Política de privacidad

Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how JinglyGlow collects, uses, shares and protects your personal data when you visit our online store or buy from us, and what rights you have. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI-CE”) and, where applicable, other privacy laws of the countries where our customers live.

1. Data controller

Controller	Claudio Castro (sole trader), trading as JinglyGlow
Address	Carrer Vicent Serra Llaurador, 12550 Almassora (Castellón), Spain
Email	jinglyglow@gmail.com

We have not appointed a Data Protection Officer, as we are not legally required to. For any privacy matter, contact us at the email above.

2. What data we collect

Identification and contact data: name, surname, email address, phone number, shipping and billing address.
Order data: products purchased, price, order number, delivery and return details, communications about your order.
Payment data: payments are handled directly by our payment providers. We do not receive or store your full card number; we only receive limited information such as the payment method, the last four digits and the transaction status.
Account data (if you create a customer account): login email and order history.
Customer service data: messages you send us by email, contact form or chat, including photos or videos you provide to report a problem.
Technical and browsing data: IP address, device and browser type, language, pages viewed, referring website, approximate location derived from your IP, and interactions with our store, collected through cookies and similar technologies (see section 10).
Marketing data: your subscription status to our newsletter and your interactions with our emails.

We do not intentionally collect special categories of data (such as health data) and we ask you not to send them to us.

3. Why we use your data and on what legal basis

Purpose	Legal basis (Art. 6 GDPR)
Processing and delivering your order, handling payments, returns, refunds and guarantee claims	Performance of a contract (Art. 6.1.b)
Managing your customer account	Performance of a contract (Art. 6.1.b)
Answering your questions and requests	Performance of a contract or pre-contractual measures (Art. 6.1.b) and our legitimate interest in providing good service (Art. 6.1.f)
Issuing invoices and keeping accounting and tax records	Legal obligation (Art. 6.1.c)
Preventing fraud and keeping the store secure	Legitimate interest (Art. 6.1.f)
Sending newsletters and promotional emails	Your consent (Art. 6.1.a and Art. 21 LSSI-CE). If you are already a customer, we may email you about similar products of our own under Art. 21.2 LSSI-CE; you can object at any time, free of charge, in every email.
Analytics, personalised advertising and remarketing (e.g. Meta, Google, TikTok)	Your consent via the cookie banner (Art. 6.1.a and Art. 22.2 LSSI-CE)
Reminding you of products left in your cart	Your consent, where you have given it when entering your email

Providing the data marked as required at checkout is necessary to complete your purchase; if you do not provide it, we cannot process your order.

We do not carry out automated decision-making that produces legal or similarly significant effects on you, except automated fraud checks performed by our payment providers, which you may ask us to review manually.

4. Who we share your data with

We do not sell your personal data. We share it only with service providers who need it to run our store, acting as data processors under a contract with us, or as independent controllers where indicated:

E-commerce platform: Shopify International Limited (Ireland) and its group companies, which host our store and process order data. Shopify’s privacy information: shopify.com/legal/privacy.
Payment providers (independent controllers for payment and fraud prevention): Shopify Payments (powered by Stripe Payments Europe Ltd., Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), and any other payment method shown at checkout.
Suppliers and fulfilment partners: the manufacturers and logistics partners who prepare and ship your order receive your name, shipping address, phone number and the products ordered. Some of them are located outside the European Economic Area (see section 5).
Carriers and postal services, who deliver your parcel and may contact you about the delivery.
Email, customer service and review tools integrated in our Shopify store, used to send order notifications, newsletters and review requests.
Advertising and analytics providers (only with your consent): Meta Platforms Ireland Ltd., Google Ireland Ltd. and TikTok Technology Limited (Ireland).
Professional advisers (accountants, lawyers) and public authorities (tax authority, courts, police) when legally required.

5. International data transfers

Because we sell worldwide and some of our suppliers, logistics partners and service providers are located outside the European Economic Area (for example, in China, the United States or Canada), your data may be transferred outside the EEA. When this happens, we ensure an adequate level of protection by relying on:

an adequacy decision of the European Commission (for example, for Canada, the United Kingdom, or US companies certified under the EU–US Data Privacy Framework); or
Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), together with additional safeguards where necessary; or
where no other safeguard is available, the transfer being necessary for the performance of your contract (Art. 49.1.b GDPR), for example to send your address to the warehouse that ships your order.

You may request a copy of the safeguards used by writing to us.

6. How long we keep your data

Order and invoice data: for as long as needed to fulfil your order and handle returns and guarantee claims (at least 3 years after delivery), and then for 6 years to comply with accounting and tax obligations (Article 30 of the Spanish Commercial Code and Spanish tax legislation).
Customer account: until you ask us to delete it, or after 3 years of inactivity.
Customer service communications: up to 3 years after the matter is closed.
Marketing: until you unsubscribe or withdraw your consent.
Cookies: for the periods indicated in our cookie banner and section 10, and never longer than 24 months.

After these periods, data is deleted or kept blocked only to be made available to courts or authorities for the limitation period of any possible liability, as required by Article 32 LOPDGDD.

7. Your rights

You have the right to:

Access your personal data and obtain a copy of it;
Rectify inaccurate or incomplete data;
Erase your data (“right to be forgotten”) where it is no longer needed;
Restrict the processing of your data;
Object to processing based on our legitimate interests, and to direct marketing at any time;
Data portability: receive your data in a structured, machine-readable format;
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, email jinglyglow@gmail.com with the subject “Data protection” and indicate which right you wish to exercise. We may ask for information to verify your identity. We will reply within one month, which may be extended by two further months for complex requests, in which case we will inform you. Exercising your rights is free of charge.

If you believe we have not handled your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the data protection authority of your country of residence. We would appreciate the chance to resolve your concern first.

8. Additional information for residents of the United Kingdom

If you live in the UK, we process your data in accordance with the UK GDPR and the Data Protection Act 2018, with the same rights described above. You can complain to the Information Commissioner’s Office (ico.org.uk).

9. Additional information for residents of the United States

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, Texas or others), you have the right to know what personal information we collect, to access it, correct it, delete it, and to opt out of the “sale” or “sharing” of personal information for targeted advertising. We do not sell personal information for money. Using advertising cookies and pixels may be considered “sharing” under some US laws; you can opt out at any time through the cookie/privacy settings on our store, and we honour Global Privacy Control (GPC) browser signals where required by law. We do not use or disclose sensitive personal information for purposes that would require a right to limit. To exercise your rights, email jinglyglow@gmail.com; you may use an authorised agent. We will not discriminate against you for exercising your rights. In the last 12 months we have collected the categories of personal information listed in section 2, for the purposes listed in section 3, and disclosed them to the categories of recipients listed in section 4.

10. Cookies and similar technologies

We use cookies and similar technologies (pixels, local storage) on our store. When you first visit, a banner allows you to accept, reject or configure non-essential cookies. Rejecting is as easy as accepting, and non-essential cookies are only installed after you consent. You can change your choice at any time through the cookie/privacy settings link in the footer of our store or by deleting cookies in your browser.

Strictly necessary cookies (always active): make the store work, e.g. shopping cart, checkout, security, remembering your cookie choice and language. Set by Shopify. These do not require consent.
Preference cookies (consent): remember choices such as currency or region.
Analytics cookies (consent): help us understand how visitors use the store (e.g. Shopify Analytics, Google Analytics), so we can improve it.
Marketing cookies and pixels (consent): measure the performance of our ads and show you relevant ads on other platforms (e.g. Meta Pixel, Google Ads, TikTok Pixel).

Some of these providers are located outside the EEA; see section 5. For more information about Shopify cookies, visit shopify.com/legal/cookies.

11. Minors

Our store is intended for adults. You must be at least 18 years old to place an order. In Spain, minors under 14 may not provide their personal data without parental consent (Art. 7 LOPDGDD). We do not knowingly collect data from children; if you believe a child has provided us with personal data, please contact us and we will delete it.

12. Security

We apply appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), PCI-DSS compliant payment processing through our payment providers, restricted access to data, and strong authentication on our accounts. No system is 100% secure; if a data breach affecting your rights occurs, we will notify the competent authority and, where required, you.

13. Changes to this policy

We may update this Privacy Policy to reflect legal or operational changes. The “Last updated” date at the top shows when it was last revised. If changes are significant, we will notify you by email or with a notice on our store.