Privacy Policy
Last updated: June 2026
1. Introduction
At Gala Gulaab, we take the privacy and security of your personal data seriously. This Privacy Policy explains how we collect, use, share, and protect your personal data when you visit galagulaab.com (our "Website"), place an order with us, subscribe to our newsletter, or communicate with us in any way.
This Policy applies to all visitors, customers, and subscribers. Please read it alongside our Terms & Conditions. By using our Website, you acknowledge the practices described here.
2. Data Controller
The data controller responsible for your personal data is:
Gala Gulaab
Email: customercare@galagulaab.com
Website: galagulaab.com
For the purposes of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Spain's Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales ("LOPDGDD"), Gala Gulaab acts as data controller.
3. Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
Website visitors
Device and technical data: IP address, browser type, operating system, and connection information. Behavioural data: pages visited, time on site, referral source, scroll behaviour, and interactions — collected via analytics and session-recording tools.
Customers
Contact and order details: name, email address, delivery address, billing address, and phone number. Order information: products purchased, order history, payment method used, and delivery preferences. Communications: any messages, enquiries, or correspondence you send us. We do not store your payment card details — all payments are processed securely by Shopify Payments or Klarna.
Newsletter subscribers
Email address and engagement data (such as email opens and click activity), managed via Klaviyo.
Contact enquiries
Name, email address, and the content of your message.
We do not collect or process special categories of personal data (such as health, biometric, or ethnicity data).
4. How We Collect Your Data
We collect personal data in the following ways:
Directly from you — when you create an account, place an order, subscribe to our newsletter, or contact us.
Automatically — through cookies and tracking technologies when you browse our Website. Please see Section 9 (Cookies) for more detail.
From service providers — when third parties collect or process data on our behalf in the course of providing services such as analytics, fulfilment, or payment processing.
5. Why We Process Your Data — Purposes and Legal Bases
We process your personal data only where we have a lawful basis to do so under GDPR Article 6. The table below sets out our purposes, the applicable legal basis, and the data involved.
| Purpose | Legal Basis | Data Used |
|---|---|---|
| Processing and fulfilling your order | Contract performance (Art. 6(1)(b)) | Name, address, email, phone, order details |
| Processing payment securely | Contract performance (Art. 6(1)(b)) | Payment method data (processed by Shopify Payments or Klarna) |
| Sending order confirmations and shipping updates | Contract performance (Art. 6(1)(b)) | Email address, order details |
| Arranging delivery via our fulfilment partner | Contract performance (Art. 6(1)(b)) | Name, delivery address |
| Managing returns and refund requests | Contract performance (Art. 6(1)(b)) | Order details, contact details |
| Responding to customer enquiries | Legitimate interest (Art. 6(1)(f)) | Name, email, message content |
| Preventing fraud and ensuring payment security | Legitimate interest (Art. 6(1)(f)) | IP address, payment status, order details |
| Maintaining accounting and legal records | Legal obligation (Art. 6(1)(c)) | Order data, financial data |
| Sending marketing emails (with your consent) | Consent (Art. 6(1)(a)) | Email address, engagement data |
| Website analytics and performance monitoring | Legitimate interest (Art. 6(1)(f)) | Device data, behavioural data |
| Targeted advertising and remarketing (with your consent) | Consent (Art. 6(1)(a)) | Cookie identifiers, behavioural data |
| Session recording and usability analysis | Legitimate interest (Art. 6(1)(f)) | Browsing behaviour, on-site interactions |
| Website security and content delivery | Legitimate interest (Art. 6(1)(f)) | IP address, device data |
Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing that took place before withdrawal.
Where we rely on legitimate interests, we have determined this is appropriate and proportionate to the purposes described. You have the right to object to such processing — see Section 10 (Your Rights).
6. Our Service Providers and Third Parties
We work with a carefully selected group of third-party service providers who may access your personal data in the course of providing their services. All providers are required to process your data only in accordance with applicable data protection law and are subject to contractual obligations regarding its protection.
Shopify
Our Website is built on and hosted by Shopify Inc. Shopify processes order and customer data on our behalf and also acts as an independent data controller in certain contexts. For more on how Shopify handles your data, visit: shopify.com/legal/privacy
Sendcloud
We use Sendcloud to manage order fulfilment and shipping logistics. Your name and delivery address are shared with Sendcloud and the relevant carrier in order to fulfil your order. sendcloud.com/privacy-policy
Klarna
If you choose Klarna as your payment method, certain personal data — including your contact details and order information — will be shared with Klarna to allow them to assess eligibility and process your payment. Klarna acts as an independent data controller for this processing and is solely responsible for its own lending decisions. klarna.com/legal/privacy
Google Analytics & Google Tag Manager
We use Google Analytics, deployed via Google Tag Manager, to understand how visitors interact with our Website. Data collected includes browsing behaviour, device type, and approximate location. This data is used to analyse Website performance and improve the user experience. Google may transfer data to servers in the United States under appropriate safeguards. policies.google.com/privacy
Google Ads (Global Site Tag)
We use Google's advertising tools to measure the performance of our paid marketing campaigns and to serve relevant ads to users who have previously visited our Website. This involves the use of cookies where you have provided consent.
Meta Pixel — Facebook & Instagram
We use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram, and to show relevant ads to users who have visited our Website. We have enabled Meta's Enhanced Conversions feature, which may transmit hashed versions of certain personal data (such as your email address) to Meta to improve ad measurement accuracy. Meta acts as an independent data controller for this processing. facebook.com/privacy/policy
Microsoft Clarity
We use Microsoft Clarity to analyse how visitors interact with our Website through session recordings, heatmaps, and click tracking. This helps us identify usability issues and improve our customer experience. For full details on how Microsoft handles this data, please refer to their privacy statement: privacy.microsoft.com
Klaviyo
We use Klaviyo to manage our email newsletter. If you subscribe, your email address and engagement data will be stored and processed by Klaviyo. You may unsubscribe at any time via the link included in every email, or by contacting us directly. klaviyo.com/legal/privacy-notice
Pandectes GDPR
We use Pandectes to manage cookie consent on our Website. This tool records and stores your consent preferences in accordance with applicable law. pandectes.io/privacy-policy
Cloudflare
We use Cloudflare for website security, performance, and content delivery. Cloudflare may process technical data including your IP address in the course of providing these services. cloudflare.com/privacypolicy
We may in future engage additional service providers or activate additional marketing channels, including platforms such as Pinterest, or SMS marketing. This Policy will be updated accordingly.
7. International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place — such as the European Commission's Standard Contractual Clauses (SCCs) — to ensure that your data is afforded an equivalent level of protection. For more information about how a specific provider handles international transfers, please refer to their privacy policy as linked in Section 6.
8. Data Retention
We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The table below sets out our standard retention periods.
| Data Category | Retention Period |
|---|---|
| Customer and order data | 5 years from date of purchase (Spanish commercial law obligations) |
| Accounting and tax records | 5 years from the relevant financial year |
| Customer service correspondence | 3 years from the date of the enquiry |
| Marketing consents and email lists | 3 years from last interaction, or until consent is withdrawn |
| Website analytics data | 13 months (Google Analytics standard) |
| Session recordings (Microsoft Clarity) | Up to 90 days, in accordance with Microsoft Clarity's standard retention settings |
| Cookie consent records | 2 years from consent or withdrawal |
Upon expiry of the relevant retention period, personal data is securely deleted or anonymised.
9. Cookies
Our Website uses cookies and similar tracking technologies. Cookies are small text files stored on your device that enable certain website functions and help us understand how our Website is used.
We use the following categories of cookies:
Strictly necessary: Essential for the Website to function — for example, maintaining your shopping cart and session. These do not require your consent.
Analytics: Help us understand how visitors interact with our Website, including which pages are visited most frequently. Used by Google Analytics and Microsoft Clarity.
Marketing: Used to measure the effectiveness of advertising and to deliver relevant ads. Used by Meta Pixel and Google Ads tools.
Preference: Used to remember your settings and browsing preferences.
You can review and manage your cookie preferences at any time via our cookie settings tool. You may also adjust cookie settings through your browser, though this may affect certain Website functionality.
10. Your Rights
Under the GDPR and LOPDGDD, you have the following rights in relation to your personal data:
Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request that we correct any inaccurate or incomplete data.
Right to erasure — to request deletion of your personal data, where no legal obligation requires us to retain it.
Right to restriction — to request that we limit how we use your data in certain circumstances.
Right to object — to object to processing based on legitimate interests, or to object to direct marketing at any time.
Right to data portability — to receive your data in a structured, machine-readable format, where processing is based on your consent or a contract.
Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
These rights are not absolute and may be subject to lawful exceptions. We will respond to any request without undue delay and within the timeframe required by applicable law, and at no charge to you.
11. How to Exercise Your Rights
To exercise any of the rights set out above, please contact us at customercare@galagulaab.com. We may ask you to verify your identity before processing your request. We will confirm receipt of your request and respond within the applicable statutory timeframe.
12. Supervisory Authority
If you have concerns about how we handle your personal data, we encourage you to contact us first so that we may address them directly. You also have the right to lodge a complaint with the relevant data protection supervisory authority at any time.
In Spain, this is the Agencia Española de Protección de Datos (AEPD): aepd.es
If you are resident in another EU member state, you may contact your national supervisory authority. A full list is available at: edpb.europa.eu
13. Children's Privacy
Our Website and services are not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with personal data, please contact us at customercare@galagulaab.com and we will delete it promptly.
14. Third-Party Links
Our Website may contain links to third-party websites, including social media platforms. We are not responsible for the privacy practices or content of those websites and we encourage you to review their privacy policies before sharing any personal data with them.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any updates will be posted on this page with a revised date. Where required by applicable law, we will notify you of material changes.
16. Contact
For any questions or concerns regarding this Privacy Policy, or to exercise your rights, please contact us at:
Gala Gulaab
customercare@galagulaab.com
galagulaab.com