Privacy Policy

6. Privacy Policy

6.1 Data controller

Dormeluna is the public-facing name of the operator responsible for personal data processed through this store. The seller's full legal identity, NIF, professional address and direct privacy contact must be added here before publication.

6.2 Personal data we may collect

Depending on how a person uses the store, Dormeluna may process:

  • Identity and contact data, such as name, delivery and billing address, email address and telephone number.

  • Order and transaction data, such as purchased products, order history, refunds and payment status.

  • Customer service communications and information supplied in a return, complaint or warranty request.

  • Technical data, such as IP address, device, browser, language, approximate location, cookie identifiers and website activity.

  • Marketing preferences and interactions with newsletters or advertisements.

  • Fraud-prevention, security and compliance information.

Payment providers process payment credentials under their own security and privacy obligations. Dormeluna does not normally store complete card details.

6.3 Purposes and legal bases

Dormeluna may process personal data to:

  • Operate the store, take payment, fulfil orders, arrange delivery and manage returns because processing is necessary to perform the purchase contract.

  • Answer questions, provide customer support and handle complaints based on the contract or Dormeluna's legitimate interest in providing effective service.

  • Comply with accounting, tax, consumer protection, fraud-prevention and other legal obligations.

  • Protect the website, customers and business against fraud, abuse and security threats based on legal obligations and legitimate interests.

  • Send marketing communications when the recipient has consented or when another lawful basis permits them. A person can unsubscribe at any time.

  • Use non-essential analytics or advertising technologies where valid consent has been obtained in jurisdictions that require it.

Where processing relies on consent, consent can be withdrawn at any time without affecting processing already carried out lawfully.

6.4 Service providers and recipients

Personal data may be shared only as reasonably necessary with providers that support the store, such as the ecommerce and hosting platform, payment processors, fulfilment partners, carriers, customer-support tools, email providers, analytics and advertising providers, professional advisers and fraud-prevention services.

Data may also be disclosed when required by law, court order or a competent authority, or when necessary to establish, exercise or defend legal claims.

6.5 International data transfers

Some providers may process data outside the European Economic Area or the United Kingdom. Where required, Dormeluna will rely on a recognised transfer mechanism, such as an adequacy decision, approved standard contractual clauses or another lawful safeguard.

6.6 Retention

Personal data is retained only for as long as reasonably necessary for the relevant purpose, including order fulfilment, customer service, legal claims, fraud prevention and mandatory accounting or tax periods. Data collected on the basis of consent may be kept until consent is withdrawn or the data is no longer necessary, subject to applicable legal retention duties.

6.7 Privacy rights

Subject to applicable law, individuals may have rights to request access, correction, deletion, restriction, objection and data portability, and to withdraw consent. They may also have the right not to be subject to certain solely automated decisions.

Requests may be submitted through the Dormeluna Contact page. Dormeluna may need to verify the requester's identity before acting. EU residents may complain to their local data protection authority; in Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD). UK residents may contact the Information Commissioner's Office where applicable. Residents of US states with applicable privacy laws may exercise the rights granted by those laws.

6.8 Marketing

Marketing emails will include an unsubscribe method. Withdrawing from marketing does not prevent Dormeluna from sending necessary transactional communications about an order, return or account.

6.9 Children

The store is not directed to children and Dormeluna does not knowingly seek to collect personal data from children who cannot lawfully consent or enter into the relevant transaction.

6.10 Security

Dormeluna and its providers use reasonable technical and organisational measures designed to protect personal data. No online system can be guaranteed completely secure.

6.11 Policy changes

This Privacy Policy may be updated when processing activities, service providers or legal requirements change. The current effective date will appear at the top of the policy.