Privacy policy

Last updated: September 17, 2026.

1. Data controller

Because the controller is established in Spain, this store's processing of your personal data is subject to the EU General Data Protection Regulation (GDPR), regardless of the fact that we sell exclusively to customers located in the United States.

2. Information we collect

  • Contact information: name, shipping and billing address, phone number, email.
  • Payment information: securely handled by our payment provider; we don't store your full card details.
  • Order information: items purchased, order history, returns/refund requests.
  • Account information: if you create an account, your username and preferences.
  • Technical information: IP address, device and browser type, cookies, browsing activity on the store.
  • Communications: the content of messages you send us.

3. How we use it, and our legal basis under the GDPR

  • Fulfilling your order (payment, shipping, refunds) — necessary to perform our contract with you.
  • Customer support — necessary to perform our contract with you.
  • Legal compliance (accounting, tax obligations) — necessary to comply with a legal obligation.
  • Marketing communications — only where you've given consent (e.g. newsletter signup); you can withdraw consent at any time.
  • Improving the store and preventing fraud — based on our legitimate interest.

4. Who we share it with

We don't sell your personal information. We share it only with third parties who help us run the store:

  • Shopify, which hosts the store and checkout. See Shopify's privacy policy.
  • Zendrop, our fulfillment partner, to prepare and ship your order.
  • Our payment processor, to securely process payment.
  • Analytics or marketing tools, only if enabled and where consent is required.

Some of these providers may process data outside the European Economic Area. Where that happens, we rely on the safeguards each provider has in place (such as standard contractual clauses) to protect your information.

5. How long we keep it

We keep your data while our relationship with you continues, and afterward for as long as required by tax and accounting rules. Data used only with your consent (like the newsletter) is kept until you withdraw that consent.

6. Your rights under the GDPR

You may at any time request to access, rectify, erase, or restrict the processing of your personal data; object to processing; and request data portability. Contact us through our contact form to exercise these rights. You may also lodge a complaint with your local data protection authority, or with the Spanish Agencia Española de Protección de Datos (AEPD, www.aepd.es), which supervises the controller.

7. Cookies

This store uses first- and third-party cookies necessary for it to function (cart, session, checkout) and, if you accept them, analytics or marketing cookies. You can manage your cookie preferences from the banner shown when you visit the store or from your browser settings.

8. Your California privacy rights (CCPA)

If you are a California resident, you may have the right to know what personal information we collect, to request its deletion, and to opt out of the "sale" or "sharing" of personal information (we do not sell your data). See our Your Privacy Choices page.

9. Security

We apply reasonable technical and organizational measures to protect your data, including encrypted communications and the security provided by Shopify's infrastructure. No system is completely secure, so we can't guarantee absolute security.

10. Changes

We may update this privacy policy as needed. We'll post the current version on this page, along with the "last updated" date.

11. Contact

For any questions about this privacy policy or to exercise your rights, contact us through our contact form or at sinpeluofficial@yahoo.com.