Privacy policy
This policy explains how we process your personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Obsero Cosmetics Europe S.L., Tax ID (NIF) B24740656
- Calle Huerto Real 3, 03400 Villena (Alicante), Spain
- Email: partners@obseroeu.com
2. What data we process
- Identification and contact: first name, last name, email, phone number, shipping and billing address.
- Order data: products, amounts, payment method, purchase history, returns.
- Payment data: handled directly by the payment provider. Obsero does not store your full card number.
- Customer account: username, encrypted password and preferences.
- Communications: what you write to us by email, contact form or social media.
- Browsing: IP address, device, browser and use of the website, through cookies (see the Cookie Policy).
We do not process special categories of data. If you voluntarily tell us about your skin or your health in an enquiry, we will only use that information to reply to you.
3. Why we use your data, on what legal basis and for how long
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Managing orders, payments, shipping, returns and warranties | Performance of the contract (Art. 6(1)(b)) | For the duration of the relationship and 6 years afterwards (accounting and tax obligations) |
| Issuing invoices and meeting legal obligations | Legal obligation (Art. 6(1)(c)) | 6 years (Spanish Commercial Code, Art. 30) |
| Managing your customer account | Performance of the contract (Art. 6(1)(b)) | Until you delete it |
| Answering enquiries and complaints | Legitimate interest in replying to you (Art. 6(1)(f)) or contract | Until resolved, then the limitation period for legal claims |
| Sending the newsletter and offers | Consent (Art. 6(1)(a)) | Until you unsubscribe |
| Sending offers for products similar to those already purchased | Legitimate interest (Art. 21.2 LSSI), with an opt-out in every email | Until you object |
| Analytics and personalised advertising through cookies | Consent (Art. 6(1)(a) GDPR and Art. 22 LSSI) | As set out in the Cookie Policy |
| Preventing fraud and protecting the website | Legitimate interest (Art. 6(1)(f)) | For as long as needed for that purpose |
We do not make automated decisions that produce legal effects concerning you.
4. Who we share your data with
We do not sell your data. We only share it with providers that deliver a service to us, under a data processing agreement, or where the law requires it:
- Shopify International Ltd. (Ireland), the store platform.
- The payment providers that process your payment.
- The carriers that deliver your order.
- Email and newsletter tools.
- Analytics and advertising tools (for example Google or Meta), only if you accept their cookies.
- Our tax and accounting advisers.
- Public authorities, judges and courts where there is a legal obligation.
Shopify also processes some data as an independent controller for its own services. You can read about this in its consumer privacy notice.
5. International transfers
Some providers may process data outside the European Economic Area, for example in Canada or the United States. In those cases, appropriate safeguards are in place: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the provider is certified) or standard contractual clauses. You can ask us for a copy of these safeguards.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and withdraw your consent without affecting processing carried out before.
Write to partners@obseroeu.com with the subject “Data protection”, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you to confirm it. We will reply within one month.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of the EU country where you live.
7. Minors
The store is not aimed at children under 14 and we do not knowingly collect their data. Purchases must be made by adults.
8. Security
We apply technical and organisational measures to protect your data: encrypted connection (HTTPS), access restricted to authorised staff, and providers with security guarantees.
9. Changes to this policy
We may update this policy because of legal changes or changes to our services. We will publish the new version with its date and, if the change is significant, we will notify you by email.
Last updated: 25 October 2026