Privacy Policy

At Clerea Cosmetics, we take your data privacy very seriously. This Privacy Policy describes how we collect, use, and protect your personal information when you visit our website or make a purchase.

1. Data Controller

Who is responsible for your data?

Owner: Laboratorios Clerea S.L.U. (hereinafter, "Clerea Cosmetics")

NIF/CIF: B24828790

Registered office: Avda. Tenor Fleta, 24 — 50007 — Zaragoza

Email: hola@clereacosmetics.com

Data Protection Officer: Clerea Cosmetics is not obliged to appoint a Data Protection Officer according to Article 37 of the GDPR.

2. Purpose of Processing

What do we use your personal data for?

We process the information you provide us for the following purposes:

Order management: To process your purchase, manage payment, and ship products to the indicated address.
Customer service: To answer your inquiries, product questions, or complaints through our contact forms or chat.
Commercial communications (newsletter): Only if you have given us your explicit consent, we will send you emails with news, natural beauty tips, and exclusive offers. You can unsubscribe at any time.
Website improvement: To analyze browsing behavior to improve site usability (see Cookie Policy).

3. Legal Basis

Why is it legal for us to process your data?

The legal basis for processing your data depends on how you interact with our store:

Performance of a contract (Art. 6.1.b GDPR): When you make a purchase, we need your data to process and ship the order.
Consent (Art. 6.1.a GDPR): For sending the newsletter and other commercial communications. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Legitimate interest (Art. 6.1.f GDPR): To send you information about products similar to those you have already purchased, provided you had the opportunity to object at the time of data collection and can easily unsubscribe (Art. 21.2 LSSI-CE). Also for anonymous market statistics.

4. Data Recipients

Who do we share your data with?

To provide you with our services, we strictly share the necessary data with the following providers (Data Processors), who comply with privacy regulations:

Transport and logistics companies: For home delivery of your order.
Shopify Inc. — E-commerce and payment platform: Shopify manages both the operation of our online store and payment processing through Shopify Payments. Shopify Inc. is based in Canada (a country with an adequacy decision from the European Commission) and processes data on servers located in the EU and USA under Standard Contractual Clauses approved by the European Commission. More information at: https://www.shopify.com/legal/privacy.
Klaviyo Inc. — Email marketing platform: Manages the sending of commercial communications to our newsletter subscribers. Klaviyo Inc. is based in the USA and operates under Standard Contractual Clauses. More information at: https://www.klaviyo.com/legal/privacy-notice.
Hosting and technology services: Providers that host our website and email infrastructure.
Agency/Advisory: For compliance with tax and accounting obligations.

We do not transfer your data to third parties unless legally obliged to do so.

International data transfers: Some of the aforementioned data processors (Shopify, Klaviyo) are based or process data outside the European Economic Area. In all cases, these transfers are made under the guarantees provided in Article 46 of the GDPR, mainly through Standard Contractual Clauses adopted by the European Commission.

5. Data Retention

How long do we keep your data?

Customer data (orders and billing): Will be kept for the duration of the commercial relationship and, once it ends, for 6 years in accordance with Article 30 of the Commercial Code, and 4 years according to the General Tax Law, applying the longer period.
Data to address potential claims: Up to 3 years from the end of the contractual relationship, in accordance with the general limitation period for personal actions (Article 1964 of the Civil Code).
Subscriber data (newsletter): From the moment the user subscribes until they exercise their right to unsubscribe or request the deletion of their data.

6. User Rights

You have full control over your data. You can exercise the following rights at any time and free of charge by writing to hola@clereacosmetics.com:

Access: To know what data we hold about you.
Rectification: To correct erroneous or inaccurate data.
Erasure: To request that we delete your data when it is no longer necessary.
Objection: To object to the processing of your data for a specific purpose.
Restriction of processing: To request that we restrict the processing of your data in certain circumstances.
Data portability: To receive your data in a structured, commonly used, and machine-readable format to transfer it to another controller.
Withdrawal of consent: To withdraw any consent you have given us at any time, without affecting the lawfulness of processing carried out previously based on that consent.

To exercise these rights, please send a request to hola@clereacosmetics.com. If we have reasonable doubts about your identity, we may ask you for a copy of your identity document or other equivalent means of accreditation.

If you believe that the processing of your data does not comply with current regulations, you can file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

7. Data Security

Clerea Cosmetics applies appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These include:

SSL/TLS encryption for all communications between your browser and our website.
Restricted access controls to personal data.
Internal management procedures and periodic security reviews.

However, no internet transmission system is completely secure. If you detect any vulnerability or incident, please notify us at hola@clereacosmetics.com.