Privacy Policy

"Chic & Fabric"is deeply committed to compliance with Spanish and European regulations on the protection of personal data, and guarantees full compliance with the obligations set forth, as well as the implementation of the security measures provided for in the General Data Protection Regulation (GDPR) (EU) 2016/679, of April 27, and in Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD and GDD, hereinafter LOPD).
In accordance with these regulations, we inform you that the use of our website may require certain personal data to be provided through registration or contact forms, or by sending emails, and that these will be processed by “Chic & Fabric”, Data Controller, whose details are:

Company name:: Crafty Labs, SL
Tax ID No.: B39854104
Registered office: C/ Marcelino Sanz de Sautuola, 17 – 39003, Santander, Cantabria - Spain
Contact Us+34 942 415 459
e-mail: [email protected]

Collection and Processing of Personal Data

Personal data is any information concerning a person: name, email address, postal address, telephone number, tax ID number, etc. Additionally, when the User visits our website, certain information is automatically stored for technical reasons, such as the IP address assigned by the User’s internet service provider.
"Chic & Fabric”, as Data Controller, has the obligation to inform Users of its website about the collection of personal data that may be carried out, either by sending an email or by completing the forms included on the website.
Only the necessary data will be obtained to be able to perform the contracted service, or to be able to respond appropriately to the request for information made by the User. The data collected is identifying and corresponds to a reasonable minimum to be able to carry out the activity carried out. In particular, no specially protected data is collected at any time. In no case will the data be used differently than the purpose for which they were collected.

Contact form/ email address

Purpose: To respond to your request for information made through our contact form(s).
Legitimation: The legal basis that legitimizes this processing is the User's consent, which may be revocar at any time.
Data transfer: Personal data will be processed through servers managed by Profesional Hosting or, in the case of contact via email, by Google Ireland, who will be considered Data Processors.

Mailing list subscription forms (newsletter)

Purpose: To send communications, some of them commercial, of interest to the Users according to the website's theme. As established by the LSSICE, “Chic & Fabric" undertakes not to send commercial communications without identifying them as such. For these purposes, information sent to customers to maintain the existing contractual relationship, if any, will not be considered commercial communications.
Legitimation: The legal basis that legitimizes this processing is the User's consent, which may be revocar at any time.
Data transfer: Personal data will be processed through servers managed by Mailchimp, which will be considered the Data Processor.

Data transfer: Personal data will be processed through the servers of this website, managed by Mailchimp, which will be considered as Data Processor.

Appointment booking forms

Purpose: To respond to your appointment booking request submitted through our specific form.
Legitimation: The legal basis that legitimizes this processing is the User's consent, which may be revocar at any time.
Data transfer: Personal data will be processed through servers managed by Profesional Hosting, which will be considered the Data Processor.

Registration/customer sign-up/contracting forms

Purposes:

Manage your User registration on our website.
Manage purchases made.
Provide information about the processing and status of purchases.
Historical record of purchases made on our website.
Comment and content management.
Sending communications via email and/or telephone, in order to inform the User of possible incidents, errors, problems and/or status of orders.
Legitimation: The legal basis that legitimizes this processing is the execution of a contract

Data transfer: “Chic & Fabric"will not transfer or communicate your data to any third party, except in cases provided for by law or when strictly necessary to provide a service. Specifically, the data may be transferred to:

Providers of technological or computer services.
Payment service providers.
Courier and parcel companies.
Third parties or intermediaries, as service providers, operating on our own behalf.

Data transfers will be carried out respecting the strictest confidentiality, using the necessary measures, such as the signing of confidentiality agreements, or adherence to their privacy policies established on their respective websites.

The User may refuse the transfer of their data to the Processors, by written request, through any of the means referenced above.

Furthermore, in some cases when necessary, customers’ data may be transferred to certain bodies in compliance with a legal obligation: Spanish Tax Administration Agency, banking entities, Labour Inspectorate, etc.

Minimum age restriction

Only people over the age of 14 may provide personal data on this website. As required by the Organic Law on Data Protection and Guarantee of Data Rights, in the case of minors under 14 years of age, the consent of their parents or guardians will be a compulsory condition for us to process their personal data.
On the other hand, only people over 18 years old can hire our services. In the case of minors under 18 years of age, the consent of their parents or legal guardians will be a mandatory condition for us to provide the services offered, unless the minor is emancipated.

User Registration

When the User registers through the corresponding form, the information we collect includes:

Full name
Email and / or phone
Shipping addresses
Sector of activity (if it is a company)
IP
Username/Password

The User must also provide a password, which must meet certain security requirements. These passwords do not expire. To recover the password, the User must go to the specific recovery form and enter their email address. To continue the process, they can change it by clicking the link that will be sent to the email address entered. The User is responsible for maintaining the confidentiality of their password, as well as for all uses made of it. They must notify "Chic & Fabric"any unauthorized use of your account or password as soon as possible.
Once registered, the User has access to a private panel, where he/she can view certain content, a record of purchases made, etc. He/she can also manage account options, such as his/her password or User data.
The User may receive the following notifications:

When registering on the platform (account validation email).
When making purchases, such as proof of purchase, incidents, shipments made, etc.
The User receives the store's newsletter if he/she has subscribed to it, from which he/she can unsubscribe in his/her User panel and in the corresponding links included at the bottom of the newsletter.
For comments made, and responses to them.
For password recovery (specified in the previous field).
By unsubscribing or deleting the account.

Security measures

Users of the website are informed of “Chic & Fabric“We have adopted all available technical and organizational security measures to prevent the loss, misuse, alteration, unauthorized access, and theft of data, thus guaranteeing the confidentiality, integrity, and quality of the information contained therein, in accordance with current data protection regulations. The personal data collected in the forms is processed solely by the staff of “Chic & Fabric" or the designated Data Processors.
The Website of “Chic & Fabric” also has SSL encryption, which allows the User to securely send their personal data through the website's contact or registration forms.

Veracity of the data

The User declares that all data provided is true and correct and undertakes to keep it updated. The User shall be responsible for the accuracy of his or her data and shall be solely responsible for any conflicts or disputes that may arise due to the falsity of said data. It is important that, in order for us to keep personal data up to date, the User informs "Chic & Fabric"whenever there has been any modification to them.

Data transfer

"Chic & Fabric"will not transfer or communicate your data to any third party, except in cases provided for by law or when the provision of a service implies the need for a contractual relationship with a Data Processor. Thus, the User accepts that some of the personal data collected may be provided to these Data Processors (payment platforms, management companies, intermediaries, etc.) when necessary for the effective performance of a contracted service or purchased product. The User also accepts that, in the event of providing services, these may be fully or partially subcontracted to other individuals or companies, who will be considered Data Processors, with whom the corresponding confidentiality agreement has been agreed upon, or who have adhered to their privacy policies, established on their respective websites. The User may refuse the transfer of their data to Data Processors by written request, using any of the aforementioned means.
Furthermore, in some cases when necessary, customers’ data may be transferred to certain bodies in compliance with a legal obligation: Spanish Tax Administration Agency, banking entities, Labour Inspectorate, etc.

How a User can exercise their rights

The LOPD and GDD and the GDPR grant data subjects the right to exercise a series of rights related to the processing of their personal data. To do so, the User must contact us by email at [email protected], or by written communication to the address listed in our Legal Notice, providing proper identification. This communication must include the following information: the User's full name, the purpose of the request, their address, and supporting information.
The User must exercise these rights himself/herself. However, they may also be exercised by a person authorised as the User’s legal representative, when documentation attesting to such representation is provided.
The User may exercise the following rights:

Right to request access to personal data, which is the right to obtain information about whether your own personal data is being processed, the purpose of the processing, if any, as well as the information available about the origin of said data and the communications made or planned regarding them.
Right to request rectification, in case the personal data is incorrect or inaccurate, or deletion of data that turns out to be inadequate or excessive.
Right to request the limitation of their processing, in which case they will only be kept by “Chic & Fabric"The data strictly necessary for the exercise or defense of claims.
Right to object to processing: This refers to the right of the interested party to prevent the processing of their personal data or to have it stopped in cases where their consent is not necessary for the processing, which involves commercial prospecting files or files intended to make decisions relating to the interested party based solely on automated processing of their data, unless there are legitimate reasons or the exercise or defense of possible claims that need to be continued.
Right to data portability: if you want your data to be processed by another company,Chic & Fabric” will facilitate the portability of your data in an exportable format.

In the event that consent has been given for a specific purpose, andThe User has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

We are committed to enforcing all these rights within the maximum legal deadline of 1 month.
If a User believes that there is a problem with the way in which “Chic & FabricIf your data is being processed, you can direct your complaints to the Data Protection Officer or the relevant data protection authority, which in the case of Spain is the Spanish Data Protection Agency. The personal data of Users who use the contact form or who send us an email requesting information will be processed for the time strictly necessary to respond to the request, or until it is resolved.evothat the consent granted.
Customers’ personal data will be processed until the end of the contractual relationship. The particular data retention period shall be the minimum necessary, and it may be maintained for:

Four years: Law on Social Infringements and Sanctions, related to obligations in matters of affiliation, contributions, payment of wages; Arts. 4 et seq. General Tax Act (accounting).
Five years: Art. 5 of the Civil Code (personal actions without special deadline).
Six years: Art. 6 of the Commercial Code, related to accounting records and invoices.
Ten years: Art. 10 of the Law on the Prevention of Money Laundering and Financing of Terrorism.
No term: disaggregated and anonymised data.

For its part, the data of Users who subscribe to the newsletter will be kept indefinitely, until they are deleted.evothat the consent granted.

Data retention

Requested information of Users’ personal data collected by contact form or by email will only be used strictly during the time necessary to fulfil the request for information, or until consent is withdrawn. The data of Users who subscribe to our newsletter will be kept indefinitely until the consent granted is withdrawn.
Customers’ personal data will be processed until the end of the contractual relationship. The particular data retention period shall be the minimum necessary, and it may be maintained for:

Four years: Law on Social Infringements and Sanctions, related to obligations in matters of affiliation, contributions, payment of wages; Arts. 4 et seq. General Tax Act (accounting).
Five years: Art. 5 of the Civil Code (personal actions without special deadline).
Six years: Art. 6 of the Commercial Code, related to accounting records and invoices.
Ten years: Art. 10 of the Law on the Prevention of Money Laundering and Financing of Terrorism.
No term: disaggregated and anonymised data.

For its part, the data of Users who subscribe to the newsletter will be kept indefinitely, until they are deleted.evothat the consent granted.

Social Media

"Chic & Fabric" has a profile on some of the main social networks on the Internet (Facebook, Instagram, YouTube, Pinterest). The purpose of data processing by “Chic & Fabric"will be to inform its followers about its activities, using the tools allowed by the social network in question, and to provide personalized customer service. Users should be aware that the use of these social networks is subject to the respective terms of use and privacy policies of the platforms."Chic & Fabric" recommends that Users consult these terms and privacy policies before using the links or applications provided.
In no case "Chic & Fabric"will extract data from social networks, unless the User's express and timely consent has been obtained. In addition, "Chic & Fabric"is not responsible for the privacy practices of these social networks or their applications, especially with regard to confidentiality, processing of personal data, and content.

International Data Transfers

"Chic & Fabric” makes international data transfers by using the following third-party services:

Mailchimp (USA): We use the electronic communications services of The Rocket Science Group, LLC (Mailchimp), located in the United States. This company belongs to the Data Privacy Framework Program, which ensures an adequate level of protection in the processing of your personal data, in accordance with the criteria established by the GDPR.
Vault Blog (India): For backup management, we use the services of Blog Vault, located in India. This company offers adequate protection guarantees by signing standard contractual clauses approved by the European Commission.
Reviews.io (United Kingdom): The review verification services of Reviews.io are used, a company based in the United Kingdom, a country that has been declared to have an adequate level of protection by the European Commission.

Confidentiality

The information provided by the User will, in all cases, be considered confidential, and may not be used for purposes other than those described herein.Chic & Fabric" undertakes not to divulge or reveal information about the User's claims, the reasons for the advice requested, or the duration of its relationship with the User.

Terms of validity

This privacy and data protection policy was drafted on November 27, 2025. It may vary depending on changes in regulations and case law, and it is the responsibility of the data subject to read the updated document in order to know their rights and obligations in this regard at any given time.