Privacy policy

Last updated: 28 September 2026

This Privacy Policy explains how Gramp Mask ("we", "us") collects and uses your personal data when you visit or buy from our store, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Gramp Mask, Carrer de Ballester 53, 08023 Barcelona, Spain. Email: hello@grampsmask.store.

2. Data we collect

• Contact and order data: name, email, phone, billing and shipping address, products purchased.
• Payment data: processed securely by our payment providers. We do not store full card numbers.
• Communications: messages you send us.
• Device and usage data: IP address, browser, pages visited, collected through cookies and similar technologies (see section 8).

3. Why we use your data and legal basis

• To process and deliver your order and handle returns – performance of a contract (Art. 6.1.b GDPR).
• To comply with tax, accounting and consumer law – legal obligation (Art. 6.1.c GDPR).
• To answer your questions and provide customer service – performance of a contract or our legitimate interest.
• To send marketing emails – only with your consent (Art. 6.1.a GDPR). You can unsubscribe at any time.
• To prevent fraud and keep the store secure – our legitimate interest (Art. 6.1.f GDPR).
• Analytics and advertising cookies – only with your consent.

4. Who we share your data with

We only share your data with service providers that help us run the store, such as Shopify (e-commerce platform), payment processors, our product supplier and shipping carriers (to deliver your order), email tools and, if you consent, advertising partners such as Meta and TikTok. We never sell your personal data.

5. International transfers

Some providers (for example Shopify) may process data outside the European Economic Area. In that case, transfers are protected by adequacy decisions or the European Commission's Standard Contractual Clauses.

6. How long we keep your data

Order data is kept for as long as required by tax and commercial law (generally 6 years). Marketing data is kept until you withdraw your consent. Other data is kept only as long as necessary for the purpose it was collected for.

7. Your rights

You can request access, rectification, erasure, restriction, objection and data portability, and withdraw your consent at any time, by emailing hello@grampsmask.store. You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

8. Cookies

We use strictly necessary cookies to make the store work (for example, to keep items in your cart and process checkout). With your consent, we also use analytics cookies to understand how the store is used and marketing cookies to show you relevant ads. When you first visit, a cookie banner lets you accept, reject or customise non-essential cookies. You can change your choice at any time via the Cookie preferences link in the footer, or by deleting cookies in your browser settings.

9. Children

Our store is not directed at children under 14 and we do not knowingly collect their data.

10. Changes

We may update this policy. The latest version will always be available on this page with its update date.