Privacy policy

Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how Graellsia Studio collects, uses, stores and shares personal information when you visit graellsiastudio.com, place an order, contact us, subscribe to our communications or otherwise interact with our online store.

1. Data Controller

Data Controller: Alicia García Hernández
Tax Identification Number (NIF): 50771088-Z
Trade name: Graellsia Studio
Address: Calle Collado del Hoyo 9, 28470 Cercedilla, Madrid, Spain
Email: info@graellsiastudio.com

For the purposes of applicable data protection law, Alicia García Hernández is the controller of the personal information processed through Graellsia Studio, except where a service provider processes certain information as an independent controller under its own legal obligations or privacy terms.

2. Personal Information We Collect

Depending on how you interact with our website and services, we may collect the following categories of personal information:

  • Identification and contact information: name, surname, email address, telephone number, billing address and shipping address.
  • Order and transaction information: products purchased, order history, order value, delivery information, returns, exchanges and refunds.
  • Payment-related information: information necessary to process your payment. Full payment card details are generally processed directly by the payment provider and are not stored by Graellsia Studio.
  • Communications: information you provide when contacting us, requesting assistance or communicating with customer service.
  • Account information: where customer account functionality is available, information associated with the creation and use of that account.
  • Marketing preferences: information about whether you have agreed to receive marketing communications and your communication preferences.
  • Technical and usage information: IP address, browser type, device information, approximate location derived from technical information, website interactions and other information collected through cookies or similar technologies.

3. Sources of Personal Information

We may obtain personal information:

  • Directly from you when you place an order, complete a form, contact us, subscribe to communications or otherwise provide information to us.
  • Automatically when you use our website, subject to applicable cookie and consent requirements.
  • From service providers that assist us in operating our store, processing payments, preventing fraud, delivering orders or providing technical services.

4. Purposes and Legal Bases for Processing

We process personal information only where we have an appropriate legal basis.

Order management and performance of a contract. We process the information necessary to accept and manage your order, process payment, prepare and deliver your products, communicate with you about your purchase, provide customer service and manage returns, exchanges or refunds. The legal basis is the performance of a contract with you or taking steps at your request prior to entering into a contract.

Customer enquiries and pre-contractual communications. When you contact us about our products or a possible purchase, we use the information you provide to respond to your enquiry. The legal basis is taking steps at your request prior to entering into a contract or, where appropriate, our legitimate interest in responding to communications addressed to our business.

Legal and administrative obligations. We process and retain information where necessary to comply with tax, accounting, consumer protection and other legal obligations applicable to our business. The legal basis is compliance with a legal obligation.

Security and fraud prevention. We may process information to protect our website, customers and business, detect or prevent fraudulent or abusive activity, maintain security and establish, exercise or defend legal claims. The legal basis is our legitimate interest in protecting our business, customers and services, provided that this interest does not override your rights and freedoms.

Marketing communications. If you expressly choose to receive marketing communications, we may use your email address and related preferences to send information about products, collections and news from Graellsia Studio. The legal basis is your consent. You may withdraw that consent at any time.

Analytics, advertising and non-essential technologies. Where required by law, analytics, advertising and other non-essential tracking technologies are used only after you have given the corresponding consent through our cookie consent mechanism. You may change or withdraw your choices at any time.

5. Information Required to Complete a Purchase

Certain personal information, such as your name, contact details, delivery address and information necessary to process payment, is required in order to enter into and perform a purchase contract with you.

If you do not provide information that is necessary to process an order, payment or delivery, we may be unable to complete the transaction or provide the requested service.

Providing information for marketing purposes is optional and is not required to make a purchase.

6. Shopify

Our online store is hosted on Shopify, which provides the ecommerce infrastructure used to operate the website, checkout and related services.

Shopify may process personal information on our behalf in order to provide ecommerce functionality, process transactions, maintain security, prevent fraud and provide technical services. Depending on the Shopify services and features enabled, Shopify may also process certain information for its own purposes under its applicable privacy terms.

Information submitted through our online store may therefore be processed by Shopify and its authorised service providers in accordance with applicable data protection safeguards.

7. Meta Advertising and Analytics

Subject to your consent where required by applicable law, we use advertising and measurement tools provided by Meta Platforms Ireland Limited, including the Meta Pixel, advanced matching technologies and the Meta Conversions API.

These tools may collect or receive information about your interactions with our online store, including:

  • IP address, browser and device information.
  • Pages and products viewed.
  • Cart, checkout and purchase events.
  • Transaction value and related order information.
  • Identifiers such as email address, telephone number, name or location information, which may be transformed or hashed before being transmitted for matching purposes.

We use these technologies to measure advertising performance, attribute conversions, understand how visitors interact with our store, create advertising audiences, and optimise or personalise advertising on Meta services such as Facebook and Instagram.

Where consent is legally required, these advertising and measurement technologies will not be activated until you have provided the relevant consent through our cookie consent controls. You may withdraw or change your consent at any time through the cookie preferences available on our website.

Meta may process information received through these tools in accordance with its own terms and privacy policy and may act as an independent controller for certain processing activities. More information about Meta’s processing practices is available in the Meta Privacy Policy.

Information processed through Meta’s services may be transferred outside the European Economic Area subject to the safeguards and transfer mechanisms described in Meta’s applicable terms and privacy documentation.

8. Email and Communication Services

We use email and communication service providers, including Zoho Mail, to receive and manage communications sent to Graellsia Studio.

When you contact us by email, the information contained in your message may therefore be processed through those service providers for the purpose of managing and responding to your communication.

9. Payments

Payments made through our online store are processed by the payment methods and payment service providers available at checkout.

Payment providers may process information such as payment credentials, transaction details and fraud-prevention information in accordance with their own legal obligations and privacy policies.

Graellsia Studio does not generally receive or store the complete payment card details used to make a purchase.

10. Shipping and Delivery

Where necessary to deliver your order, we may provide relevant personal information to postal, courier or logistics providers.

This information may include your name, delivery address, telephone number, email address and other information reasonably necessary to arrange and manage delivery.

11. Other Recipients of Personal Information

Personal information may be disclosed, where necessary, to the following categories of recipients:

  • Ecommerce and website infrastructure providers.
  • Payment service providers.
  • Shipping, postal and logistics providers.
  • Email and communication service providers.
  • Technology, hosting, security and fraud-prevention providers.
  • Professional advisers, accountants or administrative service providers where necessary.
  • Public authorities, courts or other competent bodies when disclosure is required by law.
  • Analytics or advertising providers where those services are enabled and the legally required consent has been obtained.

We limit the personal information shared with service providers to what is reasonably necessary for the relevant purpose.

12. Marketing Communications

If you subscribe to marketing communications, we may send you information about Graellsia Studio, new products, collections or other news that may be relevant to you.

You may withdraw your consent at any time by using the unsubscribe option included in our marketing communications or by contacting us at info@graellsiastudio.com.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

13. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website, checkout and essential store functions to operate correctly. Other technologies may be used for analytics, personalisation or advertising.

Where required by applicable law, non-essential cookies and similar technologies will not be used until you have provided the relevant consent.

You can manage your choices through the cookie consent controls available on our website. Additional information is provided in our Cookie Policy.

14. International Data Transfers

Some of the technology and service providers used to operate our online store may process personal information outside Spain or the European Economic Area.

Where personal information is transferred to a country that does not benefit from an applicable adequacy decision, the relevant provider or parties will use appropriate safeguards where required by data protection law, such as Standard Contractual Clauses approved by the European Commission or another legally recognised transfer mechanism.

15. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected and for the periods required to comply with applicable legal obligations.

  • Order and transaction information is retained for as long as necessary to fulfil the transaction and thereafter for the periods required by applicable tax, accounting, commercial and consumer protection laws and for the establishment, exercise or defence of legal claims.
  • Customer service communications are retained for as long as necessary to respond to the enquiry and, where relevant, for the time necessary to address possible contractual or legal claims.
  • Marketing information is retained until you withdraw your consent or unsubscribe. We may retain minimal information necessary to record and respect your opt-out request.
  • Cookie and analytics information is retained in accordance with the applicable cookie settings, consent choices and the retention periods of the relevant technologies and providers.

When personal information is no longer required, it will be deleted, anonymised or securely retained only where continued storage is required by law.

16. Your Data Protection Rights

Subject to the conditions and limitations established by applicable data protection law, you may exercise the following rights:

  • Right of access: to obtain confirmation as to whether we process personal information concerning you and to access that information.
  • Right to rectification: to request correction of inaccurate or incomplete personal information.
  • Right to erasure: to request deletion of your personal information where the legal requirements are met.
  • Right to restriction: to request restriction of processing in certain circumstances.
  • Right to object: to object to processing based on legitimate interests in circumstances provided by law.
  • Right to data portability: to receive certain personal information in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller.
  • Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at info@graellsiastudio.com. We may request information reasonably necessary to verify your identity before processing your request.

17. Right to Lodge a Complaint

If you believe that your personal information has been processed in breach of applicable data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) or, where applicable, another competent supervisory authority.

18. Automated Decision-Making

Graellsia Studio does not currently make decisions that produce legal effects or similarly significant effects for customers based solely on automated processing.

Certain service providers may use automated systems for purposes such as fraud detection, transaction security or risk assessment in accordance with their own legal obligations and privacy practices.

19. Security

We implement reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, misuse or disclosure.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

20. Children's Privacy

Our online store is not specifically directed at children. We do not knowingly collect personal information from children in circumstances where such collection would be prohibited by applicable law.

If we become aware that personal information has been collected unlawfully from a child, we will take reasonable steps to delete or otherwise appropriately manage that information.

21. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

Graellsia Studio is not responsible for the privacy practices, security or content of third-party websites. We recommend reviewing the privacy information provided by those third parties before submitting personal information to them.

22. Changes to this Privacy Policy

We may update this Privacy Policy when necessary to reflect changes to our services, technology, legal requirements or data-processing practices.

The current version will be published on this website and the “Last updated” date will be changed accordingly.

23. Contact

For questions about this Privacy Policy, the processing of your personal information or the exercise of your data protection rights, please contact:

Graellsia Studio
Alicia García Hernández
Calle Collado del Hoyo 9
28470 Cercedilla, Madrid, Spain
Email: info@graellsiastudio.com