Privacy Policy

October 26, 2026

1. Data controller

At Ovillara we process your personal data transparently, only as needed, and in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

• Controller: Ovillara
• Address: Calle San Juan de la Peña 1, 3º centro, 22600 Sabiñánigo (Huesca), Spain
• Privacy email: ovillarapro@gmail.com

2. What data we process and why

We only collect the data you give us when you buy, contact us or subscribe, and the data generated by your browsing.

Purpose	Data	Legal basis	How long we keep it
Managing your order, shipping and returns	Name, address, email, phone, products purchased	Performance of the contract	For the duration of the relationship and then for the legal retention periods (6 years for tax and accounting purposes)
Payment	Payment data, processed by the payment gateway; we do not store your card	Performance of the contract	As required by tax law
Answering your questions	Name, email and whatever you tell us	Legitimate interest in assisting you	Until your question is resolved, and for a maximum of 1 year
Sending you news and offers	Email	Your consent (you can withdraw it at any time)	Until you unsubscribe
Analyzing and improving the website; advertising	Browsing data and cookies	Your consent	As set out in the Cookie Policy

We do not make automated decisions or create profiles that have legal effects on you.

3. Who we share your data with

We never sell your data. We only share it with the providers we need to run the store:

• Shopify, the platform that hosts the store.
• Payment gateways, to charge your order securely.
• Suppliers and shipping carriers, to prepare and deliver your order.
• Email and analytics tools, only if you have given your consent.
• Public authorities, when required by law.

All of them process your data according to our instructions and with the safeguards required by the GDPR.

International transfers. Some of these providers may process data outside the European Economic Area (for example, in Canada or the United States). In those cases, the transfer is based on European Commission adequacy decisions or on standard contractual clauses approved by the Commission.

4. Your rights

You can exercise the following rights at any time:

• Access: find out what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Objection and restriction: ask us to stop using it or to use it only for certain purposes.
• Portability: receive your data in a format you can take to another service.
• Withdraw your consent, for example by unsubscribing from emails, without affecting anything done before.

To exercise them, email us at ovillarapro@gmail.com stating which right you wish to exercise. We will reply within one month at the latest.

If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security. We apply technical and organizational measures to protect your data against loss, unauthorized access or misuse.

Minors. The store is not aimed at children under 14 and we do not knowingly collect their data.

Changes. We may update this policy. The current version will always be the one published on this page.