Privacy Policy
This English version is provided as a courtesy translation. In the event of any discrepancy or dispute, the Spanish version of this Privacy Policy shall prevail.
At Casa Cordobán we craft every pair of loafers by hand, with patience and care. We treat your personal data with that same care. This policy explains, clearly and without unnecessary fine print, what data we collect when you visit casacordoban.com or place an order, why we use it, how long we keep it, and the rights you have under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is the data controller
The controller of your personal data is the owner of Casa Cordobán:
- Owner: Álvaro García Dolera, trading under the brand name "Casa Cordobán"
- Tax ID (NIF): 23822846K
- Address: Carrer del Comte d'Altea 55, 46005 València, Spain
- Email: alvgar6b@gmail.com
- Website: casacordoban.com
For any matter relating to your personal data, you can write to that email address or reach us through our contact page.
2. What data we collect
We only collect the data we need to assist you and process your orders:
- Identification and contact data: first and last name, email address and, if you provide it, phone number.
- Shipping and billing address: the details needed to deliver your order and issue your invoice.
- Payment data: payments are processed through Shopify Payments (or the express payment wallets you choose). Your card details travel encrypted directly to the payment provider; Casa Cordobán never stores your full card numbers. We only receive confirmation of the payment and, where applicable, the last digits of the card to identify the transaction.
- Order data: products purchased, sizes, amounts, returns and related communications.
- Browsing data: IP address, device and browser type, pages visited and interactions with the store, collected through cookies and similar technologies as described in our Cookie Policy.
All the data we process is provided directly by you or generated by your browsing and purchases; we do not obtain your data from third-party sources. Fields marked as required in our forms are necessary to process your order or enquiry: without them, we will not be able to assist you.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Managing your order: payment, handcrafted production (around 10 days), shipping with a tracking number, delivery and order status communications | Performance of a contract (Art. 6(1)(b)) |
| Handling your enquiries and requests before and after purchase | Pre-contractual measures and performance of the contract (Art. 6(1)(b)) |
| Managing returns, the right of withdrawal and the legal guarantee | Performance of the contract and compliance with legal obligations (Arts. 6(1)(b) and 6(1)(c)) |
| Issuing invoices and complying with our tax, accounting and consumer-law obligations | Compliance with a legal obligation (Art. 6(1)(c)) |
| Keeping the store secure and preventing payment fraud | Legitimate interest in protecting our business and our customers (Art. 6(1)(f)) |
| Producing store usage statistics through Shopify's built-in analytics (non-essential cookies) | Your consent, which you may withdraw at any time from the cookie banner (Art. 6(1)(a)) |
| Sending you commercial communications, only if you expressly authorise us by subscribing | Your consent, revocable at any time (Art. 6(1)(a)) |
We do not make automated decisions that produce legal effects on you, nor do we carry out profiling of that nature. The payment provider may apply automated fraud-prevention checks as part of the secure processing of the transaction.
4. How long we keep your data
We keep your data only as long as necessary for each purpose and, afterwards, duly blocked for the applicable statutory limitation periods:
| Data | Retention period |
|---|---|
| Order, invoicing and payment data | For the duration of the contractual relationship and, once ended, blocked for: 4 years for tax purposes (Art. 66 of the Spanish General Tax Law), 6 years for commercial and accounting records (Art. 30 of the Spanish Commercial Code) and up to 5 years for the limitation period of contractual claims (Art. 1964 of the Spanish Civil Code) |
| Data linked to the legal guarantee of the footwear | For the legal guarantee period applicable to new goods (3 years from delivery, under Spanish Royal Decree-Law 7/2021) and the related claim periods |
| Enquiries and communications not resulting in an order | As long as necessary to handle them and, at most, 1 year from the last communication |
| Data processed on the basis of your consent (analytics, commercial communications) | Until you withdraw your consent |
| Browsing data and cookies | The specific lifespan of each cookie is detailed in the Cookie Policy |
5. Who we share your data with
We do not sell or transfer your data to third parties for commercial purposes. Your data is only shared with, or processed on our behalf by, the providers that are essential for your order to reach you:
- Shopify (Shopify International Ltd., Ireland, and Shopify Inc., Canada): the technology platform hosting the store, including transactional order notifications. It acts as data processor under its data processing agreement.
- Shopify Payments and its associated financial institutions and payment wallet providers: secure payment processing. They receive your payment data directly, without it passing through our systems.
- Shipping and courier companies in charge of delivery: they receive your name, shipping address and contact details, strictly to deliver your order and provide tracking.
- Google (Google Ireland Ltd.): provider of the email service (Gmail) through which we handle enquiries, and therefore processes the data contained in the messages you send us.
- Public authorities, courts and tribunals, where we are under a legal obligation to provide information.
6. International data transfers
Some of our providers process data outside the European Economic Area, always with the safeguards required by the GDPR:
- Shopify Inc. (Canada): Canada benefits from an adequacy decision of the European Commission for organisations subject to its federal data protection law (PIPEDA), allowing transfers with a level of protection equivalent to the European one.
- United States — U.S. entities of the Shopify group and their sub-processors: transfers are based on the standard contractual clauses approved by the European Commission, with supplementary measures where appropriate.
- United States — Google LLC: transfers are based on the EU-U.S. Data Privacy Framework, under which Google LLC is certified.
You may request further information about these safeguards at alvgar6b@gmail.com.
7. Your rights
You may exercise the following GDPR rights at any time, free of charge:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to ask us to delete your data when it is no longer necessary.
- Objection: to object to processing based on legitimate interest.
- Restriction: to ask us to temporarily suspend the use of your data in the cases provided by law.
- Portability: to receive your data in a structured, commonly used format, or to have it transmitted to another controller.
- Withdrawal of consent: to revoke any consent given, at any time, without affecting the lawfulness of prior processing.
How to exercise them
Write to us at alvgar6b@gmail.com with the subject line "Data protection", stating the right you wish to exercise and some detail that allows us to identify you (for example, the email address you used for your order). If we have reasonable doubts about your identity, we may ask for additional information to verify it. We will reply within one month of receiving your request.
You can also manage your data-sharing preferences for this store on the Your privacy choices page.
8. Right to lodge a complaint with the AEPD
If you believe we have not processed your data in accordance with the law, we would appreciate you contacting us first so we can resolve it. In any event, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), the supervisory authority in Spain: www.aepd.es.
9. Minors
Casa Cordobán does not direct its store or its communications to children under 14 years of age, and we do not knowingly collect data from children under that age, which under Art. 7 of the LOPDGDD would require the consent of their parents or guardians. If we become aware that we have collected data from a child under 14 without such consent, we will delete it. If you are a parent or guardian and believe a minor has provided us with data, please write to alvgar6b@gmail.com.
10. Cookies
We use essential first-party cookies and, only with your consent, Shopify's built-in analytics cookies. You can find the full list, their lifespans and how to accept, reject or configure them in our Cookie Policy and in the store's privacy banner.
11. Changes to this policy
We may update this policy when the law or our processing activities change (for example, if we add new providers). The current version will always be published on this page, with its update date. We recommend reviewing it from time to time.
Última actualización / Last updated: 24 de agosto de 2026