Privacy policy

Updated: 11 October 2026

1. Controller and contact

The controller for personal data relating to the online store nellycast.ro is Nelly Aleyda Castro Ibarra, trading as Nelly Castro, Calle General Prim, 11, 46005 Valencia, Spain; tax identification Y9824161R; VAT identification ESY9824161R. Contact us at shop@nellycastro.com or +34 696 399 635.

This policy concerns consumer visits and purchases, enquiries, customer accounts and related communications. It explains our use of personal data under the GDPR, Spanish LOPDGDD and LSSI-CE.

2. Data and sources

We process information you supply when purchasing, contacting us, creating or using an account or subscribing: name, contact details, addresses, products, orders, amounts, payment status and communications. Tax information is processed where needed for invoicing. Shopify and payment and delivery providers also supply information needed to manage the transaction.

Browsing generates technical and activity data, such as IP address, browser, device, pages viewed, dates, identifiers and consent status. Information collected through optional technologies depends on privacy choices and functions used. Required fields are identified in each form; without necessary information we cannot process the relevant purchase or request. Marketing subscription is not required to purchase.

3. Purposes and legal bases

• Orders, payment, delivery, returns, warranties and pre-purchase enquiries: performance of a contract or requested pre-contractual steps, GDPR Article 6(1)(b).
• Invoicing, tax and accounting duties and legally required responses: legal obligation, Article 6(1)(c).
• General enquiries, protection against abuse and legal claims: legitimate interests, Article 6(1)(f), limited to what is necessary and balanced against individuals’ rights.
• Subscription-based newsletters and electronic advertising, and analytics or advertising through non-essential technologies: consent, Article 6(1)(a), alongside LSSI-CE requirements. Withdrawal does not affect the lawfulness of earlier processing.

Consent for non-essential analytics and personalized advertising also concerns corresponding server event disclosures. An order, merely using the store or a preselected checkbox does not replace active consent. Contractual service messages must be distinguished from promotional reminders.

The supporting AI analysis relies on the legitimate interest in efficient, structured transaction and communication handling, GDPR Article 6(1)(f), where the specific processing is necessary and individuals’ interests and rights do not override that interest. Using AI is not itself a legal obligation. Section 10 explains the right to object.

4. Shopify and store services

The store uses Shopify for hosting, checkout and customer and order management. Shopify processes data on our behalf to provide the platform. For certain functions, including Enhanced Services and users’ own relationships with Shop or Shop Pay, Shopify may act as an independent controller, depending on the service.

Shopify Network Intelligence is enabled and uses activity and customer data alongside other Shopify data for personalization, analytics and advertising. See Shopify’s Consumer Privacy Policy and privacy controls. Those controls do not replace contacting us about rights relating to our own processing.

For EEA merchants, the contracting entity is Shopify International Limited, Ireland. Our contract performance relies on GDPR Article 6(1)(b); security and abuse prevention rely on the legitimate interest in secure operation. This basis does not replace required advertising consent. Shopify explains its bases for its own Enhanced Services purposes in its linked Consumer Privacy Policy.

5. Recipients, payments and delivery

Necessary information is disclosed to providers involved in hosting and support, payments, delivery and accounting and tax obligations. The store offers Shopify Payments and PayPal. The information and each provider’s responsibility depend on the payment method selected. Payment providers may act under their own responsibility for payment execution, fraud prevention and legal duties.

Authorities and courts may receive information where required by law or necessary for claims. Providers acting on our behalf must operate under the applicable contractual safeguards.

Emails to shop@nellycastro.com are processed through Dogado. This involves contact, message and technical information for transmission and storage. UPS receives the recipient’s name, delivery address, necessary contact details and shipment and delivery information. UPS also processes information independently for transport services and legal obligations. Our local tax adviser receives records, transaction and customer information necessary for accounting and tax duties. Further information: Dogado and UPS.

Providers supporting forms, messaging, workflow automation, payment and order rules, shipping, withdrawal functions and technical support are also integrated into store administration, order handling and communication. They may receive information necessary for their respective tasks. Not every service processes all customer information.

We use an internal inventory and invoicing system with analysis through the Google Gemini API to handle orders, invoices and customer communications. Processing may concern names, contact and address details, order and invoice information and other personal information in the documents and messages processed.

Document analysis through the Gemini API may transmit complete files to Google. Email analysis transmits the subject and message text stripped of HTML markup and shortened before transmission. AI extracts and classifies information, creates summaries and estimates content, sentiment and urgency. These fallible assessments may contain evaluations relating to individuals. Anonymization of all transmitted content is not asserted.

6. Cookies, analytics and advertising

Necessary technologies support functions such as cart, security, session and preferences. Additional measurement or advertising technologies require the appropriate choice where consent is legally required.

The reviewed configuration includes active Google Ads and Google Analytics, and Facebook/Instagram and TikTok pixels with browser and server components. These tools may process identifiers, technical information, browsing activity and purchase events to measure campaigns and target advertising. Pseudonymous identifiers are not the same as anonymous data. See Google’s information, Meta’s information and TikTok’s information.

Cookies store information in the browser; similar identifiers and pixels can recognize devices or interactions. Analytics evaluates store use, while advertising measures campaigns and supports interest-based delivery. Browser events may be linked with server-side purchase events. Providers may combine information with existing user profiles where the function provides for this. You can withdraw consent and object to direct marketing at any time; contact shop@nellycastro.com for related requests. You can also delete or block cookies in your browser. Browser blocking alone does not prevent independent server-side processing or erase information already disclosed.

You can reopen your preferences using “Cookie settings” in the store footer and change or withdraw your choice for future uses. Withdrawal does not affect lawful earlier processing or automatically erase information already disclosed.

7. Newsletters and communications

Necessary order and enquiry communications are separate from advertising. Newsletter subscriptions use the email address and information provided for that purpose. Unsubscribe using the link in each message or by writing to shop@nellycastro.com.

We use Shopify Messaging for newsletters and campaigns. Shopify is configured to require an additional subscription confirmation (double opt-in). Subscription and confirmation information, dates and associated technical details may be processed as evidence. The current configuration includes open tracking and campaign identifiers in links (UTM), allowing campaign opens and responses to be analyzed. Newsletter subscription is not blanket consent to any additional profiling. Where measurement or personalization requires consent, that consent must cover those purposes. Unsubscribe through the message link or shop@nellycastro.com.

8. International transfers

Some providers and their partners may process data outside the European Economic Area. Shopify’s displayed EU hosting location does not exclude international access or transfers. Depending on the recipient, an applicable adequacy decision or other GDPR Chapter V safeguards are required, such as binding corporate rules or standard contractual clauses, with necessary additional measures.

The former Privacy Shield is not the basis for these transfers. The EU–US Data Privacy Framework is available only for certified US organizations and processing covered by their certification. Contact us for information about applicable safeguards.

Shopify processing may particularly involve Canada, the United States and Singapore. Its Data Processing Addendum describes binding corporate rules for intra-group transfers from the EEA and standard contractual clauses for other relevant transfers. UPS explains standard contractual clauses and approved group privacy rules in its notice. Google, Meta, TikTok and payment providers may involve international recipients and access. An EU contracting entity does not mean processing takes place exclusively in the EU.

The Gemini API is subject to service-specific Google terms for processing inputs and outputs. Processing may take place outside the EEA. Exclusive EU processing is not asserted. See the Gemini API terms and Google Data Processing Addendum.

We use the Gemini API through a business project with billing enabled. Under the applicable paid-service terms, Google does not use inputs and responses to improve its products. Google nevertheless describes limited logging for security, abuse prevention and legally required disclosures. This is not a promise of zero storage.

9. Retention

Transaction information is retained while necessary for contract performance and claims. Accounting records subject to Spanish Commercial Code Article 30 must be retained for six years from the last accounting entry; tax duties and possible limitation-period interruptions may require additional analysis. These duties do not justify retaining all browsing or marketing data for the same period.

After the purpose ends, data is deleted or anonymized, except mandatory retention and, where applicable, blocking under LOPDGDD Article 32. Marketing withdrawal must prevent further messages while allowing minimum information needed to demonstrate the request or avoid improper re-inclusion.

Enquiry retention depends on handling the request and whether correspondence relates to a contract or possible claims. Account information is needed for the existing account and its purposes; closing an account does not remove legally required order records. Marketing information is processed until withdrawal or the end of the subscription purpose. Consent records are needed while lawful processing must be demonstrated; a suppression list supports compliance with unsubscribe requests. Technical logs and backups may only be kept for security and recovery purposes and the duration required for those purposes.

AI results, classifications and summaries stored in our internal invoicing system are subject to their handling purpose and the retention criteria applicable to the related transaction or communication. Google’s data use is distinct from our own storage of invoices, messages and analysis results.

10. Rights and complaints

You can request access, correction, erasure, restriction and portability where their conditions apply, and object to legitimate-interest processing. You can object to direct marketing at any time. Consent can be withdrawn without retroactive effect. Portability can apply to automated processing based on consent or contract. Applicable rights also concern solely automated decisions with legal or similarly significant effects.

Send requests to shop@nellycastro.com or the postal address above. An identity-document copy is not routinely required; necessary additional information will be requested only if there are reasonable identity doubts. Responses are normally provided within one month; where the law permits, this can be extended by up to two additional months, with notice within the first month. Requests are free, subject to statutory exceptions for manifestly unfounded or excessive requests.

You can complain to the Spanish Data Protection Agency or another competent supervisory authority. You do not need to complain to us first.

11. Security, automated decisions and updates

Security measures must be appropriate to processing risks. An encrypted connection does not remove every internet risk. Do not supply particularly sensitive information unnecessary for your enquiry.

AI analysis creates summaries and classifications for internal handling. Payment providers may carry out their own automated fraud-prevention and payment checks; their procedures depend on the selected service and its privacy notice. Where statutory conditions concerning solely automated significant decisions apply, you can in particular request human intervention, express your point of view and contest the decision. Contact us with questions about how processing affects your order.

We adapt this policy when our services or processing change and notify material changes where required.