Privacy policy

1. Who is responsible for your data (the Controller)

This Privacy Policy explains what personal data we collect when you visit or shop with us, why we collect it, who we share it with, and what rights you have over it. Under the General Data Protection Regulation (GDPR), the entity that determines the purposes and means of this processing — the "controller" — is:

Para Casa
Carrer de l'Hospital 73
08001 Barcelona, Spain
Email: contact@para-casa.com
Phone: +34936039809

If you have any questions about this policy or about how your data is handled, the email address above is the best way to reach us.

2. The personal data we collect

The personal data we collect depends on how you interact with our store — simply browsing the site, placing an order, or contacting us directly. Each of these is explained below, together with the legal basis we rely on under the GDPR.

2.1 When you visit the site

When you browse our website, our server automatically and temporarily logs certain technical information, including your IP address, the date and time of your visit, the URL requested, the referring page, and details about your browser and operating system. This information is used purely for security and reliability purposes — for example, to detect and prevent abuse and to keep the site running correctly. The legal basis for this processing is our legitimate interest in the secure and stable operation of our website (GDPR Art. 6(1)(f)).

2.2 When you place an order

To process and fulfil your order, we collect the information necessary to do so: your name, billing and shipping address, email address, phone number (optional), and payment details. This data is used to confirm your purchase, arrange delivery, handle invoicing, and provide customer support related to your order. The legal basis for this processing is the performance of the contract formed when you place an order with us (GDPR Art. 6(1)(b)).

Payments are processed securely through our configured payment providers, and we accept the following payment methods: Visa, Mastercard, American Express, Discover, Diners Club, Google Pay and Apple Pay.

2.3 When you contact us

If you get in touch with us — for example, with a question about an order or a general enquiry — we store the content of your message together with the contact details you provide, so that we can respond to you and keep a record of our correspondence. The legal basis for this processing is the performance of a contract or pre-contractual steps taken at your request (GDPR Art. 6(1)(b)), and our legitimate interest in maintaining accurate customer service records (Art. 6(1)(f)).

3. How we share your personal data

We do not sell your personal data. We only share it with third parties in the following limited circumstances:

  • where you have given your explicit consent;
  • where sharing is necessary to perform our contract with you — for instance, passing your shipping address to the delivery partners responsible for getting your order to you;
  • where we are subject to a legal obligation requiring disclosure; or
  • where we have a legitimate interest in sharing the data under GDPR Art. 6(1)(f), such as preventing fraud or protecting the security of our systems.

4. Cookies

We use cookies that are strictly necessary for the site to function, such as those that let you add items to your basket and complete checkout securely. These cannot be switched off, as the site would not work correctly without them.

Optional cookies — such as those used for analytics or marketing — are only set once you have given your consent through our cookie banner. You can change your cookie preferences at any time.

5. Services and third parties we use

This site is hosted on Shopify (Shopify Inc., 150 Elgin Street, Ottawa, ON, K2P 1L4, Canada). As Shopify's infrastructure is based in Canada, using our store may involve the transfer of your data outside the European Economic Area for hosting purposes.

Payments are processed by our configured payment providers, who handle the payment methods listed in Section 2.2 above (Visa, Mastercard, American Express, Discover, Diners Club, Google Pay and Apple Pay). Each of these providers processes your data under its own separate privacy policy, which we encourage you to review.

6. Your rights under the GDPR

As a data subject, you have a number of rights in relation to the personal data we hold about you. In particular, you have the right to:

  • Access — request confirmation of whether we process your data, and obtain a copy of it (Art. 15);
  • Rectification — request correction of inaccurate or incomplete data (Art. 16);
  • Erasure — request deletion of your data where it is no longer necessary for the purposes it was collected, or where you withdraw consent (Art. 17);
  • Restriction of processing — request that we limit how we use your data in certain circumstances (Art. 18);
  • Data portability — receive the data you have provided to us in a structured, commonly used, machine-readable format (Art. 20);
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
  • Lodge a complaint — with a supervisory authority, in particular in the EU country where you live, work, or where the alleged infringement occurred (Art. 77).

7. Right to object

Where we process your personal data on the basis of a legitimate interest, you have the right to object at any time, on grounds relating to your particular situation, under GDPR Art. 21. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

To exercise any of the rights described in this policy, please contact us at contact@para-casa.com.