Privacy Policy

1. Who is responsible for your data

The data controller is VivaForte, based in Spain. Our full identification details are in our Legal Notice. For anything about your personal data, contact us through our contact page.

2. What data we collect and why

• Orders: your name, delivery and billing address, email address, phone number (if you give one) and order details. We use these to process and deliver your order, take payment, and send you order updates. Legal basis: performance of our contract with you.
• Accounting and legal obligations: we keep invoices and order records for as long as Spanish tax and commercial law require, generally up to six years. Legal basis: legal obligation.
• Your account: if you create an account, your login details and order history. Legal basis: performance of our contract with you.
• Enquiries: the details you send us through our contact form, so that we can reply. Legal basis: our legitimate interest in answering you, or steps taken at your request before a contract.
• Reviews: if you leave a product review, or accept an invitation to review your purchase, we process your name, review and order reference. Legal basis: our legitimate interest in collecting feedback, or your consent where required.
• Marketing: we only send marketing emails if you have asked to receive them, and you can unsubscribe at any time using the link in any email. Legal basis: your consent.
• Security and technical data: your IP address and basic device information, used to keep the website secure, prevent fraud and make it work properly. Legal basis: our legitimate interest.

We do not make decisions about you using fully automated processing, and we do not sell your data.

3. Who we share your data with

We share data only with service providers who need it to deliver our service, and only as far as necessary:

• payment providers, including WooPayments and its payment processor, Klarna, Amazon Pay, Apple Pay and Google Pay, depending on how you pay;
• couriers and postal services that deliver your parcel;
• our website hosting, security, email and website tool providers, including a translation service that makes this site available in other languages;
• our accountants and advisers; and public authorities where the law requires it.

Some of these providers are based outside the European Economic Area, for example in the United States. Where that happens, we rely on safeguards that the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

4. How long we keep your data

We keep data only for as long as we need it for the purpose it was collected. Order and invoice records are kept for the legal retention period. Enquiries are kept for as long as needed to deal with them. Marketing data is kept until you unsubscribe or withdraw your consent. Account data is kept until you ask us to delete your account.

5. Cookies

Our website uses cookies that are strictly necessary for it to work, such as keeping items in your basket, completing checkout and keeping the site secure. These do not need your consent. Where we use any other cookies, for example for analytics or marketing, we will ask for your consent first, and you can change your choice at any time. Full details are in our Cookie Policy.

6. Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given at any time, without affecting what we did before. To use any of these rights, contact us through our contact page and we will reply within one month. We may need to confirm your identity first.

If you are unhappy with how we handle your data, you have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority in your own country.

7. Children

Our website and products are intended for adults. We do not knowingly collect data from anyone under 18.

8. Security and changes

We use appropriate technical and organisational measures to protect your data, including encrypted connections and secure payment providers. We may update this policy from time to time, and the date at the top shows when it last changed.