Privacy policy
Last updated: 27 April 2026
This Privacy Policy describes how Valma Home (hereinafter "the Controller", "Valma Home" or "we") collects, uses, retains and, where applicable, discloses personal information when you visit, use or make a purchase on this website (the "Services"). The site is hosted on the Shopify platform, which acts as data processor.
This policy has been drafted in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
1. Data controller
Owner: Valma Home (Patricia Miller Martínez).
Tax ID (NIF): 74530335P.
Registered address: C/ Vall de Laguar, 10. Valverde, Elche (Alicante), Spain.
Contact and privacy email: hello@valmahome.com.
Website: https://valmahome.com.
2. Personal data we process
We only process the data necessary for each purpose. Depending on your interaction with the Services, we may process:
Identification and contact data: first name, surname, ID number (DNI/NIE/NIF) when required by tax regulations, email, phone, shipping and billing address.
Account data: login credentials, order history, wishlist, returns, communications with customer service.
Order and billing data: products purchased, amounts, payment method, shipping address, tax data.
Payment data: full card or bank account details are processed directly by the payment gateway (Shopify Payments, PayPal, Klarna and other available channels) and are not stored on our servers. We only retain transaction identifiers and the last digits when necessary to manage refunds.
Browsing and device data: IP address, device identifier, browser type, language, operating system, pages visited, time on the site, source of visit, cookie data and similar technologies (see Cookies Policy).
Commercial communications data: consent given, preferences, opens and clicks in email/SMS, newsletter form.
User-generated content: reviews, comments, photos or videos voluntarily submitted.
3. Purposes and legal bases of processing
We process your data for the following purposes, on the indicated legal bases (Article 6 GDPR):
Management of the order and the commercial relationship (processing the purchase, payment, shipping, returns, warranty, customer service). Legal basis: performance of a contract (Art. 6.1.b GDPR).
Compliance with legal obligations (invoicing, accounting, taxation, attending administrative or judicial requirements). Legal basis: legal obligation (Art. 6.1.c GDPR).
Management of the customer account (registration, authentication, history). Legal basis: performance of a contract and consent.
Sending commercial communications and newsletters. Legal basis: consent (Art. 6.1.a GDPR) or legitimate interest in existing customers for similar products (Art. 21.2 LSSI-CE), with the right to object at any time.
Personalisation, measurement and improvement of the Services (analytics, segmentation, recommendations). Legal basis: consent managed through the cookie banner.
Fraud prevention and security of the Services. Legal basis: legitimate interest (Art. 6.1.f GDPR).
Management of reviews and content posted by users. Legal basis: consent.
Handling of data subjects' rights and complaints. Legal basis: legal obligation and consent.
4. Retention periods
Order and billing data: during the contractual relationship and, thereafter, for the applicable legal periods (up to 6 years for commercial and tax obligations under the Spanish Commercial Code and the General Tax Law).
Customer account: as long as the account remains active. After 3 years of inactivity, we may delete it, unless there is a legal retention obligation.
Commercial communications: until the data subject withdraws consent or objects.
Browsing data and cookies: according to the periods indicated in the Cookies Policy; consent is renewable every 24 months.
Claims and support: until the matter is resolved and, thereafter, for the prescription period for legal actions (5 years as a general rule).
5. Recipients and data processors
Your data may be communicated to the following recipients or categories of processors, exclusively for the purposes described and with GDPR safeguards:
Shopify Inc. (Canada / USA) — e-commerce platform that hosts the store and processes orders.
Shopify Payments, PayPal, Klarna, Bizum, or other integrated gateways — payment processing.
Logistics and transport operators (Correos, SEUR, GLS, MRW, UPS, DHL or others) — order delivery.
Omnisend (UK / USA) — email and SMS marketing and automation.
Judge.me (being phased out) — review management while still active.
Google LLC (USA) — web analytics and advertising when consent has been given.
Meta Platforms Inc. (USA) — measurement pixels and advertising when consent has been given.
TikTok Pte. Ltd. — measurement and advertising when consent has been given.
Other technology providers for hosting, customer service, antifraud and productivity tools.
Public authorities, security forces, and courts when there is a legal obligation.
We maintain a contract with each processor pursuant to Article 28 GDPR.
6. International transfers
Some providers are located outside the European Economic Area (mainly the USA and the UK). Transfers are covered by GDPR safeguards: adequacy decisions of the European Commission (including the EU–US Data Privacy Framework where applicable), Standard Contractual Clauses (SCC) and additional measures such as encryption and pseudonymisation. You can request a copy of these safeguards by writing to hello@valmahome.com.
7. Automated decisions and profiling
We do not make decisions producing significant legal effects based solely on automated processing. We may carry out limited marketing profiling (segmentation by language, country, purchase history or interaction with campaigns) always with your consent. You can object at any time.
8. Rights of the data subject
You may exercise at any time, free of charge, the rights of access, rectification, erasure ("right to be forgotten"), objection, restriction, portability, withdrawal of consent and not to be subject to automated individual decisions.
To exercise these rights, write to hello@valmahome.com indicating the right you wish to exercise and attaching, where necessary, a copy of an identity document.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), c/ Jorge Juan, 6. 28001 Madrid, www.aepd.es, especially if you consider that your rights have not been adequately addressed.
9. Information security
We apply appropriate technical and organisational measures (TLS encryption in transit, access controls, backups, activity logging, vendor management) to protect your data against unauthorised access, loss, alteration or disclosure. We will notify the authority and, where applicable, the affected individuals of any security breach posing a risk to their rights, within the deadlines set by the GDPR.
10. Minors
The Services are not directed at minors under 14 years of age. We do not knowingly collect personal data of minors without the consent of a parent or legal guardian. If you detect that a minor has provided data without such authorisation, please contact us so that we can delete it.
11. Cookies and similar technologies
The use of cookies and similar technologies is governed by the Cookies Policy, which details the purpose of each cookie, its duration, the third parties involved and how to manage consent.
12. Changes to this policy
This Privacy Policy may be updated to adapt to regulatory, technical or operational changes. The current version will always be published on this site, indicating the date of the last update. In the event of substantial changes, we will inform you in a prominent manner and, where appropriate, request your consent again.