Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, and protect personal data when you visit luva.works or purchase Works from us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Spanish data-protection law.

2. Data Controller

Data Controller: Liubov Dronova, Alp, Girona, Spain. Email: hello@luva.works. NIF: ESZ0308594P.

In this Privacy Policy, “Luva”, “we”, “us”, or “our” refers to the Data Controller above.

3. Data we collect

Depending on how you interact with us, we may process:

Identity and contact data — name, email address, phone number (if provided), and shipping/billing address.

Order and transaction data — items purchased, amounts, payment status, and delivery details. Payment card data is processed by our payment provider (Stripe) and is not stored on our servers.

Technical data — IP address, browser type, device information, and approximate location derived from IP, collected via server logs and, where enabled, analytics tools.

Communications — messages you send us by email or through other channels you choose to use.

4. Purposes and legal bases

We process personal data to: fulfil contracts and deliver orders (performance of a contract); communicate about your order and respond to enquiries (contract / legitimate interests); comply with legal, tax, and accounting obligations (legal obligation); improve the Site and understand traffic (legitimate interests / consent where cookies require it); and protect against fraud or abuse (legitimate interests).

If we send marketing emails in the future, we will do so only where permitted by law (typically on the basis of your consent or soft opt-in where applicable). You may unsubscribe from marketing emails at any time using the unsubscribe link or by contacting us.

5. Cookies and tracking

The Site may use essential cookies required for cart, checkout, and security. Where analytics are enabled, tools such as Google Analytics may be deployed through Google Tag Manager. Non-essential analytics or marketing tags are used only when configured and, where required by law, subject to your consent. You can control non-essential cookies through your browser settings and any consent mechanism we provide.

6. Sharing of data

We share personal data only with service providers necessary to operate the business, including: payment processors (Stripe); shipping and logistics partners; hosting, email, and infrastructure providers; and professional advisers where required. We do not sell your personal data.

Some providers may process data outside the European Economic Area. Where that occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision. You may request a copy of the safeguards used for international transfers.

7. Retention

We retain personal data only as long as needed for the purposes described in this Policy. In particular:

We generally retain order and invoice records for the period required under applicable tax and accounting laws.

Customer correspondence may be retained for up to several years where necessary to resolve disputes or respond to follow-up questions.

Technical logs and analytics data, where collected, are kept for a shorter period consistent with their purpose, then deleted or anonymised.

8. Your rights

Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) in Spain, or with your local supervisory authority.

9. Security

We implement appropriate technical and organisational measures to protect personal data. No method of transmission or storage is completely secure. Please contact us promptly if you believe your personal information has been compromised.

10. Children

The Site is not directed to children under 16. We do not knowingly collect their personal data.

11. Contact details for data requests

To exercise any of your rights, or if you have questions about this Privacy Policy, please contact hello@luva.works and describe your request. We will respond within a reasonable period and in any event within the timeframes required by law.