Who we are
The data controller is Esmarats Jewellery, with Tax Identification Number (NIF) 47854946L and contact email hello@esmarats.com.
What data we collect and how
We collect the following categories of data, with your consent or on other legal bases:
- Identification data: name, surname, email, address, telephone, ID/NIF/Passport.
- Payment data: not stored in our system; we only use secure gateways (Stripe) for payment.
- Browsing data: cookies and trackers to improve user experience and analyse website performance.
Data is collected directly through the website (purchase forms, contact forms, subscriptions) or from third parties with whom we have agreed processing.
Purposes and legal basis
The purposes for which we process your data are:
Purpose
- Managing orders and delivering products.
- Sending newsletters or promotions if you have given consent.
- Maintaining contact and responding to enquiries.
- Analysing traffic to improve the website (consent or legitimate interest).
Legal basis
- Contract performance (Art. 6.1.b GDPR).
- Consent (Art. 6.1.a GDPR).
- Legitimate interest or contract performance (as applicable).
- Consent or legitimate interest.
Data protection principles
We adhere to the following principles:
- Lawfulness, fairness, and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
These principles are those established by the GDPR and the LOPDGDD.
Data retention
- Order and invoicing data: 5 years in accordance with tax regulations.
- Subscriptions and marketing: retained while your consent remains active. We review every 12–24 months and delete data if there is no interaction.
- Browsing/cookie records: between 6 and 12 months, depending on configuration and purpose.
Third-party communication and international transfers
We share data with:
- Delivery companies (for shipping).
- Payment gateway (to process payments).
- Email providers (for newsletters).
In the event of transfers outside the European Economic Area, we use the European Commission’s Standard Contractual Clauses or other appropriate safeguards.
Cookies and consent
We use cookies to:
- Guarantee basic website functionality.
- Analyse traffic (Analytics).
- Send personalized communications.
When you access the website, we request your active consent for non-essential cookies, with the option to refuse, modify your choice, or withdraw consent at any time.
Users’ rights
You have the right to:
- Access your data.
- Rectify inaccurate data.
- Erasure (“right to be forgotten”) and restriction of processing.
- Object to processing.
- Data portability.
- Withdraw consent (as easily as it was given).
To exercise these rights, send your request to hello@esmarats.com.
Security and incidents
We apply technical and organisational measures to protect your data (SSL encryption, access restrictions, backups, etc.). In the event of an incident posing a risk to rights and freedoms, we are prepared to notify the AEPD and affected individuals within 72 hours, in accordance with the GDPR.
Automated decision-making
When we use profiling or automated decisions that may affect you, we inform you of:
- The logic involved.
- The likely impact.
- The possibility to intervene and appeal.
Data sources
We collect data directly from you (forms, purchases) or, if not, we will inform you.
Language and easy access
This policy is written in a clear and accessible format and is visible from any page of the website, usually via a footer link.
Changes and updates
The current version of this Privacy Policy was last updated on 09/09/2025. If we make significant changes, we will notify you by email or with a prominent notice on the website.
Applicable law
This policy is governed by the GDPR, the LOPDGDD, the LSSI-CE, and other applicable Spanish and European regulations.
Contact
If you have questions, comments, or wish to exercise your rights, please contact us via:
- Email: hello@esmarats.com
- Website form: www.esmarats.com (Contact us)