Privacy Policy

Last updated: June 2026

At Velisse, we are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your information when you visit our website or make a purchase from us, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Spanish data protection law (Ley Orgánica 3/2018, LOPDGDD).

Please read this policy carefully. By using our website, you confirm that you have read and understood its contents.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

  • Company name: Velisse
  • Address: Carrer Jaume Marquès i Casanovas, Girona, Spain
  • Email: velisse.team.co@gmail.com

If you have any questions about how we handle your data, please contact us at the email address above.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

a) Data you provide directly

  • Full name
  • Email address
  • Shipping and billing address
  • Phone number
  • Payment information (processed securely by our payment provider — we do not store full card details)
  • Any messages or enquiries you send us

b) Data collected automatically

  • IP address
  • Browser type and version
  • Device type and operating system
  • Pages visited and time spent on the website
  • Referring URL
  • Cookie data (see Section 8)

3. How We Use Your Data

We use your personal data for the following purposes:

  • To process and fulfil your order — including sending confirmation emails, managing shipping and handling returns. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • To communicate with you — to respond to your enquiries or provide customer support. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • To send marketing communications — only if you have given your explicit consent. You can withdraw consent at any time. Legal basis: consent (Art. 6(1)(a) GDPR).
  • To comply with legal obligations — such as tax, accounting or fraud prevention requirements. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
  • To improve our website and services — through analytics and performance monitoring. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Sharing Your Data with Third Parties

We do not sell or rent your personal data to third parties. We may share your data with trusted service providers who assist us in operating our business, including:

  • Shopify Inc. — our e-commerce platform provider (data may be processed in the USA; Shopify is Privacy Shield certified and complies with GDPR).
  • Payment processors — such as Stripe or PayPal, to securely handle payment transactions.
  • Shipping and logistics providers — to deliver your order.
  • Email marketing tools — only if you have subscribed to our newsletter.
  • Analytics providers — such as Google Analytics, to help us understand website usage.

All third parties are required to handle your data securely and in accordance with applicable data protection law. Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses).

5. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes described in this policy:

  • Order data: retained for up to 7 years to comply with Spanish tax and accounting obligations.
  • Customer account data: retained for as long as your account is active, plus a reasonable period thereafter.
  • Marketing data: retained until you withdraw your consent or unsubscribe.
  • Analytics data: typically retained in anonymised form for up to 26 months.

6. Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

  • Right of access — you may request a copy of the personal data we hold about you.
  • Right to rectification — you may request that we correct any inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") — you may request deletion of your data, subject to our legal obligations.
  • Right to restriction of processing — you may request that we limit how we use your data in certain circumstances.
  • Right to data portability — you may request a structured, machine-readable copy of your data.
  • Right to object — you may object to processing based on legitimate interests or for direct marketing purposes.
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at velisse.team.co@gmail.com. We will respond within 30 days.

7. Right to Lodge a Complaint

If you believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with the competent supervisory authority:

  • Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es

We would, however, appreciate the opportunity to address your concerns before you contact the authority, so please reach out to us first.

8. Cookies

Our website uses cookies — small text files stored on your device — to improve your browsing experience and analyse site usage. We use the following types of cookies:

  • Strictly necessary cookies: required for the website to function (e.g. shopping cart, login sessions). These cannot be disabled.
  • Analytical/performance cookies: help us understand how visitors interact with our website (e.g. Google Analytics). These are only set with your consent.
  • Marketing cookies: used to display relevant advertisements. These are only set with your consent.

You can manage or withdraw your cookie consent at any time through your browser settings or our cookie consent tool. Please note that disabling certain cookies may affect website functionality.

9. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, disclosure or destruction. These include SSL encryption for data transmission, restricted access to personal data, and use of secure and reputable third-party services.

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

10. Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe a child has provided us with their data without parental consent, please contact us and we will delete it promptly.

11. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing any personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on this page with a revised date. We encourage you to review this policy periodically.

13. Contact Us

For any questions, requests or concerns relating to this Privacy Policy or your personal data, please contact us:

  • Email: velisse.team.co@gmail.com
  • Address: Carrer Jaume Marquès i Casanovas, Girona, Spain