Privacy policy

Last updated: October 5, 2026

At Vurnix we only process your personal data when necessary and with full transparency, in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). These rules protect you wherever you live.

1. Data controller

2. What data we process and why

Purpose	Data	Legal basis	Retention
Managing your order: payment, shipping, tracking, returns and after-sales support	Name, email, phone, shipping and billing address, products purchased	Performance of the sales contract (Art. 6.1.b GDPR)	For the duration of the relationship and then for the legal retention period (up to 6 years for commercial and tax obligations)
Issuing invoices and meeting tax and accounting obligations	Billing data and amount	Legal obligation (Art. 6.1.c GDPR)	The periods required by tax law
Answering your questions via the form or email	Name, email and the content of your message	Your consent or, if you are a customer, performance of the contract	As long as needed to answer you and up to 1 year afterwards
Sending you your welcome code, news and offers (if you subscribe or choose “Yes” at checkout), and reminding you of an unfinished order	Email and, in the reminder, the products in that order	Your consent (Art. 6.1.a GDPR and Art. 21 LSSI)	Until you unsubscribe (reply “UNSUBSCRIBE” to any email or write to us)
Publishing your product review (if you choose to leave one)	The name you give, rating, text and optional photo (the photo is reprocessed and its metadata and location are removed)	Your consent (Art. 6.1.a GDPR), which you can withdraw at any time	While it is published or until you ask us to remove it
Aggregated visit statistics	Anonymised technical data (page visited, country, device type). No cookies and no identification	Legitimate interest in improving the website (Art. 6.1.f GDPR)	Aggregated, non-personal data
Measuring and optimising our Facebook and Instagram ads (only if you accept advertising cookies)	Meta cookies, pages and products viewed, cart, IP address and browser and, if you buy, the order amount and your email, phone, name and city hashed	Your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI), which you can withdraw in “Cookie settings”	Cookies: 90 days. Meta keeps events under its own policy

We only send you offers if you have expressly agreed (subscription or checkout option). We don't share your email.

3. Payment data

Payments are processed by Stripe Payments Europe, Ltd. (Ireland), certified PCI-DSS Level 1. We never see or store your card number. Stripe processes your payment data as an independent controller for fraud prevention and to meet its legal obligations. More information at stripe.com/privacy.

4. Who we share your data with

• Stripe, to process the payment.
• Meta Platforms Ireland Ltd., only if you accept advertising cookies, to measure our ads (joint controllers under Art. 26 GDPR; Meta may transfer data to the US under the EU-U.S. Data Privacy Framework).
• Suppliers and carriers that prepare and deliver your order, who only receive your name, address and contact phone. Some suppliers and logistics operators may be located outside the European Economic Area; this transfer is necessary to perform the contract you request (Art. 49.1.b GDPR).
• Web hosting provider (servers located in the European Union), as data processor.
• WhatsApp (Meta), only if you choose to contact us that way: the conversation is also subject to WhatsApp's privacy policy.
• Public authorities, where required by law.

We never sell or share your data with third parties for marketing purposes.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent, by emailing hola@vurnix.com with the subject “Data protection”. We will reply within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.

6. Security

The whole website runs over encrypted HTTPS. We apply technical and organisational measures to protect your data against unauthorised access, loss or alteration.

7. Minors

We don't sell to anyone under 18. If you are under 18, please don't give us your data.