Privacy Policy

Català · Español · English · Deutsch

This Privacy Policy explains how VIWA BCN S.L.U. (“VIWA”) collects and processes your personal data when you use viwabarcelona.com, in accordance with the GDPR (Regulation (EU) 2016/679) and the Spanish Data Protection Act (LOPDGDD).

1. Data controller

• Controller: VIWA BCN S.L.U.
• Represented by: Frank Walkowiak, Sole Director (Administrador Único)
• NIF/CIF: B27646199
• Registered office: Passeig de Gràcia 19, 08007 Barcelona, Spain
• Contact: care@viwabarcelona.com

2. What data we collect

• Identity & contact details (name, email, phone, billing and delivery address)
• Order and delivery information
• Payment data (processed by our payment providers; we do not store full card details)
• Account data, if you create an account
• Browsing data and cookies (see our Cookie Policy)
• Marketing preferences

Providing the data requested as mandatory at checkout is necessary for us to conclude and perform the purchase contract with you; if you do not provide it, we cannot process your order. Providing data for marketing purposes is entirely voluntary and has no effect on your ability to purchase from us.

If you provide us with personal data relating to other people (for example, when you ask us to ship an order to a third party, or you pay using another person’s payment details), you confirm that you have their permission to share their data with us for that purpose.

Please do not send us special categories of data (for example, data revealing health, religious or political beliefs) through our contact form or chat — we do not need such data to provide our services.

3. Purposes and legal bases

• Processing and delivering your orders and customer service — performance of the contract (Art. 6(1)(b) GDPR)
• Invoicing, accounting and tax obligations — legal obligation (Art. 6(1)(c))
• Marketing emails / newsletter — your consent (Art. 6(1)(a)). You can unsubscribe at any time, free of charge, via the link in each message.
• Analytics and advertising cookies — your consent (Art. 6(1)(a))
• Fraud prevention, security and improving our store — legitimate interest (Art. 6(1)(f))

4. Recipients and processors

We share personal data only as necessary with service providers acting on our behalf or as independent controllers where they process payments:

• Shopify — store platform, hosting and payment processing (Shopify Payments)
• PayPal — payment processing (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), where you choose PayPal at checkout
• Shipping carrier — Correos
• Klaviyo — email marketing
• PageFly — page builder used to render parts of our store
• Bundler (Nice-Team) — product bundle offers, loaded from the provider’s own content delivery network
• Okendo — product reviews
• Revoq (BuschBytes, Cologne, Germany) — online withdrawal form and acknowledgement of receipt; data hosted in the EU
• Meta (Meta Platforms Ireland Ltd.) — advertising measurement via the Meta Pixel and Meta Conversions API, only with your consent. Event data and contact details may be shared in hashed (encrypted) form.
• Google — analytics and advertising, if and when we use it (only with your consent)
• Consentmo — cookie-consent management

5. International transfers

Some providers may process data outside the European Economic Area (e.g. in the United States). Where this occurs, appropriate safeguards apply, such as the European Commission’s Standard Contractual Clauses or an adequacy decision. You may request a copy of these safeguards, or information on where they are available, by writing to care@viwabarcelona.com.

6. Retention

We keep your personal data only as long as necessary for the purposes described above and to comply with our legal obligations. As a general rule: order, invoicing and accounting records are retained for 6 years from the last accounting entry (art. 30 of the Spanish Commercial Code) and for the limitation periods under Spanish tax law; data processed on the basis of your consent (e.g. newsletter) is kept until you withdraw it; account data is kept while your account remains active; and cookie lifetimes are set out in our Cookie Policy. After these periods, data is deleted or anonymised, or kept blocked only for the time needed to deal with potential legal claims.

7. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to its processing. Where processing is based on your consent, you may withdraw that consent at any time; this does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. To exercise these rights, email care@viwabarcelona.com.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), or with the supervisory authority of the EU or EEA country where you live or work.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

8. Cookies

For details on the cookies and tracking technologies we use, please see our Cookie Policy.

9. Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse.

10. Changes to this policy

We may update this Privacy Policy from time to time. The version in force is the one published on this page.

Last updated: 29 October 2026