Privacy policy

The controller of your personal data is:

Owner

[RAZÓN SOCIAL / NOMBRE DEL TITULAR]

Tax ID

[NIF / CIF]

Address

[DIRECCIÓN]

Country

[PAÍS]

Contact email

[EMAIL LEGAL]

Website

nomafe.com

We only process the data needed for each purpose. Depending on how you interact with us, this may include:

• Identification and contact details: first name, last name, email and phone number.
• Address: shipping address and, where applicable, billing address.
• Order information: products, amounts, date, shipping status, returns and incidents.
• Payment data: handled directly by the payment provider. We never see or store your full card number.
• Browsing data: IP address, browser and device type, and the technical server logs needed for the security and operation of the website.
• Communications: the content of the messages you send us.

We use your data to:

• Manage your orders, from purchase to delivery.
• Process payments through the checkout payment providers.
• Ship your orders and let you track them.
• Assist you with questions, returns, withdrawals, warranty claims and incidents.
• Prevent fraud and protect the security of the website and of transactions.
• Comply with our legal, tax and accounting obligations.
• Send you marketing communications only where appropriate: if you have given your consent or, if you are already a customer, about products similar to those you bought — always with the option to unsubscribe in every message.

We do not take automated decisions with legal effects on you, nor do we create profiles for that purpose.

• Performance of a contract (Art. 6(1)(b) GDPR): order management, payment, shipping and customer service.
• Legal obligation (Art. 6(1)(c) GDPR): invoicing, accounting, tax obligations and handling of warranty and consumer rights.
• Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, website security and communications to customers about similar products, which you can object to at any time.
• Consent (Art. 6(1)(a) GDPR): marketing communications to non-customers and, in the future, non-essential cookies. You can withdraw it at any time, without affecting prior processing.

Providing your order details is necessary to make a purchase. Without them we cannot process or ship your order.

We do not sell your data. We only share it with the providers we need to deliver the service, who act on our instructions or as independent controllers within their own scope:

• Shopify (Shopify International Limited, Ireland): store platform, cart and checkout. Shopify privacy policy.
• Payment providers: [PROVEEDORES DE PAGO]. They process payment data to collect payments and prevent fraud.
• Hosting and security: Cloudflare, Inc., which hosts and protects the website. Cloudflare privacy policy.
• Logistics: the provider that prepares orders at its warehouse in Spain and the carrier that makes the delivery (AliExpress Standard Shipping, GLS, Correos or DHL, as assigned). They receive your name, address, phone number and shipping details.
• Analytics or advertising tools: we currently use none. If we do in the future, we will list them here and in the cookie policy, and they will only be activated with your consent.
• Public authorities: when the law requires us to disclose data to them.

Some providers, such as Shopify or Cloudflare, may process data outside the European Economic Area. In those cases, the transfer is based on an adequacy decision of the European Commission (for example, the EU-US Data Privacy Framework or the decision on Canada) or on the standard contractual clauses approved by the Commission, with any additional safeguards required.

• Order and billing data: for as long as the relationship lasts and, afterwards, for the periods required by law (in Spain, six years for accounting and commercial records).
• Customer service and warranty: for the warranty period and the limitation period of any possible claims.
• Marketing communications: until you unsubscribe or withdraw your consent.
• Technical browsing logs: for the time strictly needed for security, usually a few days or weeks.

After these periods, the data is deleted or anonymised.

You can exercise the following rights at any time:

• Access: find out what data about you we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection: object to certain processing, such as marketing communications.
• Restriction: ask us to keep your data without using it, in certain cases.
• Portability: receive the data you gave us in a structured, commonly used format.

You can also withdraw any consent you have given us at any time.

Write to us at [EMAIL LEGAL] stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month at the latest; this may be extended by two further months for complex requests, in which case we will let you know.

If you believe we have not handled your request properly, you can lodge a complaint with the competent data protection authority. In Spain, this is the Agencia Española de Protección de Datos (aepd.es); you can also contact the authority of your country of residence.

We apply appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), payments processed by certified providers and access limited to the people who need it.

We may update this policy to reflect legal changes or changes to the service. The date of the last update is shown at the top of the page. If the change is significant, we will inform you through an appropriate channel.