Privacy policy
Last updated: May 2026
Controller: Pamuk Studio S.L, CIF/VAT: ESB27664994, Carrer d'Alcolea 58, 08014 Barcelona, Spain. Contact: info@pamuuc.com
This Privacy Policy explains how we collect, use and protect personal data on pamuuc.com, our online store, customer service channels, email communications and related customer touchpoints in the European Union. If you do not agree with this Policy, please do not provide your data and stop using our Website.
1. Who We Are
The data controller responsible for your personal data is Pamuk Studio S.L, CIF/VAT: ESB27664994, with registered address at Carrer d'Alcolea 58, 08014 Barcelona, Spain. You can contact us at info@pamuuc.com.
2. Types of Personal Data We Collect
- Identity and contact data: name, surname, email address, phone number, billing address and delivery address.
- Account data: account login details, password, saved preferences and account activity.
- Order and delivery data: products purchased, order number, order history, payment status, delivery details, return information, refund information and customer notes linked to an order.
- Payment data: payment details are handled by our payment providers. We do not store full card numbers on our own systems.
- Customer support data: messages, requests, complaints, return requests, warranty or defect claims, and related communications.
- Technical data: IP address, device type, browser type, operating system, language settings, approximate location, server logs and website interaction data.
- Marketing data: newsletter subscription status, email preferences, consent records, opt out records, campaign interactions and similar communication data.
- Cookies and similar technologies: essential cookies for the Website to work and, with your consent, analytics, advertising or performance cookies. See our Cookie Policy.
3. How We Use Your Data and Legal Bases
| Purpose | Examples | Legal basis | Typical retention |
|---|---|---|---|
| Account creation and management | Create and manage your account, save preferences, allow access to order history | Contract | Active account plus up to 3 years after last activity, unless a longer period is required by law |
| Orders, payments and delivery | Process purchases, prepare orders, manage shipping, returns, refunds and warranty requests | Contract; legal obligation for invoicing, accounting and tax records | Invoices, accounting and order data kept for up to 6 years where required by commercial and tax laws |
| Pre-orders | Manage weekly production batches, order confirmations, production updates and dispatch notifications | Contract | Order data kept for the same period as standard order records |
| Customer support | Answer questions, handle complaints, manage size or order queries, review defect claims | Contract; legitimate interests to provide and improve customer service | Up to 3 years from closure, unless a longer period is needed for legal claims |
| Legal guarantee and disputes | Assess defective items, manage warranty remedies, defend or exercise legal claims | Legal obligation; legitimate interests | For the applicable legal guarantee period and limitation periods |
| Security and fraud prevention | Protect the Website, prevent abuse, detect suspicious activity, secure transactions | Legitimate interests | Security logs usually kept up to 12 months, unless needed longer for investigation or legal reasons |
| Analytics | Understand website performance, traffic, user behaviour and store improvements | Consent where cookies or similar technologies are used | Analytics data typically kept up to 13 months, or as stated in our Cookie Policy |
| Advertising and remarketing | Pixels, custom audiences, campaign measurement and performance advertising | Consent where cookies, pixels or similar technologies are used | As stated in our Cookie Policy and in the settings of each advertising provider |
| Email marketing | Newsletters, product updates, offers, brand news and similar communications | Consent; or soft opt in for our own similar products where legally permitted, with immediate opt out | Until you unsubscribe or object. Proof of consent and opt out records may be kept up to 5 years |
| Compliance and record keeping | Tax, accounting, regulatory, consumer protection and business records | Legal obligation; legitimate interests | As required by law or applicable limitation periods |
4. Cookies and Similar Technologies
We use cookies and similar technologies. Essential cookies are used to make the Website work, keep items in your cart, manage checkout and protect the store. These cookies do not require consent.
We only set non essential cookies, such as analytics, advertising or remarketing cookies, with your consent through our cookie banner. The banner allows you to accept, reject or manage choices. You can withdraw or change your consent at any time through Cookie Settings. See our Cookie Policy for full details.
5. Email Marketing
You can subscribe to our email marketing to receive brand news, product updates, collection information and offers. You can unsubscribe at any time by using the unsubscribe link in our messages or by contacting us at info@pamuuc.com.
If you have purchased from us, we may contact you about our own similar products where this is permitted by applicable law. You can opt out at the point of collection and in every message.
6. Sharing Your Data
We share personal data only when necessary for the purposes described in this Policy. We may share data with service providers acting on our instructions, including:
- store platform and hosting providers;
- payment processors and fraud prevention tools;
- parcel carriers, fulfilment partners and return service providers;
- email marketing and customer communication tools;
- analytics and advertising partners, where you have consented where required;
- professional advisers, accountants, legal advisers and public authorities where required by law.
These providers may only use the data to provide their services to us and must protect it appropriately. We do not sell your personal data.
7. International Data Transfers
Some of our providers may process personal data outside the European Economic Area. Where the recipient is in a country recognised by the European Commission as providing an adequate level of protection, we rely on that adequacy decision.
Where the recipient is in the United States and participates in the EU U.S. Data Privacy Framework, we may rely on the European Commission's adequacy decision for certified organisations. In other cases, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, where needed, additional measures. You can contact us for more information about the relevant safeguards.
8. How Long We Keep Data
We keep personal data only for as long as needed for the purpose for which it was collected, including to meet legal, accounting, tax, consumer protection or dispute management requirements. Key retention periods are listed in the table above.
When data is no longer needed, we delete it, anonymise it or securely restrict access until deletion is possible.
9. Your Rights
Under data protection law, you may have the following rights:
- Access: to know whether we process your personal data and receive a copy of it.
- Rectification: to correct inaccurate or incomplete personal data.
- Erasure: to ask us to delete your personal data where legally possible.
- Restriction: to ask us to restrict the use of your data in certain cases.
- Portability: to receive certain data in a structured, commonly used and machine readable format.
- Objection: to object to processing based on legitimate interests, including direct marketing.
- Withdraw consent: to withdraw consent at any time where consent is our legal basis.
- Not to be subject to certain automated decisions: where applicable under data protection law.
You can exercise your rights by contacting us at info@pamuuc.com. We respond within one month from receiving your request. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. If we need to extend the period, we will inform you within one month and explain the reason.
We do not charge a fee unless a request is manifestly unfounded, excessive or repetitive. We may ask for additional information to verify your identity before responding.
10. Children
We do not target minors. In Spain, consent for information society services can generally be given by minors aged 14 or older. For children under 14, consent must be given by the holder of parental responsibility where consent is the legal basis.
If we learn that we have collected personal data from a child who cannot lawfully give consent, we will delete the data where required and ask the holder of parental responsibility to contact us.
11. Security
We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, secure service providers, restricted internal access and security practices adapted to the nature of the data we process.
No online service is completely risk free. If you believe your account or personal data has been affected by a security issue, please contact us at info@pamuuc.com.
12. Complaints
You can contact us at any time at info@pamuuc.com. You also have the right to lodge a complaint with the Agencia Española de Protección de Datos or with your local EU data protection authority.
Before submitting a complaint about the exercise of your rights, the Spanish Data Protection Authority generally expects you to have contacted the controller first by a means that allows you to prove the request was made.
13. Changes to This Policy
We may update this Policy from time to time to reflect legal, technical or business changes. We will post the new version on this page and update the Last updated date.
