Privacy policy

1. DATA CONTROLLER

Controller: Sirats Barandiaran Mandaluniz — SVVVA
Tax ID (NIF): 79142819A
Business address: Carrer Queixans 18-20, 2n 2a, 08032 Barcelona, Spain
Email: info@offsvvva.com

No data protection officer has been appointed, as none of the circumstances requiring such an appointment under Article 37 of Regulation (EU) 2016/679 currently apply.

2. PURPOSES, LEGAL BASES AND RETENTION PERIODS

Order, payment and shipping management

Data processed: Identification and contact data, shipping and billing addresses, and order details.
Legal basis: Performance of the contract, pursuant to Article 6.1(b) GDPR.
Retention: For the duration of the contractual relationship and, subsequently, for six years to comply with applicable commercial and tax obligations.

Invoicing and tax obligations

Data processed: Identification, tax and financial data.
Legal basis: Compliance with a legal obligation, pursuant to Article 6.1(c) GDPR.
Retention: Six years under the Spanish Commercial Code and four years for tax purposes.

Handling queries and complaints

Data processed: Identification and contact data, and the content of the communication.
Legal basis: Performance of the contract or legitimate interest, pursuant to Articles 6.1(b) and 6.1(f) GDPR.
Retention: Three years from the last communication.

Returns, exchanges and guarantee management

Data processed: Identification, order and banking data.
Legal basis: Performance of the contract and compliance with legal obligations.
Retention: For the duration of the applicable guarantee and legal limitation periods.

Marketing communications and newsletter

Data processed: Identification and contact data.
Legal basis: Consent, pursuant to Article 6.1(a) GDPR, or legitimate interest in relation to existing customers under Article 21.2 of the LSSI.
Retention: Until consent is withdrawn or the user unsubscribes.

Browsing analytics and statistics

Data processed: Browsing data and device identifiers.
Legal basis: Consent, pursuant to Article 6.1(a) GDPR.
Retention: As described in the website’s consent banner and Cookie Preferences section.

Personalised advertising and measurement

Data processed: Browsing, interaction and conversion data.
Legal basis: Consent, pursuant to Article 6.1(a) GDPR.
Retention: As described in the website’s consent banner and Cookie Preferences section.

Website security and fraud prevention

Data processed: Connection data, device information and IP address.
Legal basis: Legitimate interest, pursuant to Article 6.1(f) GDPR.
Retention: For as long as necessary to investigate and prevent security or fraud incidents and, ordinarily, for no longer than one year.

Once the applicable retention periods have elapsed, personal data will remain blocked for as long as legal liabilities may arise and will subsequently be erased.

3. SOURCE OF THE DATA

Personal data is obtained directly from the data subject through the website forms, the purchasing process, the newsletter subscription form or communications sent to SVVVA.

Browsing and device data may be obtained automatically through cookies and similar technologies, subject to the consent choices available through the website’s consent banner and Cookie Preferences section.

Personal data may also be received from payment providers, transport companies, Shopify and other service providers when necessary to complete a transaction, prevent fraud or provide the requested services.

4. RECIPIENTS AND PROCESSORS

To provide its services, SVVVA uses service providers that may act as data processors or, in certain circumstances, as independent data controllers.

Where applicable, the corresponding data processing agreements required under Article 28 GDPR have been entered into.

The main providers and categories of recipients are:

Shopify International Ltd.
E-commerce platform, online store hosting, security and store management services.

Shopify Payments / payment processing providers
Processing of card payments and payment-related transactions.

PayPal (Europe) S.à r.l. et Cie, S.C.A.
Payment processing.

Klarna Bank AB
Instalment and deferred payment services.

Klaviyo Inc.
Marketing communications and newsletter management.

Google Ireland Ltd.
Website analytics and measurement through Google Analytics.

Meta Platforms Ireland Ltd.
Advertising, conversion measurement and campaign analysis.

ParcelPanel
Shipment tracking.

Transport and courier companies
Delivery, tracking and management of orders.

Tax and accounting advisers
Compliance with accounting, tax and other legal obligations.

Personal data may also be disclosed to public authorities, courts and other competent bodies where there is a legal obligation to do so.

5. RELATIONSHIP WITH SHOPIFY

The SVVVA online store is hosted by Shopify.

Shopify collects and processes personal data relating to access to and use of the store in order to provide, secure, maintain and improve its e-commerce services. Information submitted through the store is therefore transmitted to Shopify and may be shared with other service providers involved in operating the platform.

When Shopify acts as a data processor, it processes customer personal data on behalf of SVVVA and in accordance with the corresponding data processing terms.

When Shopify Network Intelligence or other Enhanced Services are enabled, Shopify may also process certain customer data as an independent data controller for purposes that may include:

• Protecting, developing and improving Shopify services.
• Providing a more personalised shopping experience.
• Understanding how customers interact with SVVVA, other Shopify merchants and Shopify.
• Improving measurement, analytics and advertising relevance.
• Preventing fraud and improving platform security.

To provide these services, information relating to customer interactions with SVVVA may be combined with information about interactions with Shopify or other Shopify merchants.

No other Shopify merchant is granted direct access to SVVVA’s customer database.

Further information about Shopify’s processing activities and the rights available in relation to data processed by Shopify can be found in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Where required, customers may use the Shopify Privacy Portal to withdraw consent, object to certain processing activities, request deletion or exercise other rights relating specifically to processing performed by Shopify.

6. INTERNATIONAL DATA TRANSFERS

Some of the providers listed above may process personal data outside the European Economic Area, mainly in the United States or other countries in which they or their service providers operate.

These transfers are covered by one or more of the following safeguards:

• An adequacy decision adopted by the European Commission, including the EU–US Data Privacy Framework where the recipient is certified.
• Standard Contractual Clauses approved by the European Commission.
• Supplementary technical, contractual or organisational measures where required.
• Another transfer mechanism recognised by applicable data protection legislation.

Further information about the safeguards applied to international transfers may be requested by writing to info@offsvvva.com.

7. YOUR RIGHTS

Every individual has the right to:

Access: find out what personal data is being processed and obtain a copy of that data.

Rectification: correct inaccurate or incomplete personal data.

Erasure: request the deletion of personal data when it is no longer necessary or when another legal basis for deletion applies.

Restriction: request that processing be restricted or suspended in certain circumstances.

Object: object to processing based on legitimate interest, including certain direct marketing activities.

Portability: receive personal data in a structured, commonly used and machine-readable format, or request its transmission to another controller where legally applicable.

Withdraw consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Automated decisions: not be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect the individual, except where permitted by law.

To exercise any of these rights, send a request to info@offsvvva.com, indicating the right you wish to exercise.

Proof of identity may be requested where reasonably necessary to verify the identity of the person making the request. Any documentation provided for this purpose will only be used to verify identity.

Requests will be handled without undue delay and, in any event, within the periods established by applicable legislation, ordinarily within one month.

Right to lodge a complaint

If you believe that your personal data is not being processed correctly, you may lodge a complaint with the Spanish Data Protection Agency:

Agencia Española de Protección de Datos
Calle Jorge Juan, 6
28001 Madrid
Spain

Website: www.aepd.es
Electronic office: sedeagpd.gob.es

You may first contact info@offsvvva.com so that SVVVA can attempt to resolve the matter directly.

8. ADDITIONAL PRIVACY CHOICES DEPENDING ON YOUR LOCATION

Depending on the place in which you reside, you may have additional rights under applicable privacy legislation.

These rights may include the right to object to or opt out of:

• The sale or sharing of personal information, as those terms are defined by applicable legislation.
• The use of personal information for targeted or cross-context behavioural advertising.
• Certain profiling or automated processing activities.

Where applicable, these choices may be exercised through the data-sharing opt-out page or privacy options made available through the store, through the Cookie Preferences section or through the Shopify Privacy Portal.

Where required by applicable legislation, recognised privacy preference signals such as Global Privacy Control may also be treated as an opt-out request for the browser and device sending the signal.

9. MARKETING COMMUNICATIONS

If you subscribe to the newsletter, you may receive information about SVVVA news, collections, launches and promotions.

Existing customers may also receive communications concerning products or services similar to those previously purchased where permitted by applicable legislation.

You can unsubscribe at any time by using the unsubscribe link included in every marketing email or by writing to info@offsvvva.com.

Unsubscribing from marketing communications is free of charge and does not prevent SVVVA from sending non-promotional communications relating to an order, payment, account, return, guarantee claim or other contractual matter.

10. COOKIES AND SIMILAR TECHNOLOGIES

SVVVA and its service providers, including Shopify, may use cookies, pixels and similar technologies to:

• Enable essential store functionality.
• Remember customer preferences.
• Maintain security and prevent fraud.
• Analyse the use and performance of the store.
• Measure advertising campaigns.
• Personalise content and advertising where consent has been provided.

Non-essential cookies and similar technologies will only be used where the visitor has provided the consent required by applicable legislation.

Visitors can accept, reject or modify their choices through the website’s consent banner and the Cookie Preferences link available in the footer.

Consent may be withdrawn or modified at any time through Cookie Preferences.

11. SECURITY MEASURES

SVVVA applies appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the processing of personal data.

These measures include encrypted communications through an SSL certificate, access controls, account security measures and the selection of service providers offering appropriate data protection and security guarantees.

However, no information system or transmission method can guarantee absolute security. Customers should avoid sending sensitive or confidential information through insecure channels.

12. MINORS

SVVVA’s products and services are intended for adults.

SVVVA does not knowingly collect personal data relating to minors. If it becomes apparent that personal data relating to a minor has been obtained without the appropriate authorisation, it will be deleted.

Parents or legal guardians who believe that a minor has provided personal data may contact info@offsvvva.com.

13. THIRD-PARTY WEBSITES AND SERVICES

The store may contain links, integrations or tools operated by third parties.

SVVVA does not control the privacy or security practices of third-party websites and services. Personal data provided directly to a third party will be processed in accordance with that third party’s own privacy policy.

Customers should review the corresponding privacy information before providing personal data or using third-party services.

14. CHANGES TO THIS POLICY

This Privacy Policy may be updated to reflect legislative changes, regulatory requirements, changes to Shopify services or modifications to SVVVA’s personal data processing activities.

The updated version will be published on this website and the “Last updated” date will be modified accordingly.

The version in force will always be the one published on the website.

LAST UPDATED

24 July 2026