Privacy policy
Last updated: 27 October 2026
At SafeLadyNails we take your data seriously. Here we explain, without any small print, what data we process, what for, who we share it with and how you can exercise your rights.
In short
- We use your data to manage your order, look after you and comply with the law. We do not sell it or hand it over to third parties to use for their own purposes, such as advertising.
- News by email and analytics and advertising cookies, only with your consent: that is your decision. Necessary cookies (cart, security and your account session if you log in) are always stored, because the shop does not work without them.
- We do not ask you for health data or for you to tell us about personal situations.
- Your rights, at safeladynails@gmail.com.
1. Who is responsible for your data
| Controller | The owner of SafeLadyNails (name and tax ID (NIF) in the Legal notice) |
|---|---|
| safeladynails@gmail.com | |
| Telephone | 681 24 32 30 |
| Website | safeladynails.es |
We have not appointed a data protection officer because, given our activity and size, the regulations do not require us to. For any privacy matter, write to us at safeladynails@gmail.com with the subject “Data protection”.
2. What data we process
- Identification and contact data: first name and surname, email, phone, shipping address and, if different, billing address.
- Order data: products, amounts, date, shipping status, tracking number, returns and incidents.
- Payment data: only the payment method used, the result of the transaction and the last digits of the card that the payment gateway gives us. We do not see or store your full card number: it is processed directly by the payment provider.
- Customer account data (if you create one): email, the one-time access codes we send you (there is no password), saved addresses and order history.
- Subscription data (if you subscribe): the pack you choose (design and shape), its status (active, skipped or cancelled), the date of the next renewal and whether you have used the welcome code (one per customer).
- Communications with you: messages and complaints you send us by email, phone or form, and the suggestions you make to us by any means.
- Technical and browsing data: IP address, type of device and browser, and the information from the cookies you accept (see the Cookie policy).
- Necessary cookies and session: strictly necessary cookies (cart, security, your cookie choice and your account session, if you log in) are always stored and do not require your consent. Analytics and advertising cookies are only stored if you accept them; if you reject them, none is installed.
We do not ask you for specially protected data (health, ideology, sex life, etc.) or for you to tell us why you buy the product, and we ask you not to send it to us.
Source: you give us the data when you buy, register or write to us. In addition, the payment provider confirms the result of the payment to us and the carrier informs us of the delivery status.
3. What we use it for and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing your order: payment, preparation, shipping, delivery, exchanges, returns and warranty | Performance of the sales contract (art. 6.1.b) |
| Managing your subscription: renewals, pack changes, skipped shipments and cancellation, and applying the welcome code to you (one per customer) | Performance of the contract (art. 6.1.b) |
| Creating and maintaining your customer account, if you request it | Performance of the account contract (art. 6.1.b) |
| Handling your enquiries, incidents and complaints | Performance of the contract (art. 6.1.b) and legal obligation to provide customer service (art. 6.1.c; art. 21 TRLGDCU) |
| Complying with tax, accounting and consumer obligations (invoices, books, requests from authorities) | Legal obligation (art. 6.1.c) |
| Preventing payment fraud and protecting the security of the shop | Legitimate interest in preventing fraud and attacks (art. 6.1.f) |
| Storing and analysing the suggestions you send us in order to improve our products and our service | Legitimate interest in improving what we sell and how we look after you (art. 6.1.f). You can object by writing to us |
| Sending you news and offers by email | Your consent, through a box that is never ticked by default (art. 6.1.a; art. 21 LSSI) |
| Keeping your session, the cart, security and your cookie choice (strictly necessary cookies) | They are necessary to provide you with the service you request and do not require consent (art. 22.2 LSSI) |
| Measuring the use of the shop and, if you turn them on, personalising ads | Your consent in the cookie panel (art. 6.1.a; art. 22.2 LSSI) |
If you do not provide the mandatory order data (name, address, email and phone), we will not be able to sell or send you the product. The rest are voluntary.
Automated decisions: we do not make decisions with legal effects on you based solely on automated processing. The platform's anti-fraud system may flag an order as risky, but the decision to cancel it is always reviewed by a person.
4. Who we share your data with
We do not sell your data or hand it over to third parties to use for their own purposes, such as advertising. We only disclose it to those who need it to provide you with the service:
- Shopify (shop platform, checkout page, customer accounts, subscriptions and sending of order emails). It acts as a data processor through Shopify International Limited (Ireland). You can read Shopify's privacy policy for consumers.
- hCaptcha (anti-spam service that Shopify activates on the contact and login forms; provided by Intuition Machines, Inc., USA). It may receive your IP address and technical data about the browser and your interaction with the form in order to tell people from robots. Basis: legitimate interest in the security of the shop (art. 6.1.f).
- Shop Pay / Shop (Shopify), if you choose that payment method: it acts as an independent controller with its own privacy policy.
- Payment providers: Shopify Payments (card payments, Apple Pay and Google Pay). Depending on the method, they act as processor or as independent controller (for example, to comply with their own payment and fraud-prevention regulations).
- Transport and delivery companies in Spain, which deliver the package and may contact you for the delivery. They receive only what is essential: name, delivery address, phone and, where applicable, email.
- Public authorities, when the law requires it.
- Our tax and accounting advisory firm, to comply with tax obligations (data processor).
5. International data transfers
According to its Data Processing Agreement for the EU, Shopify International Limited may transfer data outside the European Economic Area to other entities of its group under its Binding Corporate Rules (art. 47 GDPR), and to its parent company, Shopify Inc., in Canada, under the European Commission's adequacy decision regarding Canada, and to other Shopify sub-processors outside the EEA, with standard contractual clauses (see Shopify's list of sub-processors). We ship orders from Spain and do not disclose your data to any provider outside the European Union in order to prepare or ship them.
6. How long we keep your data
| Data | Period |
|---|---|
| Orders, invoices and accounting documents | 6 years (art. 30 of the Commercial Code) and, for tax purposes, for as long as the authorities may check them (as a general rule, 4 years) |
| Data needed to handle the legal guarantee and possible claims | For as long as the legal guarantee lasts (3 years from delivery) and the period for making claims |
| Customer account | Until you delete it or ask us to delete it |
| Subscription | While it is active; once cancelled, only what the law requires us to keep from its orders |
| News subscription | Until you unsubscribe; afterwards, only the proof of your consent for the period during which we may be called to account |
| Enquiries and complaints | Until they are resolved and, afterwards, for the limitation period of any actions that may arise from them |
| Suggestions | Up to 3 years from when you send them to us; afterwards, or earlier if you object or ask us to delete your data, we keep only the text, with nothing that identifies you |
| Cookies | The period indicated for each one in the Cookie policy |
Once those periods have passed, the data is blocked (accessible only to respond to requests from judges, courts or authorities) and, when the blocking ends, it is deleted (art. 32 LOPDGDD).
7. Your rights
You can exercise the following rights at any time, free of charge:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your data (except for what the law requires us to keep).
- Objection: object to processing based on legitimate interest, such as the analysis of your suggestions in order to improve.
- Restriction: ask us to suspend processing in certain cases.
- Portability: receive your data in a structured and commonly used format.
- Withdraw your consent (news, cookies) at any time, without affecting what was processed before you withdrew it. To unsubscribe from the news, the link that appears in each email is enough.
How: write to us at safeladynails@gmail.com with the subject “Data protection”, stating which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month, extendable by two further months in complex cases (we would let you know within the first month).
Complaining to the authority: if you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We would appreciate it if you wrote to us first to try to resolve it.
8. Minors
The shop is aimed at adults. To buy, you must be at least 18 years old. We do not knowingly collect data from minors under 14; if we find out that we have received it, we will delete it.
9. Security
We apply appropriate technical and organisational measures to protect your data: the shop always works over an encrypted connection (HTTPS), payments are processed by a certified payment gateway without us having access to the full details of your card, and access to customer information is limited to those who need it to manage your order.
10. Changes to this policy
If we change this policy, we will publish the new version here with its date. If the change is important and we have your email, we will let you know.
Any questions? Write to us at safeladynails@gmail.com or visit the contact page.