Privacy policy

At Nooki we take your data seriously. This policy explains what information we collect, what we use it for and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD).

1. Data controller

Controller: VALUANT ADVISORY GROUP, S.L. (trading name: Nooki)
NIF: [PENDIENTE DE COMPLETAR]
Address: [PENDIENTE DE COMPLETAR]
Data protection contact: privacidad@nooki.es

2. What data we process and why

Purpose	Data	Legal basis	Retention
Managing your order, payment and delivery	First name, surname, delivery and billing addresses, email, phone, payment data (processed by the payment gateway)	Performance of a contract (art. 6.1.b)	For the duration of the relationship and, afterwards, the limitation period; 6 years for accounting and tax purposes
Customer service and after-sales	Contact details and the content of your enquiry	Performance of a contract and legitimate interest (art. 6.1.b and 6.1.f)	3 years from the last contact
Marketing communications (newsletter)	Name and email	Consent (art. 6.1.a) or legitimate interest in offering similar products to customers (art. 21.2 LSSI)	Until you unsubscribe
Review request after purchase	Name, email, order	Legitimate interest (art. 6.1.f)	Until you unsubscribe or 3 years
Analytics, measurement and personalised advertising	Device identifiers, cookies, browsing and purchase events	Consent given in the cookie banner (art. 6.1.a)	According to the lifespan of each cookie (see Cookie policy)
Fraud prevention and security	IP address, order and device data	Legitimate interest and legal obligation (art. 6.1.f and 6.1.c)	As long as necessary for the purpose
Product safety (GPSR) and traceability	Order and contact details	Legal obligation (art. 6.1.c)	6 years (traceability) / 10 years (technical documentation)

3. Who receives the data

We only share data with the providers needed to deliver the service to you, who act as processors under contract:

Shopify International Ltd. — e-commerce platform and hosting.
Payment gateways (Shopify Payments / Stripe, PayPal, Bizum through the acquirer). Nooki does not store full card details.
Logistics and fulfilment providers, to prepare and deliver your order. When a shipment comes from a supplier outside the EU, only the data strictly necessary for delivery is passed on.
Email marketing and customer service providers.
Analytics and advertising providers (Google, Meta, TikTok), only if you have given your consent.
Public authorities and administrations, where there is a legal obligation.

4. International transfers

Some providers are located outside the European Economic Area. In those cases, transfers are covered by adequacy decisions of the European Commission (for example, the EU-U.S. Data Privacy Framework) or by Standard Contractual Clauses, together with supplementary measures. You can ask us for a copy of the safeguards in place by writing to privacidad@nooki.es.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated decisions at any time, and you can withdraw your consent at any time without affecting the lawfulness of processing carried out beforehand.

Write to privacidad@nooki.es stating which right you want to exercise. We'll reply within one month at the latest. If you believe we haven't handled your request properly, you can lodge a complaint with the Agencia Española de Protección de Datos (aepd.es).

6. Children

Nooki sells products for children, but to adults. This site isn't aimed at children under 14 and we don't knowingly collect their data. If we find that a child's data has been provided without the consent of the holder of parental responsibility or guardianship, we'll delete it.

7. Security

We apply appropriate technical and organisational measures to protect your data, including an encrypted connection (HTTPS/TLS), access control and data minimisation.