsing patterns in aggregate form without identifying you personally.
• Advertising: these measure the results of our adverts and allow us to show you relevant advertising.

Analytics and advertising cookies are only activated after you accept them in the banner that appears when you enter the site. You can accept, decline or set your preferences in that banner, change them later using the cookie settings link, and delete them at any time from your browser settings.

11. FRAUD PREVENTION

To protect both you and us, certain orders may be analysed by automated fraud detection systems provided by Shopify and by our payment providers.

These systems assign a risk level to the transaction. No order is rejected on the basis of the automated result alone: where the system flags a high risk, we review the case manually and may ask you for additional information before accepting or cancelling the order. You can request human intervention, put forward your point of view and contest the decision by writing to soporte.tiendaonline@outlook.es.

12. SECURITY

We apply reasonable technical and organisational measures to protect your data against unauthorised access, alteration, loss, destruction or improper disclosure: an encrypted connection across the whole site, restricted access to information, and providers that meet recognised security standards.

No system connected to the internet can guarantee absolute security, but we work continuously to maintain an appropriate level of protection.

13. YOUR RIGHTS

You can exercise the following rights at any time:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data where it is no longer needed.
• Objection: object to certain processing, including marketing.
• Restriction: ask us to suspend processing while a complaint is resolved.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent: at any time, without retrospective effect.
• Not to be subject to automated decisions with significant effects, as described in section 11.

How to exercise them: write to soporte.tiendaonline@outlook.es stating which right you wish to exercise. We will reply within a maximum of one month. We may ask you for proof of identity where this is necessary to protect your own data.

Exercising these rights is free of charge.

14. COMPLAINTS

If you believe we have not handled your request properly, or that the processing of your data does not comply with the law, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, through its online portal.

We would be grateful if you wrote to us first: it is almost always sorted out in a couple of emails.

15. MINORS

This shop is not aimed at minors and we do not sell products to anyone under the age of 18.

If we become aware that we have collected data from a minor without the authorisation required by applicable law, we will take reasonable steps to delete it.

16. CHANGES TO THIS POLICY

We may update this Policy where necessary to reflect changes in legislation, technology or the way the shop operates. The version in force will always be the one published on this website, with its last updated date shown at the top.

If a change substantially affects the processing of your data, we will let you know by email where we hold your address.

17. CONTACT

For any question about this Policy or about exercising your rights:

soporte.tiendaonline@outlook.es

We deal with enquiries by email only.