Privacy Policy

1. Data Controller

The controller responsible for the processing of personal data is:

Eighteen & Beyond
Email: [email protected]
Website: www.eighteenandbeyond.com

2. Purpose of Processing

The Personal Data we collect is exclusively used for the following purposes:

• Carrying out obligations from contracts entered into between you and us, and providing you with products, services, and information you request, including managing and handling your requests, inquiries, or complaints.
• Advertising our products and services, contacting you via email, regular mail, social media, or otherwise for direct marketing or other commercial purposes.
• Analysing and improving the quality of our products and services, such as providing customer services and aftersales, and understanding you as a customer.
• Targeting you with advertisements or marketing materials customised to your personal preferences and experiences.

We may also use your Personal Data for our other legitimate commercial interests, such as to:

• Operate and expand our business activities
• Develop, improve, or modify our products and services
• Protect and defend our (and others’) rights, property, or safety
• Prevent abuse and fraud related to the online sale of our products
• Generate aggregated statistics about the users of our products and services
• Facilitate our business operations
• Operate company policies and procedures

You can withdraw your consent at any time (see “Your Rights” below).

Any Personal Data we collect may be used to comply with a legal obligation to which we are subject, such as supervisory bodies, fiscal authorities, or investigation bodies.

3. Categories of Personal Data

We may collect:

• Contact details (name, surname, postal address, email address, telephone number)
• Order information
• Communication history
• Technical browsing data, IP address, and device information
• Data shared during raffles, contests, or promotional campaigns
• Ratings, reviews, and feedback

4. Legal Basis for Processing

Processing is based on:

• User consent
• Performance of a contract
• Compliance with legal obligations
• Legitimate business interests

5. Retention Period

Personal data will be retained only for as long as necessary to fulfil the purposes described in this policy and to comply with applicable legal requirements, unless a longer period is required to defend a legal claim.

6. Recipients

Personal data may be shared with:

• Payment service providers
• Marketing, media companies, and email communication providers
• Professional advisers and business partners
• Public authorities where legally required
• Other third parties, where your consent has been given

Our contracts with service providers do not permit use of your Personal Data for their own marketing purposes. Personal data will never be sold to third parties.

7. International Transfers

Where personal data is transferred outside the European Economic Area, appropriate safeguards required by the GDPR are implemented in every applicable jurisdiction.

8. Data Subject Rights

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent at any time

Requests may be sent to: [email protected]

9. Security Measures

Appropriate technical and organisational measures are implemented to protect personal data against unauthorised access, disclosure, alteration, or destruction.

10. Minors

The website is not intended for children under 14 years of age without parental or guardian consent.

11. Complaints

Users may lodge a complaint with the Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
Website: www.aepd.es

12. Updates

This Privacy Policy may be updated from time to time. The latest version will always be available on this website.