Privacy Policy

Last updated: [Insert Date]

ByM ("we", "us", "our") operates the online store at m8stj0-vd.myshopify.com (the "Site"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit the Site, create an account, or place an order, and describes your rights regarding that data.

ByM is established in Spain. As such, this Policy is designed to comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"). Because we ship internationally, references to additional regional rights (e.g. the California Consumer Privacy Act) are included where relevant.

1. Data Controller

The data controller responsible for your personal data is:

Company name: ByM
Registered address: [Insert Registered Address]
Country: Spain
Contact email: m09.pfi@gmail.com
Data Protection Officer (if appointed): [Insert DPO contact, or state "Not applicable"]

2. What Personal Data We Collect

Identity data: full name, username, title
Contact data: billing address, delivery address, email address, telephone number
Order data: products purchased, order history, order value, payment status
Financial data: payment card or payment account details, processed securely by our payment providers (we do not store full card numbers)
Technical data: IP address, browser type and version, device information, operating system, time zone setting
Usage data: information about how you use the Site, pages visited, and browsing patterns
Marketing data: your preferences in receiving marketing communications
Account data: login credentials, account settings, wishlist and saved items

3. How We Collect Your Data

Directly from you when you create an account, place an order, subscribe to a newsletter, contact customer support, or complete a form on the Site
Automatically through cookies and similar technologies as you interact with the Site (see our Cookie Policy)
From third parties, such as payment providers, delivery carriers, marketing platforms, and analytics providers

4. Legal Basis and Purposes of Processing

Performance of a contract: to process and deliver your orders, manage your account, and provide customer support
Legal obligation: to comply with tax, accounting, and consumer protection laws
Legitimate interests: to improve the Site, prevent fraud, ensure security, and carry out direct marketing to existing customers (where permitted)
Consent: for marketing communications to new subscribers, non-essential cookies, and any other processing where consent is required

5. Sharing Your Personal Data

We may share your personal data with third-party service providers, acting as processors, to operate our store:

Payment processors (e.g. Shopify Payments, Stripe, PayPal, or other card payment providers)
Shipping and logistics providers, including international couriers and customs authorities where required
Analytics providers (e.g. Google Analytics)
Advertising and marketing platforms (e.g. Meta/Facebook, Google Ads)
Email marketing platforms (e.g. Mailchimp, Klaviyo, or similar)
Customer support tools (e.g. live chat or helpdesk software)
Hosting and IT infrastructure providers, including our e-commerce platform, Shopify
Professional advisers, auditors, insurers, and regulators, where required
Law enforcement or other authorities where required by law

We do not sell your personal data to third parties for their own independent marketing purposes.

6. International Data Transfers

As we ship internationally and use service providers located outside the European Economic Area (EEA), your personal data may be transferred to and processed in countries that do not offer the same level of data protection as Spain and the EU. Where this occurs, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, adequacy decisions, or other legally recognized transfer mechanisms.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Order and invoicing data is generally retained for the period required by Spanish tax and commercial law (typically up to 6 years). Marketing data is retained until you withdraw your consent or object to processing.

8. Your Rights

Under the GDPR and LOPDGDD, you have the right to:

Access the personal data we hold about you
Request rectification of inaccurate or incomplete data
Request erasure of your data ("right to be forgotten")
Request restriction of processing
Object to processing, including for direct marketing purposes
Request data portability
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with your local supervisory authority

To exercise any of these rights, please contact us at m09.pfi@gmail.com.

9. Children's Privacy

The Site is not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including encryption of payment data and restricted access to personal data on a need-to-know basis.

11. Cookies

The Site uses cookies and similar technologies. For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised.

13. Contact Us

Email: m09.pfi@gmail.com
Postal address: [Insert Registered Address]

Disclaimer: This document is a general template and does not constitute legal advice. We recommend having it reviewed by a qualified lawyer in Spain before publishing it, to ensure it reflects your actual data practices and complies with all applicable laws.