Privacy Policy

1. Data controller and information for the user

Nicawana, hereinafter the Controller, is responsible for users' personal data and processes it in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Purpose of processing

We process your data to manage and ship your orders and returns; issue invoices and meet our tax and accounting obligations; respond to your enquiries; and, where you have subscribed, send you our newsletter and commercial communications about Nicawana products. We may also carry out anonymous statistical analysis to improve the store.

Legal basis

• Performance of the sales contract for processing and shipping your orders (Art. 6.1.b GDPR).
• Legal obligation for invoicing and tax duties (Art. 6.1.c GDPR).
• Legitimate interest for answering enquiries and basic statistics (Art. 6.1.f GDPR).
• Your consent for marketing communications and non-essential cookies (Art. 6.1.a GDPR), which you may withdraw at any time.

Data retention

Order and billing data is kept for the periods required by tax and commercial law (generally up to 6 years). Marketing data is kept until you unsubscribe or object. When no longer necessary, data is securely erased.

Recipients and processors

Your data is not shared with third parties except where legally required or with providers who help us run the store, under data-processing agreements: Shopify (platform and hosting), Shopify Payments and PayPal (payment processing), Looper (logistics and fulfilment in Spain), shipping carriers such as FedEx, and Klaviyo (email marketing, only if you subscribe). Some providers may process data outside the EU; where they do, transfers are covered by adequacy decisions or Standard Contractual Clauses.

Your rights

• Withdraw your consent at any time.
• Access, rectify, port and erase your data, and restrict or object to its processing.
• Lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

To exercise your rights, contact us through the Contact page at nicawana.eu. If you need to write to us by post, ask us through that page and we will provide our postal address.

2. Mandatory or optional nature of the information

Data requested through forms marked with an asterisk (*) is necessary to attend to your request; providing any remaining data is voluntary. The user guarantees that the data provided is truthful and undertakes to notify any change.

3. Security measures

The Controller applies the principles set out in Article 5 GDPR, processing data lawfully, fairly and transparently, and limiting it to what is necessary. Appropriate technical and organisational measures are in place to protect users' rights and freedoms.