Privacy policy

Basic information

• Controller: Andalusian Nature Lab, S.L.
• Purposes: managing your orders, your customer account if you create one, your enquiries, withdrawals and guarantee claims; meeting our legal obligations; keeping the website secure; and understanding how it is used, with cookie-free statistics.
• Legal basis: the purchase contract, our legal obligations and our legitimate interest in keeping the website secure and improving it.
• Recipients: the providers that give us services (hosting, database, backups, email, payments, delivery, invoicing, and running the shop and maintaining the website) and public authorities when the law requires it, such as customs for deliveries to the Canary Islands, Ceuta and Melilla. We do not sell your data.
• Rights: to access, rectify and erase your data, object to its processing, restrict it and port it, and to complain to the Spanish Data Protection Agency.
• Further information: below.

1. Who is the controller?

The controller of your data is Andalusian Nature Lab, S.L. Its tax ID (NIF), address and contact details are at the top of this page, under "Data controller".

We have not appointed a data protection officer because our activity does not require one. For any question about your data, write to custodio@yusera.com.

2. What data do we process?

• Identification and contact details: name and surname, email address and phone number.
• Delivery and invoicing: delivery address and, if you ask for an invoice, the tax details you give us.
• Order: products, amounts, the payment method you chose, the order status and our communications about it.
• Payment: we never see or store your card details. If you pay by card, Bizum, Apple Pay or Google Pay, you enter them directly on Stripe's secure page, and we only receive the result of the payment, the method you used and a transaction reference. If you pay by bank transfer, our bank statement shows us the payer's name, account and payment reference.
• Withdrawals, guarantee claims and complaints: whatever you tell us when you exercise your consumer rights.
• Enquiries: whatever you write to us through the contact form or by email.
• Technical data: IP address, date and time of visits and browser details, which we use only to keep the website secure.
• Usage statistics: which pages are visited, which website visitors come from, country, type of device, browser and operating system, how fast pages load and actions such as adding a product to the bag or starting a purchase. They are collected by Vercel Web Analytics and Speed Insights without cookies and in aggregate: they cannot be used to identify you or to follow you on other websites.

We do not ask for health data. If you tell us about a possible reaction to a product, we will use that information only to help you and, where the law requires it, to report it to the person responsible for the product or to the Spanish Agency of Medicines and Medical Devices (cosmetovigilance).

The fields marked as required in our forms are needed to handle your request. If you do not provide them, we will not be able to process your order or enquiry.

3. Why do we use your data and on what legal basis?

1. Managing your purchase: processing the order and the payment, shipping it (with customs clearance if it goes to the Canary Islands, Ceuta or Melilla), keeping you informed of its status, reminding you of a pending bank transfer and letting you know if the order is cancelled, and handling guarantee claims, withdrawals and returns. Legal basis: performance of the sales contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
2. Your customer account, if you decide to create one: we email you an access link, with no passwords, so you can check your orders. Legal basis: your request and the contract (Article 6(1)(b) GDPR).
3. Answering your enquiries. Legal basis: if your enquiry is about a purchase, pre-contractual steps or the contract (Article 6(1)(b) GDPR); otherwise, our legitimate interest in replying to people who write to us (Article 6(1)(f) GDPR).
4. Meeting our legal obligations: invoicing, accounting and tax (including the customs documents for deliveries to the Canary Islands, Ceuta and Melilla), handling consumer complaints and reporting serious undesirable effects of cosmetics. Legal basis: legal obligation (Article 6(1)(c) GDPR) and, for health data you share with us about an incident, Article 9(2)(i) GDPR.
5. Protecting the website and preventing fraud: technical logs, attempt limits and detection of abusive use, including fraudulent payment attempts. Legal basis: our legitimate interest in protecting the website, our customers and payments (Article 6(1)(f) and Recitals 47 and 49 GDPR).
6. Understanding how the website is used so we can improve it, with the aggregate, cookie-free statistics described in section 2. Legal basis: our legitimate interest in knowing which pages and products people are interested in and whether the website loads well (Article 6(1)(f) GDPR). You can object by writing to us or by blocking the statistics scripts in your browser; the shop will keep working as normal.

We do not send newsletters or marketing messages: you will only receive emails about your orders, your account or your enquiries. We do not build marketing profiles or take decisions based solely on automated processing that produce legal effects concerning you.

4. How long do we keep your data?

• Paid orders, with their withdrawals, returns and complaints: six years, because of accounting and tax obligations (Article 30 of the Spanish Commercial Code) and to deal with possible claims.
• Orders that are never paid, whatever the payment method (a Stripe payment that is not completed, a bank transfer that never arrives or an order cancelled before it was paid): we anonymise your personal data 90 days after the order. If a payment did come in and we later refunded it (for example, a bank transfer received after the order was cancelled), the data is kept like that of paid orders.
• Customer account: for as long as you keep it. You can delete it at any time from My account; orders are kept for the legal period stated above. Access links expire after 15 minutes and sessions after 30 days.
• Enquiries: for as long as needed to reply and then for up to 12 months, unless they lead to an order or a complaint.
• Technical security logs: for up to 30 days.
• Usage statistics: these are aggregate data that do not identify you. The code Vercel uses to count a single visit is discarded after 24 hours.
• Backups: every day we make an encrypted copy of the database, which is deleted after 30 days, and the copy from the first day of each month is kept for one year. In addition, the database provider keeps a history of the last 7 days so that it can be restored. So data we delete or anonymise may remain in those copies until they expire. We only use them to restore the shop after a failure or a security incident.

When each period ends, we delete the data or anonymise it so that it no longer identifies you.

5. Who do we share your data with?

We do not sell or hand over your data. We only share it with:

• Providers that give us services (processors). They process the data only to provide that service, under a contract that meets Article 28 GDPR:
• • hosting of the website and its images, and cookie-free usage statistics: Vercel Inc.;
  • database: Neon, with servers in the European Union;
  • daily backup: GitHub, Inc., which prepares and encrypts it on its servers (GitHub Actions) without keeping it, and Cloudflare, Inc., which stores the encrypted copies (Cloudflare R2);
  • sending the shop's emails: Resend;
  • email mailboxes: Google Workspace (Google Ireland Limited);
  • card, Bizum, Apple Pay and Google Pay payments: Stripe Payments Europe, Limited (Ireland), which is also the controller of the processing the law requires of it as a payment institution, such as fraud prevention;
  • order delivery: the carrier that delivers each order (Correos, MRW, SEUR or another carrier operating in Andalusia);
  • invoicing: our invoicing software, adapted to VeriFactu;
  • running the shop (orders, bank transfer payments, shipping, withdrawals, refunds and enquiries), and website development and technical maintenance: Antonio Cuadrado Borrego.
• Banks: if you pay by bank transfer, CaixaBank, S.A., the bank where we hold the account that receives it, and your own bank. If you pay with Stripe, your bank or card issuer is also involved.
• Customs: if your order goes to the Canary Islands, Ceuta or Melilla, the delivery and order details needed for customs clearance reach the Spanish Tax Agency and the tax authority of the destination, through the carrier or the customs agent who handles it.
• Public authorities and courts, when the law requires it; for example, the Spanish Tax Agency or consumer and health authorities.

6. International transfers

Vercel, Neon, Resend, GitHub and Cloudflare are US companies, and Stripe and Google belong to groups based there. When any of these providers processes data outside the European Economic Area, or can access it from outside (for example, to provide technical support), the transfer relies on the EU-US Data Privacy Framework, if the provider has signed up to it, or on the standard contractual clauses approved by the European Commission. You can ask us for more information at custodio@yusera.com.

7. What are your rights?

You can exercise these rights at any time and free of charge:

• Access: find out what data about you we process.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete it, unless the law requires us to keep it.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask us to stop using it while we resolve a complaint.
• Portability: receive the data you gave us in a structured format.

To exercise them, write to custodio@yusera.com from the email address you used to buy or tell us your order number, so we can check it is you. We will reply within one month, which we may extend by two more months if the request is complex; in that case we will let you know first.

If you think we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es; C/ Jorge Juan 6, 28001 Madrid, Spain).

8. Security

We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), access to the management panel only for administrators with two-step verification, payments that never go through our servers and encrypted backups.

9. Minors

The shop is aimed at adults. We do not knowingly process data of children under 14.

10. Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will explain it prominently.