Privacy policy
On this page we explain what personal data we collect on carlotavargas.es, what we use it for, who we share it with and how you can exercise your rights. We do not sell your data or use it to make automated decisions about you.
Controller
- CARLOTA ENTERPRISES S.L. (trading name Carlota Vargas), CIF B67964007
- C/ Tamarit, 130, 1º 3ª, 08015 Barcelona
- info@carlotavargas.es
What data we process, why and for how long
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Name, email address, telephone number, delivery address and products ordered | To manage, take payment for and deliver your order, handle returns and guarantee claims, and comply with our accounting and tax obligations | Performance of the contract and legal obligation | 6 years from the order |
| Campaign or collaboration that brought you to us and discount code used | To find out which campaigns work (only if you accepted analytics cookies) | Consent | Kept with the order |
| Your account email address, linked orders and wishlist | To give you access to your account and show you your orders and wishlist | Performance of the contract | Until you delete the account |
| Sign-in codes and account session | To ensure that only you can access your account | Performance of the contract | Code: 10 minutes (deleted once used or, at the latest, after 24 hours); session: 30 days |
| Email address of the gift card buyer, code and balance | To send the card and allow its balance to be used | Performance of the contract | Until it expires, and for 6 years afterwards |
| Email address (back-in-stock alert) | To let you know when a product is back | Consent | Until we notify you or you withdraw your consent |
| Email address (newsletter) | To send you news from the brand | Consent | Until you unsubscribe |
| Whatever you write to us by email | To reply to you | Legitimate interest in assisting you | For as long as needed to resolve it |
If you do not give us the data needed for an order, we cannot process it. The website is not aimed at children under 14.
Cookies and browser storage are explained in the Cookie policy.
Who we share your data with
Only with those we need in order to provide the service, who process it on our behalf (data processors) or, in the case of delivery and payments, in order to carry out their part:
| Who | What for |
|---|---|
| Stripe Payments Europe, Limited (Ireland) | To process the payment. Your card details are processed directly by Stripe; we do not see them. If you pay with Bizum, Apple Pay or Google Pay, those providers are also involved. |
| Correos Express Paquetería Urgente, S.A. | To deliver the order |
| Cloudflare, Inc. | Hosting of the website and of the order and account database |
| Resend, Inc. (USA) | To send order and shipping emails, gift card emails, back-in-stock alerts and account sign-in emails |
| Google Ireland Limited | Usage statistics (Google Analytics), only if you accept analytics cookies |
| Meta Platforms Ireland Limited, Pinterest Europe Limited, Google Ireland Limited | To measure and show ads, only if you accept advertising cookies |
| Public authorities, banks and courts | When required by law |
When you accept advertising cookies, Carlota Vargas and Meta Platforms Ireland Limited are joint controllers for the collection and transmission of Meta pixel data; Meta is the controller for its subsequent processing (Meta’s terms).
Cloudflare, Resend and, in some cases, Stripe, Google, Meta and Pinterest may process data in the United States. They do so with the safeguards of the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.
Your rights
You can access your data, rectify it, ask us to erase it, restrict or object to any processing and request its portability. If you have an account, you can download your data and delete the account directly from it; when you delete it, your orders are kept without your email address for the legally required period. For anything else, write to us at info@carlotavargas.es or by post to the controller’s address. We will reply within one month at the latest.
You can withdraw your consent at any time: unsubscribe from the newsletter using the link in every email, change your cookie preferences in “Cookie settings” at the foot of the website, or write to us. Withdrawing it does not affect anything we did with your consent before you withdrew it.
If you believe that we have not handled your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos [Spanish Data Protection Agency] (www.aepd.es).
Security
We apply technical and organisational measures to protect your data: the website only works over an encrypted connection, payment is handled by a certified provider, signing in to your account does not involve passwords that could be leaked, and for sign-in codes and sessions we only store an irreversible fingerprint (hash).
Changes to this policy
If we change this policy, we will publish the new version on this page with the date it was updated.