Privacy Policy
Last updated: March 2026
1. Data controller
In accordance with Regulation (EU) 2016/679 of the European Parliament (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD, the Spanish data protection act), we inform you that the controller of your personal data is:
- Name: Aizüa
- Activity: E-commerce and consulting/training services
- Email: info@aizualabs.com
- Website: https://beauty.aizualabs.com
2. Data we collect
We collect the following types of personal data:
- Identification data: first name, surname, shipping address.
- Contact data: email address, phone number (optional).
- Payment data: handled entirely by Stripe. We do not store card details.
- Browsing data: IP address, browser type, pages visited (technical and analytics cookies).
- Order data: purchase history, shipping status, tracking number.
3. Purpose and legal basis for processing
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Order and shipping management | Art. 6.1.b — Performance of a contract |
| Customer service and returns | Art. 6.1.b — Performance of a contract |
| Compliance with tax obligations | Art. 6.1.c — Legal obligation |
| Sending commercial communications (newsletter) | Art. 6.1.a — Consent |
| Website usage analysis | Art. 6.1.f — Legitimate interest |
4. Retention period
We keep your data for as long as necessary to fulfil the purpose for which it was collected:
- Order data: 5 years (tax and accounting obligations).
- Newsletter data: until you withdraw your consent.
- Browsing data: as set out in the cookie policy (max. 13 months).
- Customer service data: 3 years from the last interaction.
5. Recipients and international transfers
Your data may be disclosed to the following third parties in order to provide the contracted services:
- Stripe Inc. (payment gateway) — international transfer covered by standard contractual clauses.
- Logistics providers — shipping address for delivery of your order.
- Brevo / Resend (transactional email) — name and email for order confirmations.
- Vercel (hosting) — browsing data stored on EU servers.
- Supabase (database) — order and customer data, EU servers.
We do not sell or disclose your personal data to third parties for their own commercial purposes.
6. Your rights
Under the GDPR, you have the right to:
- Access: find out what personal data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure (the “right to be forgotten”): request the deletion of your data.
- Restriction: ask us to restrict the processing of your data.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, write to us at info@aizualabs.com stating your name and your request. We will reply within a maximum of 30 days.
If you believe the processing of your data does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
7. AI conversational assistant
This website includes a conversational assistant based on artificial intelligence. When you use it, we process the messages in the conversation and any contact details you voluntarily provide (name, email, phone).
- Purpose: to handle your enquiry, follow up on it and, where applicable, prepare a quote.
- Legal basis: the taking of steps at your request prior to entering into a contract — writing in the chat is that request — and our legitimate interest in handling and following up on the enquiries we receive (GDPR art. 6.1.b and 6.1.f). Consent is not requested because it is not the applicable basis; you may object to the processing at any time.
- Retention: 12 months from the last message, unless it leads to an order, in which case the periods in section 4 apply.
- Processors: the assistant relies on language-model providers acting as data processors, some located outside the European Economic Area, with the safeguards set out in Chapter V of the GDPR (see section 5).
- No automated decision-making: the assistant informs you and hands over to a person; it does not take automated decisions producing legal effects concerning you (GDPR art. 22).
Do not enter passwords, bank or card details, or health data or other special categories of data into the chat. The assistant is instructed not to request or process them.
8. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration. Payment data is handled exclusively by Stripe (PCI DSS certified), and we never store credit card information on our systems.
9. Cookies
We use first-party and third-party cookies. For more information, see our Cookie Policy.
10. Changes
We reserve the right to amend this Privacy Policy to adapt it to legislative or business changes. We will inform you of significant changes by email or through a visible notice on the Site. The version in force will always be available on this page.