Privacy Policy
Last updated: February 2026
At ALMARA we take the privacy of our customers and users very seriously. This Privacy Policy explains what personal data we collect, for what purpose, how long we keep it, and what rights you can exercise, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
1. Data controller
The personal data you provide will be processed under the responsibility of:
2. Personal data we process
Depending on how you interact with us, we process the following data:
| Origin | Data collected |
|---|---|
| Order form / Checkout | Name, surname, shipping and billing address, phone number, email address |
| Payment gateway (Stripe) | Card data (managed directly by Stripe, never by ALMARA) |
| Contact form / WhatsApp | Name, email address, message content |
| Account creation (if applicable) | Name, email address, encrypted password |
| Web browsing (cookies) | Anonymised browsing data if you accept analytics cookies |
3. Purposes and legal basis for processing
We process your data for the following purposes:
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Process and dispatch your order | Performance of a contract (Art. 6.1.b) |
| Issue invoices and comply with tax obligations | Legal obligation (Art. 6.1.c) |
| Handle enquiries, incidents or complaints | Legitimate interest / contract performance (Art. 6.1.b & 6.1.f) |
| Send commercial communications about news and offers | Consent (Art. 6.1.a) — only if expressly given |
| Improve browsing experience through web analytics | Consent (Art. 6.1.a) — only if you accept analytics cookies |
4. Retention period
We keep your data for as long as necessary to fulfil the purpose for which it was collected and, once fulfilled, for the applicable legal limitation or retention periods:
- Order and billing data: 5 years (tax obligation, Art. 66 Spanish General Tax Law).
- Commercial communications data: until you withdraw your consent.
- Customer service data: 3 years from the last interaction.
- Browsing / cookie data: as indicated in our Cookie Policy.
5. Recipients and data transfers
ALMARA does not sell or transfer your personal data to third parties, except when necessary to provide the service or by legal obligation. Data processors with access to your data are:
- Stripe, Inc. — Payment gateway. Processes payment data securely under its own privacy policy (stripe.com/privacy). International transfer covered by Standard Contractual Clauses (SCC).
- Courier / delivery company — Name, delivery address and phone number, required to complete the shipment.
- Vercel, Inc. — Website hosting. EU servers where possible; transfer covered by SCC.
- Google LLC (Google Analytics) — Only if you accept analytics cookies. Transfer covered by SCC.
We may be required to disclose data to competent Public Authorities where required by applicable law.
6. Your rights
As the data subject you have the right to:
- Access: know what data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): request deletion of your data when it is no longer necessary.
- Objection: object to processing on grounds relating to your particular situation.
- Portability: receive your data in a structured, commonly used format.
- Restriction of processing: request that we pause processing while a complaint is verified.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
7. Security
ALMARA has adopted the necessary technical and organisational measures to ensure the security of your personal data and prevent its alteration, loss, processing or unauthorised access, taking into account the state of technology, the nature of the stored data and the risks to which they are exposed.
8. Dispute resolution and complaints
9. Changes to this policy
ALMARA reserves the right to modify this Privacy Policy to adapt to legislative or case-law changes, as well as changes to the company's own activities. Any relevant modification will be communicated to users through a prominent notice on the website or by email where possible.