SantaPaws Privacy Policy

Last updated: August 31, 2026

This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from santapaws.store (hereinafter, the “Site”).

Data Controller: SantaPaws, with its registered address at Calle San Vicente de Paúl, Granada, GR, 18008, Spain. You can contact us at devolucionestienda38@gmail.com for any questions regarding this policy or your personal data.

1. Personal Information We Collect

Device Information

When you visit the Site, we automatically collect certain information about your device, including your web browser, IP address, time zone, and some of the cookies installed on your device. As you browse the Site, we also collect information about the individual web pages or products you view, the websites or search terms that referred you to the Site, and information about how you interact with the Site. We refer to this automatically collected information as “Device Information.”

We collect this information using:

• Log files: These track actions occurring on the Site and collect data such as IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.

• Cookies: These are text files placed on your device. We currently use the following Shopify platform cookies:

Cookie	Purpose	Duration
_session_id	Stores session information (referrer, landing page, etc.)	Session
_shopify_visit	Records the number of visits	30 minutes
_shopify_uniq	Counts visits from the same customer	Until midnight of the following day
cart	Stores the contents of your shopping cart	2 weeks
_secure_session_id	Secure session	Session
storefront_digest	Determines access if the store is password protected	Indefinite

We do not currently use advertising pixels or third-party retargeting tools (such as Meta/Facebook Ads or TikTok Ads). If this changes in the future, we will update this policy and identify the relevant tools before activating them.

Order Information

When you make or attempt to make a purchase through the Site, we collect your name, billing address, shipping address, payment information (securely processed by our payment gateway; we do not store complete card numbers on our servers), email address, and phone number. We refer to this information as “Order Information.”

When we refer to “Personal Information” in this Privacy Policy, we are referring to both Device Information and Order Information.

2. How We Use Your Personal Information

We use Order Information to:

• Process and fulfill your orders, including payment, shipping, billing, and order confirmations.

• Communicate with you regarding your order or inquiries.

• Screen orders for potential fraud or risks.

• Comply with our legal and tax obligations.

We use Device Information to:

• Detect potential risks and fraud.

• Improve and optimize the Site through usage statistics.

• Evaluate Site performance and your browsing experience.

3. Sharing Your Personal Information

We share your Personal Information only with third parties that help us operate the Site and provide our services, including:

• Shopify, our e-commerce platform. More information: https://www.shopify.com/legal/privacy

• Google Analytics, to understand how the Site is used. More information: https://policies.google.com/privacy. You can opt out here: https://tools.google.com/dlpage/gaoptout

• Our logistics provider, to manage the shipment and delivery of your order.

• Our payment gateway, to securely process payments.

We may also share your Personal Information when necessary to comply with applicable laws, respond to a subpoena or court order, or protect our legal rights.

We do not sell your Personal Information to third parties for advertising purposes.

4. Do Not Track

We currently do not alter our data collection practices when we detect a “Do Not Track” signal from your browser.

5. Minors

The Site is not intended for individuals under the age of 16. We do not knowingly collect Personal Information from individuals under this age. If you become aware that a minor has provided us with Personal Information, please contact us so that we can delete it.

6. Your Rights — Residents of the European Union / European Economic Area

If you are a resident of the EU/EEA, under the General Data Protection Regulation (GDPR), you have the right to:

• Access the Personal Information we hold about you.

• Rectify inaccurate or incomplete information.

• Delete your Personal Information (the “right to be forgotten”).

• Object to the processing of your Personal Information for direct marketing purposes or where processing is based on legitimate interests.

• Restrict the processing of your Personal Information in certain circumstances.

• Data portability: Receive your Personal Information in a structured format and transmit it to another data controller.

• Withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at devolucionestienda38@gmail.com. We will respond within a maximum period of one month, in accordance with applicable regulations.

We process your Order Information for the performance of the sales contract entered into with you, and your Device Information based on our legitimate interest in maintaining the security and proper functioning of the Site.

If you believe that we have not properly addressed your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — https://www.aepd.es — or with the data protection authority in your country of residence.

Your information may be transferred to and processed outside the EEA, including in Canada and the United States, through the providers mentioned in Section 3, which implement appropriate safeguards under the GDPR, such as Standard Contractual Clauses.

7. Your Rights — California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what categories of Personal Information we collect and the purposes for which it is used.

• Request the deletion of your Personal Information.

• Request that your Personal Information not be shared for advertising purposes.

• Not be discriminated against for exercising these rights.

We currently do not sell or share your Personal Information with third parties for targeted advertising purposes, and we do not use retargeting pixels. If this changes, we will update this section and provide a mechanism allowing you to opt out through a “Do Not Sell or Share My Personal Information” mechanism.

To exercise these rights, please contact us at devolucionestienda38@gmail.com.

8. Data Retention

We retain your Order Information for as long as you maintain a commercial relationship with us and, thereafter, for the period required by Spanish commercial and tax regulations (generally, up to 6 years from the date of the last transaction, in accordance with the Spanish Commercial Code and applicable tax regulations).

Once this period has expired, your Personal Information will be deleted or anonymized, unless another legal obligation requires us to retain it for a longer period.

9. Data Security

We implement reasonable technical and organizational measures to protect your Personal Information against unauthorized access, loss, misuse, or alteration. However, no system for transmitting or storing data can be guaranteed to be 100% secure.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We recommend reviewing this policy periodically. The “Last updated” date at the beginning of this document indicates the current version of the policy.

11. Contact Us

For any questions, requests regarding your Personal Information, or to submit a complaint, you can contact us at:

Email: devolucionestienda38@gmail.com

Postal Address: Calle San Vicente de Paúl, Granada, GR, 18008, Spain