Privacy policy
Updated: 16 October 2026
Owner: Jessica Fernández Quirós
Spanish tax ID (NIF): 29208796S
Trading name: La Boutique de AyA
Address: Carrer Sant Nicolau 12, 46550 Albuixech, Valencia, España
Email: info@laboutiquedeaya.com
Telephone: +34 686 140 859
Controller and scope
Jessica Fernández Quirós, trading as La Boutique de AyA, is the controller for processing carried out to operate this store and manage customer relationships. Identification and contact details are provided below. This policy covers browsing, enquiries, purchases, accounts, reviews and loyalty services on laboutiquedeaya.com.
Data and sources
We receive the information you provide when buying, creating an account, subscribing, contacting us or posting a review: name, contact details, shipping and billing address, order information, messages and preferences. Payment providers send us transaction status and references; full card details are entered in the payment provider’s systems and must not be sent by email or WhatsApp. We also receive delivery information from carriers and technical information such as browser data, IP address, identifiers and browsing activity, depending on the feature used and your privacy preferences. Loyalty and review services use the information you submit and the purchase information necessary to provide that service.
Purposes and legal bases
Orders, payments, deliveries, purchase support, exchanges and returns: performance of a contract and steps you request before entering into it. Invoicing, tax obligations and responses to authorities: legal obligations. Other enquiries and protecting the store against abuse: our legitimate interests in responding and operating securely, balanced against your rights. Newsletter subscriptions and marketing: consent; the statutory exception for existing customers and similar products applies only if its requirements and an easy opt-out are met. Unsubscribe in each message or contact us. Declining marketing does not prevent purchases. Participation in Estrellas AyA is processed to provide the service requested; promotional messages need a separate legal basis. Voluntarily publishing reviews and images is based on your permission; purchase checks aim to protect review authenticity. Analytics and advertising using non-exempt technologies require consent.
Providers and recipients
We use Shopify for the platform, hosting, accounts, orders, forms, messages and automation; Correos and the assigned carrier for deliveries or collections; Shopify Payments, PayPal, MONEI or Alma for the payment method you choose; Judge.me for reviews; BON Loyalty for Estrellas AyA; and tools such as Vitals, Releasit and Make for store features, cash on delivery and integrations involved in the service used. Providers receive the data needed for their role. Processors acting on our behalf are subject to their processing agreements; payment providers, carriers and other providers may act as independent controllers for some of their own obligations. Depending on your preferences and the service settings, Google and Meta may be involved in measurement, advertising or channels such as WhatsApp. Authorities, courts and professional advisers may also receive information where legally required or needed to manage and defend claims. Ask us for information about recipients of a particular processing activity.
Shopify Network Intelligence and third-party services
Shopify Network Intelligence is enabled on this store. Shopify may combine interactions with this store and other merchants to improve, personalise and market its services, including advertising targeting, under its terms and applicable privacy preferences. Shopify acts as controller for those purposes of its own. Its policy explains the purposes, legal bases and choices. The Shopify consumer privacy policy and privacy portal are linked below. Payment providers decide their own security checks and, where relevant, eligibility for instalment payments; their terms describe their processing and any automated assessments. AyA is not the provider granting that financing.
International transfers
Although Shopify shows primary data hosting in the European Union for this store, this does not mean every provider, support access or subprocessor is located in the European Economic Area. Shopify and some providers may process data in other countries. Depending on the recipient, applicable safeguards include European Commission adequacy decisions or standard contractual clauses and any necessary supplementary measures. Shopify and Judge.me explain their transfers and safeguards in their documentation. Contact us for information and a copy or reference to safeguards applicable to your data. Shopify also documents binding corporate rules for certain transfers within its group.
Retention
Purchase data are kept while fulfilling the order and for the periods needed for guarantees and claims. Business and accounting documents are retained for statutory periods, generally six years from the last entry, without prejudice to longer legal requirements. Account and loyalty data remain while the relationship continues and they are needed for the service; erasure does not remove documents we must legally retain. Enquiries are kept until resolved and, where relevant, during liability periods. Subscriptions remain until you unsubscribe or withdraw consent; evidence of consent and a minimal suppression record may be kept to respect your choice. Reviews remain while published, subject to your rights. Cookie data depend on their lifetime and your preferences. Once use ends, data are deleted or restricted and retained where required by law.
Cookies and preferences
Open “Configure cookies” to manage analytics and marketing or reject unnecessary options. Browsing, buying or accepting terms does not amount to consenting to non-exempt cookies. This policy does not replace the information in the panel or authorise processing that needs consent when no consent has been given. Changes apply to future use and do not affect earlier lawful processing.
Your rights
Where applicable, request access, rectification, erasure, objection, restriction and portability, or withdraw consent, by emailing info@laboutiquedeaya.com or writing to the address below. You can also request information and safeguards concerning solely automated decisions with legal or similarly significant effects, including human intervention where the law provides for it. Additional identity information will be requested only when necessary and proportionate. The normal response period is one month; we will inform you of any extension permitted by law due to complexity or the number of requests. You may complain to the Spanish Data Protection Agency, www.aepd.es, or the competent supervisory authority where you live.
Required data, children and publications
Fields needed to process purchases or deliver orders are required to provide those services. Subscriptions, reviews and images are voluntary. The store is intended for people with legal capacity to contract; purchases for children must be made by their representatives or authorised persons. For sizing enquiries, provide only essential information and avoid unnecessary identifying details or images of children. Do not post other people’s information or images without appropriate permission. Your chosen display name and review content may be public.
Updates and contact
We update this policy when processing or legal requirements change and communicate important changes appropriately. Publishing an update does not replace obtaining consent where necessary. For personal-data enquiries, use the contact details provided here.