Privacy policy
This English text is a translation for your convenience. The Spanish version is the legally binding one and prevails in case of any discrepancy.
This policy explains what personal data we process when you visit the shop, buy or write to us, what we use it for, who we share it with and what rights you have. We have written it in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD, Spain's Data Protection and Digital Rights Act).
In short: we use your data to deliver your order and to comply with the law; we do not sell it; analytics and advertising cookies and pixels only work if you accept them; and you can exercise your rights by writing to vivagag01@gmail.com.
1. Who is the controller of your data
- Controller: Alexis Cantos, sole trader (empresario individual, “autónomo”). Trading name: Vivagag.
- NIF (Spanish tax identification number): 46488715B
- Address: Carrer de Girona, 81, 3.º — 08820 El Prat de Llobregat (Barcelona), España
- Email: vivagag01@gmail.com
- Telephone: +34 653 46 61 74
We have not appointed a data protection officer because our activity does not require one (article 37 of the GDPR). For any question about your data, write to the email address above.
2. What data we process and where it comes from
- Data you give us: name and surname, delivery and billing address, email address, telephone number, the content of your order and whatever you write to us (queries, withdrawals, complaints). If you request an invoice, your NIF as well.
- Payment data: processed by the payment gateway. We do not see or store your full card number; we only see the outcome of the transaction, the card type and its last digits.
- Browsing data: IP address, device and browser type, pages visited and cookie identifiers. Those that are not strictly necessary are only collected if you accept them in the cookie banner (see the Cookie policy).
- Data given to us by someone else: if someone sends you a gift, that person gives us your name, your address and, where applicable, your telephone number (see section 7).
- Data from our providers: the shop platform and the payment providers tell us whether a payment has been accepted and whether an order presents a risk of fraud.
3. What we use your data for, on what legal basis and for how long
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Handling your order: purchase, payment, delivery and customer service | Identification, contact details, addresses, order, communications | Performance of the contract (art. 6(1)(b) GDPR) | While we handle the order. Afterwards, blocked for the periods during which claims may arise: the legal guarantee (3 years from delivery, plus 5 years to bring a claim) and contractual actions (5 years) |
| Invoicing and tax and accounting obligations | Identification, NIF if you request an invoice, order and payment details | Legal obligation (art. 6(1)(c) GDPR) | 6 years for accounting records and invoices (art. 30 of the Código de Comercio, the Spanish Commercial Code); 4 years for tax purposes (Ley General Tributaria, the Spanish General Tax Act) |
| Handling withdrawals, guarantee claims, complaints, claims and official complaint forms | Identification, contact details, order, content of your communication, date and time you submitted it | Legal obligation (consumer law, art. 6(1)(c) GDPR) and performance of the contract (art. 6(1)(b)) | While the matter is being handled. Afterwards, blocked for the limitation periods stated in the first row |
| Answering your queries | Name, email address, content of the message | Pre-contractual steps at your request (art. 6(1)(b) GDPR) or legitimate interest in assisting you (art. 6(1)(f)) | As long as needed to deal with the query |
| Preventing fraud and protecting the security of the shop (including the anti-spam filter on the forms) | Order and payment details, IP address, risk indicators, technical browser data | Legitimate interest (art. 6(1)(f) GDPR): preventing fraudulent payments and automated spam submissions, and protecting the shop and its customers | Only as long as strictly needed for that check |
| Customer account, if you decide to create one | Email address, name, addresses, order history | Performance of the contract (art. 6(1)(b) GDPR) | Until you ask us to delete it |
| Sending you news and offers by email | Email address, name, language | Your consent (art. 6(1)(a) GDPR). If you are already a customer and the products are similar to those you bought: art. 21.2 of the LSSI-CE (Spain's Information Society Services and E-Commerce Act) and legitimate interest (art. 6(1)(f)), always with the option to unsubscribe | Until you unsubscribe or withdraw your consent |
| Analytics and advertising cookies and pixels (shop analytics and, where applicable, the TikTok pixel) | Cookie and device identifiers, IP address, pages viewed, purchase events | Your consent, given in the cookie banner (art. 6(1)(a) GDPR and art. 22.2 of the LSSI-CE) | The lifetime of each cookie, as set out in the Cookie policy. We ask for your consent again at most every 24 months |
| Publishing your review of a product | The name you choose to display, the content of the review, the order it relates to | Your consent when you submit it (art. 6(1)(a) GDPR) and legitimate interest in checking that it corresponds to a real purchase (art. 6(1)(f)) | While it is published; you can ask for it to be removed at any time |
| Assisting you on social media (comments and messages) | Username and content of your messages or comments | Legitimate interest in replying to you (art. 6(1)(f) GDPR) | According to the rules of each social network, which is responsible for its own processing |
“Blocked” means that we keep the data without using it, available only to judges, courts and public authorities, until any potential liability is time-barred; after that we delete it (article 32 of the LOPDGDD).
4. Who we share your data with
We do not sell your data. We only share it with those who help us provide the service or with those the law requires us to:
- Shopify International Limited (Ireland): the platform the shop runs on (hosting, cart, checkout, customer accounts and emails about your order). It acts as a processor on our behalf under its data processing addendum and publishes its list of sub-processors. For some services it provides directly to shoppers, Shopify also acts as an independent controller, under its own privacy policy.
- Payment providers: Shopify Payments and the payment institutions and banks involved in collecting the payment (list published by Shopify).
- PayPal: if you choose to pay with PayPal, PayPal processes your payment data as an independent controller, under its own privacy policy.
- Transport and order preparation: the carrier appointed by our supplier, usually Correos or an associated courier and, when the product ships from the warehouse of one of our suppliers established in the European Union, that supplier. They receive your name, address, telephone number and the content of the order, solely to prepare and deliver it. Orders are shipped from: our suppliers outside the European Union (China).
- hCaptcha (Intuition Machines, Inc., United States): the anti-spam filter Shopify integrates into the shop's forms. It may process your IP address and technical data about your browser to tell people apart from automated programs, under its privacy policy.
- Customer service email: Gmail (Google Ireland Limited).
- Apps installed in the shop that access customer data: none.
- Tax and accounting advisers, for invoicing and bookkeeping.
- Public authorities, judges and courts (for example, the Agencia Tributaria, the Spanish tax agency, or the consumer protection authorities), when the law requires it.
- TikTok, only if you accept advertising cookies (see section 6).
5. International transfers
Some of these providers process data outside the European Economic Area:
- Shopify may process data in other countries where the Shopify group or its providers operate (including Canada). Under its data processing addendum, transfers within the group are covered by its binding corporate rules, transfers to Canada by the European Commission's adequacy decision for that country and, in all other cases, by the standard contractual clauses approved by the European Commission in 2021. You can consult these safeguards in its data processing addendum.
- hCaptcha processes data in the United States and states that it is certified under the EU-U.S. Data Privacy Framework.
- TikTok states in its privacy policy that it transfers data outside Europe and describes the safeguards it applies (adequacy decisions and standard contractual clauses). We cannot assure you that the data TikTok receives stays within the European Union.
If you would like more information about these safeguards or a copy of them, write to us at vivagag01@gmail.com.
6. TikTok pixel
We use the TikTok pixel, installed with the official TikTok app for Shopify, to find out whether our TikTok ads and videos lead to visits and purchases, and to show ads on TikTok to people who may be interested in our products.
- What it collects: the pages you view and actions such as adding to the cart, starting checkout or buying; cookie and device identifiers; your IP address and browser data. It may also send TikTok, server to server, purchase events and your email address or telephone number converted into a hashed code, to match them with a TikTok account.
- Legal basis: your consent. The pixel is only activated if you accept advertising cookies in the cookie banner. You can withdraw your consent at any time by reopening the cookie preferences panel (the “Cookie preferences” link of the shop; the Cookie policy explains where it is and how to do it from your browser as well); withdrawal does not affect processing carried out before.
- Who is responsible: under the TikTok for Business terms, TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited (United Kingdom) are joint controllers with us for the collection of that data in the shop and its transmission to TikTok. TikTok is responsible for its subsequent use of the data, under its privacy policy. You can exercise your rights with us or with TikTok.
- Retention: the pixel's cookies last as long as stated in the Cookie policy.
7. If the order is a gift: the recipient's data
When someone buys a gift for you, they give us your name, your address and, where applicable, your telephone number. We do not obtain them from any other source.
We use them only to deliver the order to you and to deal with any issues with that delivery. The legal basis is the legitimate interest of the person giving you the gift, and ours, in being able to deliver it (article 6(1)(f) of the GDPR). We share them only with the carrier and, where applicable, with the supplier that prepares the parcel. They are kept for the same time as the rest of the order data. We will not send you advertising.
You have the same rights as anyone else (section 8). If you give us another person's details, do so only if that person can receive the parcel at that address.
8. Your rights
You can exercise these rights at any time:
- Access: to know what data of yours we process and obtain a copy.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to have us delete your data when it is no longer necessary or you withdraw your consent.
- Restriction: to have us stop using your data while a complaint of yours is being resolved.
- Portability: to receive the data you gave us in a commonly used format or to have us send it to another company.
- Objection: to object to processing based on our legitimate interest and, at any time and without giving reasons, to receiving advertising.
- Withdrawal of the consent you have given, without affecting processing carried out before.
- Not to be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
How to exercise them: write to us at vivagag01@gmail.com or at Carrer de Girona, 81, 3.º — 08820 El Prat de Llobregat (Barcelona), España stating which right you wish to exercise. It is free. We will reply within one month at most, a period the law allows us to extend by a further two months in complex cases, in which case we will let you know. We will only ask you to prove your identity if we have reasonable doubts about who you are.
Complaint to the supervisory authority: if you believe we have not handled your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish data protection authority: Edificio Cuzco IV, Paseo de la Castellana, 141, planta 9, 28046 Madrid; www.aepd.es, where you will find its electronic office). If you live in another European Union country, you can also contact the data protection authority of your country.
9. Do you have to give us your data?
The data marked as required when you buy (name, delivery address and email address) is necessary to conclude and perform the contract: without it we cannot deliver your order. Everything else is voluntary: receiving advertising, accepting non-essential cookies, creating an account or writing a review.
10. Automated decisions and profiling
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
The shop platform and the payment providers apply automatic anti-fraud checks (for example, your bank may decline a payment). If an order is flagged as suspicious, a person reviews it before it is cancelled.
Only if you accept advertising cookies may advertising networks use your activity in the shop to show you ads matching your interests.
11. Minors
This shop is not aimed at anyone under 18 and we do not knowingly collect their data. In Spain, the minimum age to consent on your own to the processing of personal data is 14 (article 7 of the LOPDGDD). If you believe a minor has given us data, write to us and we will delete it.
12. Security
We apply reasonable technical and organisational measures to protect your data: encrypted connection, restricted, password-protected access to the shop admin, and providers that offer sufficient guarantees. No system is infallible; if we suffered a security breach posing a high risk to your rights, we would notify you as the law requires.
13. Changes to this policy
We will update this policy when our processing or the law changes. If the change is significant, we will let you know in the shop or by email.
The Spanish version of this policy is the legally binding one; the English version is a translation.
Last updated: 20 September 2026.