Privacy policy

Last updated: 20 October 2026

1) Who is responsible

Data controller: Eulàlia Delgado Catalán (Cocolitos)
Tax ID (NIF): 47870443Z
Address: Avinguda de l’Estatut de Catalunya, 1-13, 08035 Barcelona (Spain)
Email: contact@cocolitos.eu

We have not appointed a Data Protection Officer. You can write to the address above for any privacy matter.

2) Scope of this policy

This policy applies to the use of cocolitos.eu, and to purchases and customer service through the channels indicated on the website (the “Services”).

3) Data we process

Identification and contact: first name, surname, email, postal address and phone number (if you provide it).
Order and delivery: products purchased, amount, shipping and billing addresses, tracking and delivery status.
Customer service: messages and metadata needed to handle enquiries, incidents and returns.
Billing and tax: tax ID/VAT number (if applicable), invoice and payment data.
Payments: transaction token or ID and anti-fraud attributes provided by payment processors. We do not store full card details.
Website use: activity data and cookies and similar technologies (see section 11).
Marketing (optional): your email and preferences when you voluntarily subscribe to our newsletter.
Consent preferences and records: your choice in the cookie notice (categories accepted or rejected), consent identifier, date and notice version, managed through our consent management platform (Consentmo).

4) Purposes and legal bases

Selling and delivering products (order management, shipping and returns): performance of a contract.
Customer service (enquiries and after-sales): performance of a contract or legitimate interest in replying to you.
Billing, accounting and legal compliance (fraud prevention, tax and commercial obligations): legal obligation and legitimate interest.
Email marketing (newsletter and offers): consent, which you can withdraw at any time.
Analytics, advertising and personalisation (non-essential cookies): consent through the cookie notice.
Consent management (recording choices and blocking non-essential scripts): legal obligation.
Website security (technical logs, abuse and fraud prevention): legitimate interest.

5) Who we share data with

Shopify (store platform and hosting).
Shopify Network Intelligence (if enabled): Shopify may securely process data about your interaction with our store together with data from other Shopify merchants to provide enhanced services (for example, performance, personalisation, ad measurement and fraud prevention). No other merchant can access your individual data. Legal basis: legitimate interest (security and fraud prevention) and, for measurement and marketing, your consent through the cookie notice. More information in Shopify’s privacy policy.
Payment processors (for example, Shopify Payments, PayPal, Apple Pay and Google Pay).
Logistics (carriers).
Email marketing: Klaviyo, if you subscribe to the newsletter.
Analytics and advertising (only if you accept the relevant cookies): Google (Analytics and Ads), Meta (Facebook and Instagram) and Metricool.
Consent management platform: Consentmo, to display the cookie notice, block non-essential tags until you choose and keep a record of your preferences.

Where applicable, these third parties act as data processors under contracts that require them to protect your data. We only share data with other third parties where there is a legal basis (for example, a legal obligation or your consent).

6) Facebook and Instagram sales channel (Meta)

We have integrated the Facebook & Instagram by Meta channel to sync our catalogue and show products on Facebook and Instagram. This involves the following processing:

Catalogue and shop: we sync product data (titles, images, prices and stock) and handle orders that may originate from Meta. Legal basis: performance of a contract and pre-contractual measures.
Customer data sharing: Shopify allows the Pixel (browser) and the Conversions API (server) to be combined to measure and optimise ads. Legal basis: consent for analytics and marketing cookies, and legitimate interest for security and fraud prevention.
Advertising events: content views, add to cart, purchases and technical data (for example, IP address and browser) and, where applicable, hashed identifiers (email or phone, if you provide them) to improve attribution.
Audiences and ads: we may use your preferences (if you have subscribed and accepted cookies) to personalise ads or exclude you from campaigns. You can withdraw your consent at any time.

You can manage advertising cookies from our Cookie policy and your ad preferences directly on Facebook and Instagram.

7) Relationship with Shopify, Meta and Consentmo

We use Shopify’s technology to run the store and integrate the Meta channel. Shopify mainly acts as a data processor on behalf of Cocolitos. Meta processes data as a platform provider and, where applicable, as an independent controller for its own purposes (measurement, security and service improvement). Consentmo acts as a data processor to manage the cookie notice and keep a record of your consent.

8) International transfers

Some providers (such as Shopify, Google, Meta, Klaviyo or Consentmo and their sub-processors) may process data outside the European Economic Area, mainly in the United States. In that case, valid transfer mechanisms apply (the EU-US Data Privacy Framework, adequacy decisions or the European Commission’s standard contractual clauses).

9) Retention periods

Orders and account: for the duration of the contractual relationship and, afterwards, for the periods needed to address possible liabilities.
Billing and accounting: up to 6 years (commercial obligations) and 4 years (tax obligations).
Customer service: up to 24 months from the last interaction, except for incidents or guarantees.
Marketing: until you withdraw your consent or unsubscribe.
Cookie consent records: up to 24 months from your last choice or as long as needed to demonstrate compliance.
Cookies: according to their purpose and expiry, as stated in the Cookie policy.

10) Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent without affecting the lawfulness of prior processing. You can do so from our GDPR rights page or by writing to contact@cocolitos.eu. We will reply within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority in your country.

11) Cookies and similar technologies

We use cookies and similar technologies (local storage and pixels) to make the website work and, if you accept them, for analytics, advertising and personalisation. When you visit the website you can accept, reject or configure them by category from the cookie notice, and you can change or withdraw your consent at any time. We use Consentmo as our consent management platform, which blocks non-essential scripts until you choose and keeps a record of your decision. Where active, Google tags adjust to your choice through Google Consent Mode v2.

Details of each cookie (name, provider, purpose, duration and whether it is first or third party) are available in our Cookie policy.

12) Minors

Our products are not aimed at minors. If you are under 14, do not give us personal data without the authorisation of your parents or guardians. If we detect data from minors without such authorisation, we will delete it.

13) Security

We apply appropriate technical and organisational measures (for example, TLS encryption, access controls, data minimisation and, where appropriate, pseudonymisation). No measure is perfect: please avoid sending us sensitive information through insecure channels.

14) Changes to this policy

We may update this policy to reflect legal changes or changes to our sales channels or Services. We will publish the new version with its update date.

15) Contact

To exercise your rights or ask privacy questions, write to us at contact@cocolitos.eu or by post to the address above.