Privacy policy

The controller of your personal data is:

Owner

Xavier Marginet Uró

Tax ID

40567258L

Address

Rambla de Joan Baptista Pirelli 76, piso 6, 3.ª puerta, 08800 Vilanova i la Geltrú, Barcelona, España

Country

Spain

Contact email

soporte@nomafe.com

Website

nomafe.com

We only process the data needed for each purpose. Depending on how you interact with us, this may include:

• Identification and contact details: first name, last name, email and phone number.
• Address: shipping address and, where applicable, billing address.
• Order information: products, amounts, date, shipping status, returns and incidents.
• Payment data: handled directly by the payment provider. We never see or store your full card number.
• Browsing data: IP address, browser and device type, and the technical server logs needed for the security and operation of the website.
• Communications: the content of the messages you send us.

We use your data to:

• Manage your orders, from purchase to delivery.
• Process payments through the checkout payment providers.
• Ship your orders and let you track them.
• Assist you with questions, returns, withdrawals, warranty claims and incidents.
• Prevent fraud and protect the security of the website and of transactions.
• Comply with our legal, tax and accounting obligations.
• Send you marketing communications only where appropriate: if you have given your consent or, if you are already a customer, about products similar to those you bought — always with the option to unsubscribe in every message.

We do not take automated decisions with legal effects on you, nor do we create profiles for that purpose.

• Performance of a contract (Art. 6(1)(b) GDPR): order management, payment, shipping and customer service.
• Legal obligation (Art. 6(1)(c) GDPR): invoicing, accounting, tax obligations and handling of warranty and consumer rights.
• Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, website security and communications to customers about similar products, which you can object to at any time.
• Consent (Art. 6(1)(a) GDPR): marketing communications to non-customers and non-essential cookies and technologies, such as Google Analytics (analytics) and the Meta pixel (marketing). You can withdraw it at any time, without affecting prior processing.

Providing your order details is necessary to make a purchase. Without them we cannot process or ship your order.

We do not sell your data. We only share it with the providers we need to deliver the service, who act on our instructions or as independent controllers within their own scope:

• Shopify (Shopify International Limited, Ireland): store platform, cart and checkout. Shopify privacy policy.
• Payment providers: Shopify Payments. It processes payment data to collect payments and prevent fraud.
• Hosting and security: Cloudflare, Inc., which hosts and protects the website. Cloudflare privacy policy.
• Logistics: the provider that prepares orders at its warehouse in Spain and the carrier that makes the delivery (AliExpress Standard Shipping, GLS, Correos or DHL, as assigned). They receive your name, address, phone number and shipping details.
• Analytics: we use Google Analytics 4 only when you give consent, to measure visits and shopping actions. If you buy, our server sends Google a purchase event with the amount, currency, taxes, shipping, product and quantity, linked to an order identifier. We do not send card or bank account details, or your name, email or address. More information in the cookie policy.
• Marketing (Meta): we use the Meta pixel and the Conversions API of Meta Platforms Ireland Limited (Ireland) only when you give your marketing consent, to measure and attribute our advertising on Facebook and Instagram. More information under “Advertising and measurement with Meta” and in the cookie policy.
• Public authorities: when the law requires us to disclose data to them.

Besides Google Analytics, which only works if you accept it, we measure how the website is used with our own counters, designed not to process personal data:

• What we count: only aggregated numbers per day and per hour: page visits (by language and type of page, not the full address), products viewed, products added to or removed from the cart, checkout starts, purchases (number of orders, net amount and units) and how many people accept or reject the cookie notice.
• In this measurement we do not use or store: no cookies, no localStorage, no visitor or session identifiers; nor your IP address, your browser (User-Agent), the page you came from, your email, name or address, or any other personal data. Each action only adds 1 to a counter aggregated by day and by hour, so it is not possible to know what each person did.
• Purchases: when Shopify notifies us of a paid order, we only use the date, the currency, the net amount and the units of Nomafé products. The order number is kept for 7 days solely to ignore duplicate notifications and is not linked to any personal data.
• Retention and third parties: the counters are kept for 13 months at most and then deleted. We do not share this analytics with third parties: it is stored in our own database, hosted on Cloudflare.
• Your cookie choice: because it neither stores nor reads anything on your device and does not identify you, this aggregated measurement does not depend on your choice about analytics cookies, which only affects Google Analytics.

Like any connection to a website, your request reaches us through the network of Cloudflare, our hosting provider. This analytics does not read or store your IP address; the technical network data processed by Cloudflare is explained in “Service providers and third parties”.

If you accept the “Marketing” category in the cookie notice, we use tools from Meta Platforms Ireland Limited (Facebook and Instagram) to measure how our ads perform and to attribute purchases to them. It is independent from our own analytics and from Google Analytics:

• What we switch on: the Meta pixel, which loads in your browser from Meta’s servers, and the Conversions API, through which our server tells Meta about completed purchases. Without your marketing consent the pixel is not loaded, no Meta cookie is set and no purchase is sent to Meta.
• What the pixel measures: page views, product viewed, product added to the bag and checkout started. In product events we send the product identifier, its name, the amount, the currency (EUR) and the quantity. In addition, as with any third-party resource, your browser connects to Meta, which receives your IP address, technical browser data, the address of the page you visit and the identifiers of Meta’s cookies. We have switched off the pixel’s automatic event and form-data detection.
• Cookies and click parameters: the pixel sets the _fbp cookie (it identifies your browser) and, if you arrive from a Meta ad, the _fbc cookie, built from the fbclid parameter in the address (it identifies the click). We do not send UTM parameters to Meta. Durations are listed in the cookie policy.
• Purchases (Conversions API): when Shopify notifies us of a paid order and you accepted marketing, our server sends Meta a purchase event with the date, the order number, the amount paid for Nomafé’s products, the currency, the product and the quantity, together with the _fbp and _fbc identifiers when they exist. If neither exists, nothing is sent. Nothing is sent either when you merely start checkout: only completed purchases.
• What we do not send to Meta: we do not send your name, email address, phone number, postal address or date of birth, or card or bank details. From our server we do not send your IP address or your browser (User-Agent) either. We do not use Meta’s advanced matching.
• Attributes in your cart: to be able to attribute the purchase, with your marketing consent we copy a few attributes to your Shopify cart: a consent flag, the values of _fbp and _fbc, and the site name (nomafe.com). They are removed from the cart if you withdraw your consent. Orders already placed keep the attributes they carried, as part of the order.
• Legal basis and withdrawal: your consent (Art. 6(1)(a) GDPR and Art. 22(2) of Spanish Law 34/2002, LSSI). You are free to accept or reject it without any effect on your purchase, and you can withdraw it at any time from “Cookie settings”: we stop sending events, delete the _fbp and _fbc cookies reachable from this site and remove the Meta attributes from your cart.
• Meta as a provider: Meta Platforms Ireland Limited may also process this data as a controller for its own purposes, under its privacy policy. Data may be transferred outside the European Economic Area (see “International transfers”). How long Meta keeps the data is determined by Meta.
• Retention at Nomafé: Meta’s cookies last as stated in the cookie policy; cart attributes last while the cart exists and, in a placed order, like the rest of the order data. To avoid duplicate purchases we only store the order number and the status of its delivery to Meta.

Some providers, such as Shopify, Cloudflare, Google or Meta, may process data outside the European Economic Area. In those cases, the transfer is based on an adequacy decision of the European Commission (for example, the EU-US Data Privacy Framework or the decision on Canada) or on the standard contractual clauses approved by the Commission, with any additional safeguards required.

• Order and billing data: for as long as the relationship lasts and, afterwards, for the periods required by law (in Spain, six years for accounting and commercial records).
• Customer service and warranty: for the warranty period and the limitation period of any possible claims.
• Marketing communications: until you unsubscribe or withdraw your consent.
• Technical browsing logs: for the time strictly needed for security, usually a few days or weeks.
• Own analytics: aggregated counters, 13 months at most; order numbers (only to avoid duplicates), 7 days.
• Marketing (Meta): the _fbp and _fbc cookies, for the time set by Meta (about 90 days); Meta attributes in the cart, while the cart exists or, in an order, like the rest of its data. Meta keeps the data it receives under its own policy.

After these periods, the data is deleted or anonymised.

You can exercise the following rights at any time:

• Access: find out what data about you we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection: object to certain processing, such as marketing communications.
• Restriction: ask us to keep your data without using it, in certain cases.
• Portability: receive the data you gave us in a structured, commonly used format.

You can also withdraw any consent you have given us at any time.

Write to us at soporte@nomafe.com stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We will reply within one month at the latest; this may be extended by two further months for complex requests, in which case we will let you know.

If you believe we have not handled your request properly, you can lodge a complaint with the competent data protection authority. In Spain, this is the Agencia Española de Protección de Datos (aepd.es); you can also contact the authority of your country of residence.

We apply appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), payments processed by certified providers and access limited to the people who need it.

We may update this policy to reflect legal changes or changes to the service. The date of the last update is shown at the top of the page. If the change is significant, we will inform you through an appropriate channel.