The data controller responsible for your personal data is:

Business name: Vestral

Address: Carrer Lope de Vega, 45, Unit 2-2a, Barcelona, Spain, 08005

NIF: Y4463324G

In short: We collect personal information that you provide to us, and certain information that is collected automatically when you use our Site.

We collect two types of information:

(i) Information you provide to us. This includes contact and identity information (such as your name, billing and shipping addresses, email address, and phone number) and transaction information (such as your method of payment and details of the products you have purchased). Payment card details are handled by our payment processors and are not stored by us. It also includes any other information you voluntarily provide, for example when you contact us, subscribe to our newsletter, or create an account.

(ii) Information collected automatically. When you use our Site, we automatically collect certain technical information, including your IP address, browser type and version, operating system, and data about your visits, such as the pages you view and the time and frequency of your visits. This is collected through cookies and similar technologies (see Section 5).

You are not required to submit any information to our Site. However, failure to provide certain information may prevent you from accessing some features, including placing an order.

Under the GDPR, we must have a valid legal basis for each purpose for which we process your personal data. We use your information for the following purposes:

• Processing and fulfilling your orders, arranging delivery, and handling returns — Legal basis: performance of a contract.

• Responding to your requests, enquiries, and correspondence — Legal basis: performance of a contract, or our legitimate interest in assisting you.

• Managing your account — Legal basis: performance of a contract.

• Complying with our legal, tax, and accounting obligations — Legal basis: compliance with a legal obligation.

• Sending you newsletters and marketing about our products, offers, and events — Legal basis: your consent.

• Improving our Site, diagnosing technical problems, and understanding how visitors use our Site — Legal basis: our legitimate interest in operating and improving our business, or your consent where required for cookies.

• Preventing fraud and ensuring the security of our Site — Legal basis: our legitimate interest in protecting our business and users.

Where we rely on your consent (for example, for marketing emails or non-essential cookies), you may withdraw that consent at any time (see Section 7).

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

• Order and invoicing data is retained for the period required by Spanish tax and commercial law (generally at least 4 years under the Ley General Tributaria, and up to 6 years for accounting records under the Código de Comercio).

• Account data is retained for as long as your account remains active.

• Marketing data is retained until you withdraw your consent or object to receiving marketing.

Once your data is no longer required, we will securely delete or anonymise it.

As you navigate our Site, we use cookies and similar technologies to collect certain information about your device and browsing actions.

A cookie is a small file placed on your device. We use strictly necessary cookies to operate the Site (for example, to keep items in your cart and process your order), as well as analytical and, where applicable, advertising cookies to understand how visitors use our Site and to improve your experience.

Non-essential cookies (such as analytics and advertising cookies) are only placed with your prior consent. When you first visit our Site, you will be presented with a cookie banner allowing you to accept, reject, or configure these cookies. You can withdraw or change your preferences at any time through the cookie settings on our Site, or by adjusting your browser settings to refuse some or all cookies. Please note that disabling certain cookies may affect the functionality of the Site.

We do not sell your personal information. We may share your information with:

1. Service providers who support our business — including our website host, payment processors, and shipping and logistics providers — who are contractually bound to keep your information confidential and to use it only for the purposes for which we disclose it to them.

2. Public authorities, courts, or regulators, where we are required to do so by law, or to protect our rights, property, or the safety of our users or the public.

3. A buyer or successor in the event of a merger, restructuring, sale, or transfer of some or all of our assets, including as part of any insolvency or similar proceeding.

Under the GDPR and the LOPDGDD, you have the following rights in relation to your personal data:

• Right of access — to obtain confirmation of whether we process your data and a copy of it.

• Right to rectification — to have inaccurate or incomplete data corrected.

• Right to erasure ("right to be forgotten") — to have your data deleted in certain circumstances.

• Right to restriction of processing — to limit how we use your data in certain circumstances.

• Right to data portability — to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.

• Right to object — to object to processing based on our legitimate interests, and to object to direct marketing at any time.

• Right to withdraw consent — where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, please contact us here. We will respond within the timeframes required by law. We may need to verify your identity before acting on your request.

Right to complain: If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid.

Our Site is hosted on Squarespace, Inc., and some of our service providers may be located outside the European Economic Area (EEA), including in the United States. Where your personal data is transferred outside the EEA, we ensure an appropriate level of protection by relying on legal safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses (SCCs) or an applicable adequacy decision (for example, the EU–U.S. Data Privacy Framework). You may request more information about these safeguards by contacting us.

Our Site is hosted on Squarespace, Inc., which provides the online e-commerce platform that allows us to sell our products to you. Your information is stored on Squarespace's secure servers, databases, and applications, behind a firewall.

Payment card information is processed by our payment providers in accordance with the Payment Card Industry Data Security Standard (PCI-DSS), a standard managed by the PCI Security Standards Council (a joint effort of brands such as Visa, Mastercard, American Express, and Discover). Your payment details are encrypted, and we do not store your full card number on our own systems. We recommend that you review the privacy policies of these providers to understand how they handle your information.

All content on this site, including text, graphics, logos, and the Vestral name and branding, is the property of Vestral. Photographs appearing on the site are licensed to Vestral by their respective photographers, who retain ownership of the images. No part of the site may be reproduced, copied, republished, distributed, or used for commercial purposes without prior written permission from Vestral and, in the case of photographs, the relevant rights holder.

We take reasonable technical and organisational measures to protect against the loss, misuse, unauthorised access, disclosure, alteration, or destruction of your personal data. Information you provide is encrypted using secure socket layer technology (SSL) and stored securely.

Although no method of transmission over the internet or electronic storage is 100% secure, we follow generally accepted industry standards to protect your data. Please keep your account password confidential; we will never ask you for your password by unsolicited phone call or email. Remember to sign out of your account and close your browser when using a shared or public computer.

Our Site is not intended for minors. In accordance with Spanish law (LOPDGDD), we do not knowingly collect personal data from children under the age of 14 without the consent of a parent or guardian. If you are under 14, please do not provide any information to us. If we become aware that we have collected data from a child under 14 without appropriate consent, we will take steps to delete it.

We reserve the right to modify this Privacy Policy at any time, so please review it frequently. If we make material changes, we will update the "Effective Date" above and, where appropriate, notify you. Changes take effect upon posting on the Site.

This Privacy Policy is governed by and construed in accordance with the laws of Spain, without prejudice to any mandatory consumer protection rights you may have under the law of your country of residence within the European Union.

If you have any questions or concerns regarding privacy on our Site, please send us a detailed message here and we will make every effort to resolve your concerns.