Privacy policy
Last updated: 15 October 2026
This policy explains which personal data we process, why, for how long and what your rights are, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018.
Controller
Malala Mar SL · Tax ID B09778291 · Avenida del Golf, 29738 Málaga · contacto@malalastore.com
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling your order: payment, delivery, exchanges and returns | Name, email, phone, address, items bought | Performance of the contract (art. 6.1.b GDPR) | During the relationship and then 6 years for accounting and tax obligations |
| Reserve to try on in the shop | Name, email, phone (optional), reserved item | Your request (art. 6.1.b) and consent (art. 6.1.a) | 12 months |
| "Let me know when it's back" | Email and item | Consent (art. 6.1.a) | Until we send the alert, or 12 months at most |
| New drop alerts | Email and language | Double opt-in consent (art. 6.1.a) | Until you unsubscribe (link in every email) |
| Answering your enquiries | What you send us | Legitimate interest (art. 6.1.f) | As long as needed |
| Withdrawal, complaints and guarantees | Order and request details | Legal obligation (art. 6.1.c) | 6 years |
| Visit statistics (only if you accept) | Aggregated browsing data, no cookies | Consent (art. 6.1.a) | See the cookie policy |
We do not make automated decisions or build profiles, and we never sell or share your data except where required by law. You don't need an account to buy or reserve. This website is intended for people aged 14 and over.
Processors
Supabase (database and images, EU servers), Vercel Inc. (hosting and cookieless statistics, USA, EU-US Data Privacy Framework), Stripe Payments Europe Ltd. (payments, Ireland — we never see your card details), Resend (emails, EU servers, standard contractual clauses) and the courier delivering your order. Transfers outside the EEA rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
You can request access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by emailing contacto@malalastore.com. We will reply within one month. You can unsubscribe from drop alerts with the link in every email. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
The Spanish version of this policy prevails.