Privacy Policy
Updated 25 October 2026. This policy replaces the previous one, from May 2018.
At Mi Cosmética Casera we sell raw materials so that you can make your own cosmetics. To do that we need some of your details. Here we explain which ones, what we use them for, how long we keep them and what you can ask us for at any time.
We have written this to be understood. If anything is unclear, write to info@micosmeticacasera.es and we will explain it.
1. Who is responsible for your data
- Data controller: David González Valle (Mi Cosmética Casera)
- Tax number (NIF): 08878760R
- Address: P.I. El Nevero, Complejo La Mar, Fase II, Edificio D, nº 2. 06005 Badajoz (Spain)
- Email: info@micosmeticacasera.es
- Telephone: +34 679 094 530
Given the type and scale of our activity, we are not required to appoint a data protection officer. For anything to do with your data, write to the address above.
2. What data we process, what for, and on what basis
We do not use all data for everything. Each purpose has its own legal basis:
| What for | What data | Why we may do it |
|---|---|---|
| Preparing and sending your order | First and last name, delivery address, telephone, email and what you bought. | Necessary to perform the purchase contract (Art. 6(1)(b) GDPR). Without these details we cannot serve you. |
| Issuing the invoice and keeping our accounts | Name or company name, tax number if you give us one, billing address and amount. | Required by law (Art. 6(1)(c) GDPR): Spanish tax and commercial legislation and the invoicing regulations. |
| Running your customer account | Email, encrypted password, saved addresses and order history. | You choose to create it. It is necessary to provide you with that service (Art. 6(1)(b)). |
| Answering you when you write or complain | Whatever you tell us and the details of the order concerned. | Necessary to perform the contract and handle the warranty (Art. 6(1)(b) and 6(1)(c)). |
| Sending you the newsletter | Your email address and, if you are a customer, what you usually buy. | Only with your consent (Art. 6(1)(a)). Nobody is subscribed just by buying: you have to ask for it. You can unsubscribe from any email we send you. |
| Meeting cosmetics traceability requirements | Which product batch went into which order. | Required by Regulation (EC) 1223/2009 on cosmetic products (Art. 6(1)(c)). This obligation is about the product, not about you. |
| Preventing fraud and keeping the site secure | IP address and access logs. | Legitimate interest in protecting the shop and the people who buy from it (Art. 6(1)(f)). |
| Understanding how the site is used | Browsing data via cookies. | Only if you accept it in the cookie notice (Art. 6(1)(a)). You can change your mind at any time. |
3. How long we keep your data
- Orders and invoices: six years from the end of the financial year. This is the period for which Article 30 of the Spanish Commercial Code requires us to keep commercial records, and it also covers the four-year tax limitation period.
- Your customer account: for as long as you keep it open. If you ask us to delete it, we delete it.
- Newsletter: until you unsubscribe.
- Enquiries and complaints: for as long as liability may arise from the purchase.
- Proof that you accepted cookies: three years.
- Batch traceability: whatever cosmetics legislation requires, but without your identity: when you ask us to erase your data, the batch stays and you disappear from it.
This matters and we would rather say it plainly: if you ask us to erase your data, we erase everything we can, but invoices and orders stay for those six years because the law requires us to keep them. We do not use them for anything else and nobody outside the company has access to them. After that period, they are deleted.
4. Who we share your data with
So that your order reaches you and the shop works, some companies process your data on our behalf. This is the full, up-to-date list. We keep it current: if we change carrier or supplier, it changes here.
| Who | What for | What they receive | Where they are |
|---|---|---|---|
| Shop hosting and email | |||
| Castris AICHA DIGITAL SL | Hosts the shop and its database | All of the shop's data | Spain · data centres in the EU |
| OVH and Hetzner | Infrastructure on which Castris provides the hosting | The data hosted on those servers | Data centres in the EU |
| OVHcloud OVH Srl | Server for the international shops and the help chat | Traffic of the .com shops and help-chat conversations | Milan (Italy, EU) |
| Google Workspace Google Ireland Limited | Company email, the shop's automatic emails and order documents | Our correspondence with you, invoices, delivery notes and receipts | EU, with possible access from the USA: EU-US Data Privacy Framework and standard contractual clauses |
| Delivery | |||
| GLS General Logistics Systems Spain | Transport and delivery of your order, including cash on delivery | Name, address, telephone, email and order number | Spain · and its network companies in the destination country |
| Correos Sociedad Estatal Correos y Telégrafos, S.A., S.M.E. | Transport and delivery of your order | Name, address, telephone, email and order number | Spain |
| Payments | |||
| Redsys Redsys Servicios de Procesamiento, S.L. | Card and Bizum payment gateway | Amount and order reference. You type your card details into their gateway and we never see them | Spain |
| BBVA Banco Bilbao Vizcaya Argentaria, S.A. | Collects card payments, the remote «Click & Sell» payment and incoming transfers | Amount and reference; for «Click & Sell», first and last name and telephone; for transfers, the payer's name and the reference. We do not store cards | Spain |
| Banco Santander Banco Santander, S.A. | Receives payments by bank transfer | The payer's name and the reference | Spain |
| Newsletter | |||
| Mailchimp The Rocket Science Group LLC (Intuit) | Sending the newsletter and handling sign-ups and opt-outs | Your email address and sending statistics | USA: EU-US Data Privacy Framework and, in the alternative, standard contractual clauses |
| Analytics and advertising (only if you accept them in the cookie notice) | |||
| Google Analytics 4 and Google Tag Manager Google Ireland Limited | Knowing which pages are visited | Browsing data and cookie identifiers | EU and USA: Data Privacy Framework |
| Google Ads Google Ireland Limited | Only if we ever run campaigns: measuring their results | Cookie identifiers and conversion data | EU and USA: Data Privacy Framework |
| Google reCAPTCHA Google Ireland Limited | Preventing automated sign-ups on the newsletter form | IP address and technical browser data, only when that form is submitted | EU and USA: Data Privacy Framework |
| Help chat | |||
| Anthropic Anthropic Ireland, Limited | Automatic translation of chat messages | The text of the messages being translated | Processing in the USA: standard contractual clauses |
A «processor» handles the data following our instructions and only for what we ask of them. A «sub-processor» is a supplier of one of our suppliers. Banks and payment gateways act as controllers in their own right, because financial legislation requires them to process that data independently.
Beyond this list, we do not sell or share your data with anyone. We would only provide it to public authorities, the courts or law enforcement if a legal rule required us to.
5. Does your data leave the European Union?
Some of the suppliers in the list above are outside the European Economic Area. The table shows, for each one, where they are and under what safeguard the transfer is made. Where a transfer does take place, it is because the supplier is covered by a transfer framework recognised by the European Commission or because standard contractual clauses have been signed with them.
6. What you can ask us for
You have the following rights over your data, and exercising them is free:
- Access: to know what data we hold about you and to request a copy.
- Rectification: to correct anything that is wrong or incomplete.
- Erasure: to have your data deleted, subject to the invoice limit explained in section 3.
- Portability: to take your data away in a format you can reuse.
- Restriction: to ask us to keep your data but not use it while a disagreement is resolved.
- Objection: to object to our processing it on the basis of legitimate interest.
- Withdrawing consent where that is the basis, for example the newsletter or cookies. Withdrawing it does not affect what we did before you withdrew it.
How to ask
By writing to info@micosmeticacasera.es from the email address you used to buy, or by post to the address in section 1. We will reply within one month at the latest.
If you bought without creating an account, you can ask us too: write from the email address you used for the order and tell us the order number. We will find it just the same.
We may ask you for some further detail to confirm it is really you. This is not to make things difficult: it is so we do not hand your data to someone else.
If you are not satisfied
If you believe we have not dealt with your request properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), or to the supervisory authority of the EU country where you live or work. We would be grateful if you wrote to us first, in case we can resolve it.
7. Cookies
We use our own cookies that are necessary for the shop to work — keeping your session and your basket — and, only if you accept them, analytics cookies that tell us which pages are visited. You can accept or reject them in the notice that appears when you arrive, and change your mind afterwards. If you reject them, the shop works just the same.
Approximate country from your IP. To show the delivery time for your country on the home page, our own server looks up which country the IP address you connect from belongs to in a database. It uses no cookies, does not store your IP or your country and is not used to track you or for advertising. IP Geolocation by DB-IP.
8. Do we make automated decisions about you?
No. No decision affecting you is taken automatically: orders are prepared and checked by people.
The only thing that comes close is that, if you are subscribed to the newsletter, we may group subscribers by the kind of products they buy in order to send more relevant content. You can object to this by writing to us, or unsubscribe from the newsletter.
9. How we protect your data
The site is encrypted, passwords are stored encrypted and nobody from outside gets into our systems. Staff are only allowed to see what they need for their work. With the companies listed in section 4 we have signed the contract required by Article 28 GDPR, which obliges them to use your data only for what we ask of them.
We will never ask you for your password or your card details by email or by telephone. Your card details never pass through our website and we do not store them: they are handled directly by the bank's payment gateway.
10. Changes to this policy
If we change supplier, add a new service or the law changes, we will update this page and the date at the top. We recommend having a look at it from time to time.