Privacy Policy

Last updated: July 27, 2026

1. Who we are

Enveseur SL ("we", "us", "our") operates this store and website, including all related information, content, features, tools, products and services (the "Services"), registered in Spain with registered address at Carrer Avinyonet 6, 08720 Vilafranca del Penedès, Barcelona, Spain.

Our Services are hosted on the Shopify platform ("Shopify"), which enables us to provide the Services to you.

For the purpose of applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD), we are the data controller of your personal information.

Contact for privacy matters:

• Email: compliance@enveseur.com
• Phone: +34 935 22 02 22
• Postal address: Carrer Avinyonet 6, 08720 Vilafranca del Penedès, Barcelona, Spain
• Contact form: Contact

Please read this Privacy Policy carefully. By using or accessing any of the Services, you acknowledge that you have read and understood how we collect, use, and disclose your personal information as described below. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

2. Personal information we collect

Depending on how you interact with the Services, we may collect or process:

• Contact details — name, billing/shipping address, phone number, email address
• Financial information — payment card details, transaction details, form of payment, payment confirmation (we do not store full card numbers — see Section 9)
• Account information — username, password, security questions, preferences and settings
• Transaction information — items viewed, added to cart/wishlist, purchased, returned, exchanged or cancelled, and past order history
• Communications — content of your enquiries and support requests
• Device information — browser, network connection, IP address, and other identifiers
• Usage information — how and when you interact with or navigate the Services
• Cookie consent data — your consent status, timestamp, and related identifiers (see Section 5)

Sources

We collect this data: directly from you (account creation, checkout, communications); automatically through the Services (cookies, device/usage data); from our service providers acting on our behalf; and from partners or other third parties where relevant.

3. Why we use your data and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Fulfilling orders, processing payments, account management, shipping, returns/exchanges	Performance of a contract (1)(b)
Customer support and communications with you	Performance of a contract (1)(b) / legitimate interest (1)(f)
Marketing, promotional emails, personalised recommendations and advertising	Consent (1)(a) — you can withdraw anytime
Security, fraud prevention, authentication	Legitimate interest (1)(f)
Legal compliance, responding to authorities, enforcing our terms	Legal obligation (1)(c)
Essential cookies (cart, checkout)	Legitimate interest (1)(f)
Non-essential cookies (analytics, advertising)	Consent (1)(a), via CookieFirst — see Section 5

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

4. How we disclose your information

We may disclose personal information to:

• Shopify and its sub-processors, who host the Services and process data on our behalf (IT infrastructure, payment processing, analytics, fulfillment support).
• Vendors and service providers performing services on our behalf — e.g., payment processors, shipping/logistics providers, customer support tools, cloud storage.
• Business and marketing partners, to advertise to you. Shopify supports personalised advertising with third-party services based on your online activity across different merchants. Where applicable, you may opt out of targeted advertising — see Section 8.
• Third parties you direct us to, e.g. shipping carriers, or via social media/login integrations you choose to use.
• Affiliates, within our corporate group, where relevant.
• In connection with a business transaction (e.g. merger, sale, bankruptcy), or to comply with a legal obligation, enforce our terms, or protect the Services and our users.

We do not sell your personal data for money.

Shopify's role

Because the Services are hosted on Shopify, Shopify also processes information about your access to and use of the Services to help operate and improve them, including certain "enhanced features" that draw on aggregated data from interactions across our store, other merchants, and Shopify. For these specific features, Shopify acts as an independent data controller and is responsible for responding to your requests regarding that processing. You can learn more, and exercise relevant rights, via the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

5. Cookies and consent management (CookieFirst)

To operate properly, our website uses cookies. To obtain and document your valid consent for cookies, we use a consent management platform, CookieFirst, provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH Amsterdam, The Netherlands (https://cookiefirst.com).

When you visit our site, a connection is made to CookieFirst's server so we can request and record your consent. CookieFirst stores a cookie in your browser so only the cookie categories you consented to are activated, and so we can demonstrate compliance if required.

Data collected for this purpose:

• Your consent status or withdrawal of consent
• Your anonymised IP address
• Browser and device information
• Date and time of your visit
• The page URL where you saved/updated preferences
• Your approximate location
• A universally unique identifier (UUID) linked to your consent action

Legal basis: documenting consent — Art. 6(1)(c) GDPR (legal obligation); for the underlying non-essential cookies — Art. 6(1)(a) GDPR (your consent).

Retention: consent records are kept until the predefined retention period expires or you request deletion, subject to mandatory legal retention periods.

Data Processing Agreement: we have a data processing agreement with CookieFirst, ensuring your data is processed only under our instructions and in compliance with GDPR.

Separately, our site software uses functional/essential cookies to remember cart contents so you can leave and return to complete your purchase. These are typically retained for a few hours to a few days, and may be cleared by site updates.

You can review or change your cookie preferences anytime via the cookie settings link in our website footer.

6. Marketing communications

If you register with us or opt in, we may send you occasional marketing about our products, services, and special offers by email or other channels. You can unsubscribe anytime via the unsubscribe link in any email, or by contacting us. If you opt out of marketing, we may still send non-promotional emails related to your account or orders. We will not pass your details to third parties for their own independent marketing purposes.

7. Security and retention

No security measures are perfect or impenetrable, and we cannot guarantee "perfect security." Avoid sending sensitive information to us over unsecure channels.

How long we retain personal information depends on factors such as: whether we need it to maintain your account or provide the Services, comply with legal/tax obligations, or resolve disputes and enforce agreements. As general guidance:

• Account data: for as long as your account is active, plus a reasonable period afterward for legal purposes.
• Order/invoice data: retained per Spanish commercial and tax law requirements (generally around 6 years).
• Marketing consent: until you unsubscribe, plus a record of withdrawal for evidentiary purposes.
• Cookie consent records: per Section 5.

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights, subject to exceptions permitted by law:

• Right to access/know the personal information we hold about you
• Right to delete personal information we maintain about you
• Right to correct inaccurate personal information
• Right to data portability — receive a copy of your data, or have it transferred to a third party, in certain circumstances
• Right to opt out of sale/sharing or targeted advertising — where applicable under laws that use these terms, you can exercise this here. If you visit with a Global Privacy Control (GPC) signal enabled, we treat this as an opt-out request for that device/browser, and apply it to your account where we can associate the two. We do not otherwise honour "Do Not Track" signals.
• Managing communications preferences — unsubscribe anytime from promotional emails; we may still send non-promotional account/order emails.

If you reside in the UK or EEA, you additionally have the right to:

• Object to or restrict processing for certain purposes
• Withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise any right, contact us using the details in Section 1. We may need to verify your identity, and you may designate an authorised agent to act on your behalf (subject to proof of authorisation). We will respond within the timeframe required by applicable law (generally one month under GDPR). We will not discriminate against you for exercising these rights.

9. Payment and financial data

We do not store full credit card or debit card numbers. Only the minimum necessary payment data is shared with, and processed by, our payment processing provider(s) to complete your transaction.

10. Third-party websites and links

The Services may link to third-party websites or platforms. We are not responsible for the privacy or security practices of sites we don't control — please review their own policies. Content you post on public or semi-public areas (including third-party social platforms) may be viewable by others without limitation on use.

11. Children's data

The Services are not intended for children, and we do not knowingly collect personal information from children under the age of majority in their jurisdiction. If you are a parent/guardian and believe your child has provided us with personal data, contact us to request its deletion. As of the date of this policy, we have no actual knowledge of "sharing" or "selling" personal information of individuals under 16.

12. International data transfers

We may transfer, store, and process your personal information outside the country you live in. Where we transfer data out of the EEA or UK, we rely on recognised transfer mechanisms, such as the European Commission's Standard Contractual Clauses (or the UK equivalent), unless the destination country has an applicable adequacy decision.

13. Complaints

If you have concerns about how we process your personal information, contact us using the details in Section 1. You also have the right to lodge a complaint with your local data protection supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) — www.aepd.es. For a full list of EEA authorities, see the European Data Protection Board list.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the revised policy here and update the "Last updated" date, with notice as required by law.

15. Contact

Enveseur SL Carrer Avinyonet 6, 08720 Vilafranca del Penedès, Barcelona, Spain Phone: +34 935 22 02 22 Email: compliance@enveseur.com Contact form: Contact