Privacy Policy

Last updated: May 2026

KONIRIA™ ("we", "us") respects your privacy. This Privacy Policy explains what personal data we collect, how we process it, and the rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the KONIRIA™ obligations under Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Controller: KONIRIA™
Email: [email protected]

2. Personal data we collect

Identification data: first name, last name, email address, phone number.
Shipping data: postal address and delivery instructions.
Payment data: processed securely by external payment processors (Stripe, PayPal). We do not store full card numbers on our servers. Your payment method may be temporarily saved by Stripe during checkout to enable one-click payment for any follow-up offers shown to you during that purchase.
Browsing and technical data: cookies, IP address, browser type, device information and pages visited (see our Cookie Policy).

3. Purposes of processing

To process and fulfil your orders and deliver your purchases.
To communicate order status, shipping updates and provide customer support.
To respond to enquiries and requests.
To send marketing communications when you have given your consent.
To prevent fraud and improve the security and quality of our services.
To comply with legal, accounting and tax obligations.

4. Legal basis for processing (Art. 6 GDPR)

Performance of a contract (Art. 6(1)(b)): to process your orders, arrange delivery and provide post-sale support.
Consent (Art. 6(1)(a)): for marketing communications and non-essential cookies. You may withdraw your consent at any time.
Legal obligation (Art. 6(1)(c)): to comply with accounting, tax and consumer protection requirements.
Legitimate interest (Art. 6(1)(f)): to prevent fraud, secure our systems and improve our services, provided that your rights and freedoms do not override those interests.

5. Data retention

We retain your personal data for as long as is necessary to fulfil the purposes described above. Transaction records, invoices and accounting data are kept for the period required by Spanish accounting and tax law (generally a minimum of 6 years). Marketing data is retained until you withdraw your consent or object to its use. Once retention periods expire, data is securely deleted or anonymised.

6. Marketing communications

With your consent, we may send you emails about products, offers and personalised recommendations, including abandoned cart reminders. You can withdraw your consent at any time using the unsubscribe link in every marketing email or by writing to [email protected].

7. Recipients of your data

We share your personal data only with:

Shipping carriers and logistics partners, to deliver your orders.
Payment processors (Stripe, PayPal), to handle transactions securely.
Service providers (hosting, email, analytics, customer support) acting as data processors on our behalf under written agreements that comply with Article 28 GDPR.
Public authorities and bodies, when required by law or judicial order.

We do not sell your personal data to third parties.

8. International data transfers

Some of our service providers may be located outside the European Economic Area (EEA). When this is the case, we ensure that transfers are protected by appropriate safeguards, in particular the Standard Contractual Clauses adopted by the European Commission, or equivalent mechanisms recognised by the GDPR (such as adequacy decisions). You may request a copy of the safeguards in place by writing to us.

9. Your GDPR rights

Under the GDPR you have the right to:

Access: obtain a copy of the personal data we hold about you.
Rectification: ask us to correct inaccurate or incomplete data.
Erasure ("right to be forgotten"): request deletion of your data, subject to legal retention obligations.
Restriction: ask us to limit the processing of your data.
Portability: receive your data in a structured, commonly used and machine-readable format.
Objection: object to processing based on our legitimate interests or for direct marketing purposes.
Withdraw consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within one month, as required by Article 12 GDPR.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at https://www.aepd.es or with the supervisory authority of your country of residence.

10. Children's privacy

Our products and site are not directed to minors under 14. We do not knowingly collect personal data from children under 14. In Spain, the GDPR and Organic Law 3/2018 (LOPDGDD) set the minimum age for digital consent at 14. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction, including TLS encryption in transit, restricted access controls and regular security reviews. No method of transmission over the internet is 100% secure, but we strive to protect your information using industry-standard safeguards.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent revision. We encourage you to review this policy periodically.

13. Contact

For questions or requests regarding this Privacy Policy, write to [email protected].