Privacy Policy

Last updated: [June 25, 2026]

1. Data Controller

This Privacy Policy explains how [Company Name or Legal Name], responsible for the online store [Store Name], processes the personal data of the users, customers and individuals who interact with the platform available at [Store URL, e.g. www.yourwebsite.com].

This Privacy Policy explains in a detailed and transparent manner how the personal data of users, customers and any person who interacts with the online store [Store Name], available through the domain [Store URL, e.g. www.yourwebsite.com], is collected, used and protected.

The party legally responsible for processing your personal data is:

• Legal Name: [Company Name or Legal Name]

• Tax ID: [Tax Identification Number / Tax ID]

• Registered address: [Full Legal Address].

To ensure the proper protection of your data and to make it easier to exercise your rights (such as access, rectification, erasure or objection), the user may contact us directly through the following channels:

• Dedicated email for privacy and rights requests: [Privacy/personal data email address]

• General support email: [Support email address]

• Direct support channel: Support chat bubble available within the online store itself.

2. Personal data we may process

Depending on the user’s relationship with the store, [Short Name of the Company or Store] may process the following categories of personal data:

• Identification data: full name and data associated with the user account.
• Contact data: email address, phone number and communications held with customer service.
• Purchase data: products purchased, order history, billing, incidents, returns and refunds.
• Delivery data: delivery address when the customer selects home delivery.
• Technical and browsing data: IP address, cookie identifiers, device, browser, pages visited and store usage data.
• Data related to inquiries or complaints: information, photographs or evidence that the customer sends to manage incidents, warranties, exchanges or returns.
• Marketing data: communication preferences and consent to receive commercial communications, where applicable.

[Short Name of the Company or Store] does not store complete bank card data. Card payments are processed by an external payment gateway linked to the bank account of [Short Name of the Company or Store].

3. Purposes of processing

Personal data may be processed for the following purposes:

• Create, administer and maintain the user account.
• Manage orders, payments, billing, pickups, deliveries, digital activations and transactional communications.
• Provide customer service, and resolve inquiries, complaints, incidents, warranties, exchanges, returns and refunds.
• Verify payments, and prevent fraud, suspicious transactions, unauthorized access or abusive use of the platform.
• Comply with legal, accounting, tax, consumer protection and document retention obligations.
• Send commercial communications, promotions, newsletters or information of interest when the user has given consent or when another applicable legal basis exists.
• Analyze the use of the store using Google Analytics or other tools authorized through consent, in order to improve the platform’s experience, performance and content.
• Manage the technical security, maintenance, support and operation of WooCommerce and other technology systems used by the store.

4. Legal basis for processing

The legal bases that legitimize the processing of personal data are the following:

• Performance of a contract or application of pre-contractual measures: to create the account and manage orders, payments, deliveries, pickups, digital activations, incidents and support related to the purchase.
• Compliance with legal obligations: for billing, accounting, tax obligations, handling consumer rights, document retention and responding to competent authorities.
• User consent: for non-essential commercial communications, the use of analytics or advertising cookies and other processing that requires express acceptance.
• Legitimate interest: to prevent fraud, maintain the security of the platform, manage complaints, protect the rights of [Short Name of the Company or Store] and improve services, always respecting the rights and freedoms of the user.

5. Commercial communications

[Short Name of the Company or Store] may send commercial communications by email or other electronic channels when the user has authorized it or when a prior relationship exists that allows sending information related to similar products or services, under the terms permitted by applicable law.

The user may withdraw consent or unsubscribe from commercial communications at any time, using the mechanism included in each communication or by writing to the contact channels indicated in this policy.

6. Data recipients

Data may be disclosed or made available to third parties when necessary to provide the service, comply with legal obligations or manage the relationship with the user. Among others, the following may be involved:

• Payment gateways, banking institutions and payment service providers.
• Technology providers, web hosting, maintenance, security, tools associated with WooCommerce and store management systems.
• Logistics operators, pickup points or third parties contracted to manage the delivery or availability of physical products.
• Analytics tools, such as Google Analytics, always in accordance with the applicable settings and consent.
• Customer service and messaging tools, including WhatsApp Business, when the user uses this channel.
• Email marketing providers, newsletters or communication automation, where applicable.
• Legal, accounting and tax advisors, auditors or public authorities when there is a legal obligation, valid request or need to defend rights.

7. International transfers

Based on the information available, [Short Name of the Company or Store] does not plan to carry out international data transfers on its own initiative outside the European Economic Area. However, some technology providers used for analytics, communications, messaging, hosting, support or marketing may process data in other territories depending on their configuration, infrastructure or terms of service.

When a provider involves international transfers, [Short Name of the Company or Store] will seek to ensure that appropriate safeguard mechanisms are applied in accordance with data protection regulations, such as adequacy decisions, standard contractual clauses or other valid instruments.

8. Retention periods

Personal data will be retained for the time necessary to fulfill the purpose for which it was collected and, subsequently, for the periods required by applicable law or necessary to address possible liabilities.

As a general guideline:

• Account data will be retained while the account remains active or until the user requests its cancellation, except where retention obligations apply.
• Order, billing and transaction data will be retained for the legal periods applicable under tax, accounting, commercial and consumer law.
• Data related to inquiries, incidents, warranties, returns or complaints will be retained for the time necessary to manage them and to defend against possible claims.
• Data used for commercial communications will be retained until the user withdraws consent or objects to the processing.
• Data derived from cookies will be retained in accordance with the periods indicated in the Cookie Policy or in the corresponding settings panel.

9. User rights

The user may exercise the rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent, where applicable under current regulations.

To exercise these rights, the user may write to [Privacy/personal data email address], indicating the right they wish to exercise and providing the information necessary to verify their identity when reasonably required.

The user may also file a complaint with the [Country, e.g. Spanish] Data Protection Agency if they believe that the processing of their data does not comply with applicable regulations.

10. Data security

[Short Name of the Company or Store] will apply reasonable technical and organizational measures to protect personal data against loss, unauthorized access, alteration, disclosure or improper destruction. However, no digital system can guarantee absolute security.

The user must protect their credentials, avoid sharing passwords and report any unauthorized use of their account as soon as they become aware of it.

11. Data of minors

The store is intended for people over [Minimum age, e.g. 18] years old. [Short Name of the Company or Store] does not seek to collect data from minors. If it is detected that data from a minor has been collected without valid authorization, reasonable measures will be taken to delete or regularize it in accordance with applicable regulations.

12. Cookies and similar technologies

The store uses cookies and similar technologies, including technical cookies necessary for its operation and, with the corresponding consent, analytics tools such as Google Analytics. Specific information is detailed in the Cookie Policy published on the store.

13. Changes to this policy

[Short Name of the Company or Store] may update this Privacy Policy when necessary due to legal, technical, commercial or operational changes. The current version will be the one published in the store at any given time.