Privacy policy

Last updated: 1 November 2026

Quim Arnau Barcelona operates this store and the website quimarnaubcn.com, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”). The store is powered by Shopify. This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use or make a purchase or other transaction using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy will prevail with respect to your personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read it.

Data controller

The controller of your personal information is Quim Arnau Barcelona, with its address at Trav. de Gràcia 56, 08006 Barcelona (Spain). You can write to us at info@quimarnaubcn.com about any matter relating to your privacy.

Personal information we collect or process

By “personal information” we mean any information that identifies you or can reasonably be linked to you. It does not include anonymous or de-identified information. Depending on how you use the Services, we may process the following categories:

  • Contact details: name, address, billing and shipping address, phone number and email address.
  • Financial information: payment method, payment confirmation and transaction details. Your full card details are processed directly by the payment provider; we do not see or store them.
  • Account information: username, preferences and settings, if you create an account.
  • Transaction information: items you view, add to your cart, purchase, return, exchange or cancel, and your past orders.
  • Communications with us: what you tell us by email, through the contact form or through the store chat.
  • Device and usage information: browser, device, IP address, cookie identifiers and how you browse the Services.

Where we get your information

  • Directly from you, when you make a purchase, sign up to our list, write to us or use the chat.
  • Automatically, through cookies and similar technologies, according to the settings you have accepted in the cookie banner.
  • From our service providers, when they process data on our behalf (for example, the payment provider or the logistics company).

How we use your information and on what legal basis

  • Managing your orders: payment, preparation, shipping, exchanges, returns and customer service. Legal basis: performance of the purchase contract. This information is necessary: without it we cannot process your order.
  • Managing your return, exchange and withdrawal requests sent through our form: name, email, order number, the details you give us, the date and time of submission and your IP address (to prevent abuse). Legal basis: performance of the contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
  • Sending you news and launches by email, if you have subscribed. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in each email.
  • Measuring and showing advertising for our products on social media (Facebook and Instagram), using the Meta Pixel. Legal basis: your consent in the cookie banner.
  • Answering your enquiries by email, form or chat. Legal basis: your request and our legitimate interest in assisting you.
  • Security and fraud prevention in the store and in payments. Legal basis: legitimate interest.
  • Complying with legal obligations, such as tax and accounting obligations. Legal basis: legal obligation.

Who we share your information with

We do not sell your personal information. We only share it with the providers we need in order to provide the Services, who process it on our instructions or, where they state so, as independent controllers:

  • Shopify (Shopify International Limited, Ireland): store platform, payments and analytics. Shopify may also use this data, together with customer data from other stores, to improve and personalize its services (Shopify Network Intelligence); your data is not shared with any other store. More information in the Shopify Privacy Policy and its privacy portal.
  • MailerLite (UAB MailerLite, Lithuania): sending news emails and subscription forms.
  • tawk.to (tawk.to Inc., USA): store chat. Replies are generated by an artificial intelligence assistant based on our frequently asked questions; it cannot see your orders or your account and does not make decisions that affect you. Using the chat is voluntary: please do not write any sensitive data in it. tawk.to processes the messages you write to us and technical data about your device (IP address, browser and the page you are writing from). The transfer to the USA is based on standard contractual clauses.
  • Cloudflare (Cloudflare, Inc., USA): return and withdrawal form and its database, hosted in the EU, and anti-spam check (Turnstile).
  • Resend (Plus Five Five, Inc., USA): sending the confirmation email for those requests, from Ireland.
  • Meta (Meta Platforms Ireland Limited, Ireland): Meta Pixel and Conversions API (which may include your email address or phone number encrypted by hashing in order to match conversions), only if you accept marketing cookies. Meta also processes this data as a controller, in accordance with its privacy policy.
  • Logistics and shipping: the company that stores and prepares orders and the carriers that deliver them, with the data needed for shipping.
  • Authorities, where required by law.

International transfers

Some providers, or their sub-processors, may process data outside the European Economic Area (EEA), for example in the United States or Canada. In such cases, the transfer is based on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the Commission.

How long we keep your data

  • Order and invoice data: the period required by tax and commercial law (up to 6 years).
  • News subscription: until you unsubscribe.
  • Enquiries: the time needed to deal with them and, afterwards, the limitation period for any possible claims.
  • Chat conversations: up to 12 months, unless we need to keep them longer because of a claim or a legal obligation.
  • Return, exchange and withdrawal requests: 5 years, the limitation period for any possible claims.
  • Cookies: the period stated in our Cookie Policy.

Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent without affecting the lawfulness of processing carried out before its withdrawal. Write to us at info@quimarnaubcn.com stating which right you wish to exercise. We will reply within one month. We may ask you to verify your identity.

If you believe we have not handled your data properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the data protection authority of your country.

Children

The Services are not directed at children under 14 and we do not knowingly collect their data. If you are a parent or guardian and believe a child has provided us with data, write to us and we will delete it.

Security

We apply reasonable measures to protect your information, but no measure is infallible. We recommend that you do not send us sensitive information through unsecured channels.

Links to third-party sites

The Services may include links to other sites or social networks. We are not responsible for their privacy practices; we recommend that you review their policies.

Changes to this Privacy Policy

We may update this Policy to reflect changes in our practices or for legal reasons. We will publish the updated version on this page with its new date.

Contact

If you have any questions about this Privacy Policy or wish to exercise your rights, write to us at info@quimarnaubcn.com or by post to Quim Arnau Barcelona, Trav. de Gràcia 56, 08006 Barcelona (Spain).