Privacy Policy

Last updated: October 1, 2026

Who we are

This website, https://byringlet.com, is operated by David Torrijos Vaquera, trading as Ringlet.

For the personal information we process to operate our store, manage orders, and communicate with customers, the data controller is:

David Torrijos Vaquera — Ringlet
Avenida Rafael Alberti 25
28018 Madrid, Spain
Email: ringlet@use.startmail.com
Telephone: +34 681 073 635

Our store is powered by Shopify. This Privacy Policy explains how we collect, use, retain, and disclose personal information when you visit our website, make a purchase, contact us, or otherwise use our services.

This policy provides information about our practices. Visiting our website or reading this policy does not, by itself, constitute consent to optional marketing, advertising, or non-essential cookies.

Personal information we collect

Depending on how you interact with our store and which features you use, we may process:

• Contact information, including your name, email address, telephone number, billing address, and delivery address.

• Order and transaction information, including products purchased, payments, delivery details, returns, refunds, and customer service history.

• Payment information needed to complete and verify transactions. Payment card details are processed by the payment providers available at checkout. We do not ordinarily receive your full card number or security code.

• Account information, if you create an account, including account identifiers, preferences, and authentication information managed through the platform.

• Communications you send us, including enquiries, complaints, and information supplied in connection with a product issue.

• Technical information, including your IP address, browser, device identifiers, and information needed to operate and secure the website.

• Browsing and interaction information, such as pages viewed and interactions with our store, where collected through permitted technologies.

• Marketing preferences and records of consent or withdrawal of consent.

We collect information directly from you, automatically through the website, and from providers supporting payments, hosting, delivery, security, and other services used by our store.

Why we use your information and our legal bases

Where the GDPR applies, we rely on the following legal bases:

Orders and customer accounts — performance of a contract

We use the information necessary to process purchases, receive payments, arrange delivery, manage accounts, handle returns, and provide contractual customer support. This also includes taking steps at your request before entering into a contract.

Legal and regulatory obligations — compliance with a legal obligation

We process and retain information where necessary for tax, accounting, consumer protection, and other applicable legal requirements, and to respond to valid requests from competent authorities.

Security and business administration — legitimate interests

Where appropriate, we process information to prevent fraud, secure the website, manage enquiries, keep necessary business records, and establish, exercise, or defend legal claims.

We rely on legitimate interests only where the processing is necessary and our interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests.

Optional analytics, personalised advertising, and marketing — consent where required

Where required by applicable law, we obtain consent before using non-essential tracking technologies, carrying out personalised advertising, or sending promotional communications.

Where the law permits promotional emails to existing customers about our own similar products without additional consent, we provide an opportunity to object when collecting the email address and in each communication.

You can withdraw consent at any time. Withdrawal does not affect processing lawfully carried out before that withdrawal.

We may use anonymised information that no longer identifies individuals to understand and improve our services.

Information needed to place an order

Some information, such as your name, delivery address, and payment details, is necessary to complete a purchase. If you do not provide required information, we may be unable to process your order.

Information requested for optional marketing purposes is not required to make a purchase.

Cookies and similar technologies

Our website uses technologies necessary for functions such as shopping carts, checkout, security, and remembering privacy preferences.

Where optional analytics or advertising technologies are enabled, we request consent before using them when required by applicable law. You can accept, reject, or manage these technologies through the website’s privacy controls, where applicable.

You can change your choices using the cookie preferences controls available on the website. Blocking necessary cookies through your browser may affect store functionality.

A targeted-advertising opt-out does not replace cookie consent where consent is legally required.

Who receives your information

We disclose personal information only where necessary for a stated purpose and with an appropriate legal basis. Recipients may include:

• Shopify, which hosts and supports our store.

• Payment providers, which process payments and manage payment security.

• Fulfilment suppliers and delivery companies, which receive the information needed to prepare, ship, and deliver your order.

• Providers supporting customer service, website functionality, IT security, and business administration.

• Analytics or advertising providers, where those services are enabled and any required consent has been obtained.

• Professional advisers, including accountants and legal advisers, where necessary.

• Public authorities, where disclosure is required by law.

• Parties involved in a business transfer, where legally permitted and subject to appropriate safeguards.

Some providers act on our instructions as processors. Others, such as certain payment providers, may act as independent controllers for their own legal and operational purposes.

We do not sell customer contact lists. Certain advertising-related disclosures may nevertheless be classified as “sale,” “sharing,” or targeted advertising under some US privacy laws. Where applicable, you may exercise the corresponding opt-out rights.

Shopify’s role

Shopify processes personal information to host and operate our store, support transactions, and provide platform services.

If Shopify Network Intelligence or other enhanced Shopify features are enabled, Shopify may also process information from interactions with our store and other merchants to provide those features, subject to applicable law and privacy settings.

For certain processing activities, Shopify acts as an independent data controller and is responsible for handling rights requests relating to those activities.

For more information, please review:

Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/app-users

Shopify Privacy Portal:
https://privacy.shopify.com/en

These links supplement this policy and do not remove our responsibilities for the processing we control.

International transfers

Our providers and fulfilment partners may process information in countries outside your country of residence.

Where personal information is transferred outside the European Economic Area or the United Kingdom, we use the safeguards required by applicable law. Depending on the transfer, these may include an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, the relevant UK transfer arrangements, and additional safeguards where necessary.

You may contact us for information about the safeguards applicable to your data and, where appropriate, to request a copy, subject to necessary redactions.

How long we retain information

We retain personal information only for as long as necessary for its purpose and any applicable legal retention period.

• Order, payment, and invoicing records are retained to fulfil transactions and meet accounting and tax obligations. Spanish accounting documentation is generally retained for six years, and tax records generally for at least four years, subject to applicable extensions and other legal requirements.

• Customer account information is retained while the account remains active and, afterwards, only where necessary for legal obligations or claims.

• Customer service and return records are retained for the time needed to resolve the matter and address applicable warranty obligations or legal claims.

• Marketing information is retained until you unsubscribe or withdraw consent, unless another lawful retention reason applies. We may keep a minimal suppression record to respect your opt-out.

• Cookie and tracking information is retained for the periods applicable to the technologies used and described in the relevant privacy controls.

• Records of privacy requests and consent are retained where necessary to demonstrate compliance.

Where Spanish law requires restricted or blocked retention, information will be kept only for the relevant legal responsibilities and deleted when the applicable period expires.

Your privacy rights

Depending on the applicable law, you may have the right to:

• Access your personal information and receive information about its processing.

• Correct inaccurate or incomplete information.

• Request deletion of your information.

• Request restriction of processing.

• Object to processing based on legitimate interests.

• Object at any time to processing for direct marketing, including related profiling.

• Receive eligible information in a portable format and request its transfer to another controller.

• Withdraw consent where processing relies on consent.

• Exercise applicable protections relating to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, email ringlet@use.startmail.com.

We may request information reasonably necessary to verify your identity. We will not routinely require a copy of your identity document if verification can be completed through less intrusive means.

Under the GDPR, we generally respond within one month of receiving your request. If an extension is permitted because of complexity or the number of requests, we will inform you within that first month and explain the reasons.

Requests are generally free of charge. Any refusal or fee will be limited to circumstances permitted by law and explained to you.

Marketing preferences and advertising opt-outs

You can unsubscribe from promotional emails using the unsubscribe link in the message or by contacting us.

Unsubscribing from marketing does not prevent necessary communications about orders, payments, delivery, security, or customer service.

Where applicable, you can opt out of advertising-related data sharing through:

https://byringlet.com/pages/data-sharing-opt-out

Where required by applicable law and supported by the platform, recognised Global Privacy Control signals are treated as opt-out requests. Cookie preferences and advertising opt-outs may operate separately, depending on the technology and applicable law.

Complaints

If you have concerns about our handling of personal information, contact ringlet@use.startmail.com.

You also have the right to complain to a competent data protection authority without first contacting us.

In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD):

https://www.aepd.es

If you reside elsewhere in the European Economic Area, you may also contact the supervisory authority in your habitual place of residence, place of work, or the location of the alleged infringement.

Children’s information

Our store is intended for a general adult audience and is not directed at children. We do not knowingly collect children’s information for marketing or profiling.

If you believe that a child has provided personal information in circumstances requiring parental authorisation, please contact us so that we can investigate and take appropriate action.

Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, or disclosure.

No system can guarantee absolute security. This does not limit our obligations under applicable data protection law.

Please do not send full payment card details, passwords, or unnecessary identity documents by email.

Third-party websites

Our website may contain links to third-party websites or services. Their handling of information is governed by their own privacy notices. Please review those notices before providing personal information.

Changes to this policy

We may update this policy to reflect changes in our services, providers, or legal obligations. We will publish the updated version and revise the date above.

Where a change requires notice or fresh consent under applicable law, we will provide that notice or request consent before carrying out the relevant processing.

Contact

For questions about this policy or to exercise your privacy rights:

David Torrijos Vaquera — Ringlet
Avenida Rafael Alberti 25
28018 Madrid, Spain
Email: ringlet@use.startmail.com
Telephone: +34 681 073 635
Website: https://byringlet.com