Privacy Policy

Last updated: 20 April 2026

At Boya Porcelana ("Boya", "we") we care about your privacy and want to be clear about what data we collect, why we collect it, and what you can do with it.

This policy applies to the website boyaporcelana.com and all services we offer through it: online shop, workshop registrations, newsletter and commercial communications. It is drafted in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

---

1. Data controller

• Owner: Bojana Brkić (self-employed / autónoma)
• NIE: Z3469197-C
• Address: Carrer de la Reina Na Germana, 7, L'Eixample, 46005 València, Spain
• Email: studio@boyaporcelana.com
• Phone: +34 664 29 88 68

2. What data we collect

We only collect the data we need to provide our services, comply with legal obligations and improve your experience.

Data you provide to us:

• first and last name
• shipping and billing address
• email address
• phone number
• order data (products, quantity, amount)
• payment data (processed by secure payment gateways; we do not store card numbers)
• the content of your messages when you write to us
• workshop registration data

Data we collect automatically:

• IP address
• device type, operating system and browser
• pages visited and time spent on them
• traffic source (campaign, social network, search engine)
• advertising and cookie identifiers

3. Purposes and legal bases

Performance of a contract (Art. 6.1.b GDPR)

• processing and shipping your orders
• managing returns and complaints
• managing your registration and participation in workshops

Compliance with legal obligations (Art. 6.1.c GDPR)

• issuing invoices
• accounting and tax obligations
• consumer rights compliance

Legitimate interest (Art. 6.1.f GDPR)

• website security and fraud prevention
• statistical analysis of website usage to improve our services

Consent (Art. 6.1.a GDPR)

• sending the newsletter and commercial communications
• non-essential cookies and similar technologies
• personalised advertising on digital platforms (see section 4)

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Advertising on digital platforms

If you give us your consent, we process your data to show you relevant advertising on social networks, search engines and other external websites. This is one of the more sensitive purposes, so we want to explain it in detail.

What data we use for this:

• cookie and device identifiers
• your email address and other identifiers, in hashed (encrypted) form
• information about products you have viewed, added to the cart or purchased
• browsing data on our website (pages visited, time spent, interactions)

What we use it for:

• showing our ads on social networks, search engines and other advertising platforms where you are present
• creating custom audiences of customers and website visitors
• creating lookalike audiences to reach people with profiles similar to yours
• remarketing, i.e. showing you again products you have shown interest in
• measuring the effectiveness of our campaigns and conversions

Platforms we share this information with:

• Meta Platforms Ireland Ltd. (Facebook and Instagram)
• Google Ireland Ltd. (Google Ads, YouTube)
• Pinterest Europe Ltd.
• TikTok Technology Ltd.
• LinkedIn Ireland Unlimited Company

The list of platforms may change over time. The complete and updated list, along with the specific cookies and tracking technologies used, is published in our Cookie Policy, which we recommend you consult.

For some of these platforms (in particular Meta, through its pixel) we act as joint controllers for certain processing operations, in accordance with Article 26 GDPR. Each platform also has its own privacy policy.

You can withdraw your consent for this type of advertising at any time from the cookie panel or by writing to us at studio@boyaporcelana.com. If you do, you may still see generic ads from us, but not personalised ones.

5. Recipients of the data

We do not sell your data. We share it only with trusted providers who help us deliver our service, and only to the extent strictly necessary:

• Shopify Inc.: platform for our online shop and sales analytics
• Courier and logistics companies: for delivering orders (name, address, phone number)
• Payment gateways: to process payments securely
• Mailchimp (Intuit Inc.): for sending the newsletter, if you are subscribed
• Google LLC: for web traffic analytics (Google Analytics) and advertising (Google Ads)
• Meta Platforms Ireland Ltd.: for advertising on Facebook and Instagram (Meta Pixel)
• Other advertising platforms: detailed in section 4 and the Cookie Policy
• Accounting and tax advisors: to comply with legal obligations
• Public authorities: when required by law

We have signed the corresponding processing agreement with all data processors, in accordance with Article 28 GDPR.

6. International transfers

Some of our providers (Shopify, Google, Meta, Mailchimp, TikTok) may process data outside the European Economic Area, including the United States and other countries. These transfers are made with the appropriate safeguards:

• adequacy decisions by the European Commission, including the EU-US Data Privacy Framework where applicable
• standard contractual clauses approved by the European Commission
• additional technical security measures, where necessary

7. Retention periods

We keep your data only for as long as necessary for each purpose:

• orders and invoicing: for the applicable legal periods (up to 6 years for commercial obligations, and up to 10 years for anti-money-laundering obligations where applicable)
• customer account: as long as your account is active or until you request its deletion
• newsletter: until you withdraw your consent
• enquiries and communications: up to 2 years after the last contact, if no purchase follows
• cookies and advertising data: as set out in the Cookie Policy

After these periods, the data is blocked (kept only to address possible legal liabilities) and subsequently deleted.

8. Cookies

Our website uses first-party and third-party cookies to function correctly, analyse website use and display personalised advertising. You can accept, reject or configure them in the cookie panel that appears when you enter the website, and change your choice at any time.

For more information, see our Cookie Policy.

9. Your rights

As a data subject, you have the following rights over your data:

• Access: to know what data we hold about you
• Rectification: to correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): to ask us to delete your data
• Restriction of processing
• Portability: to receive your data in a structured, machine-readable format
• Objection to processing, including profiling for advertising purposes
• Not to be subject to automated decisions with significant legal effects
• To withdraw consent at any time

You can exercise these rights by writing to studio@boyaporcelana.com or by post to Carrer de la Reina Na Germana, 7, 46005 València, Spain, attaching a copy of an identification document. We will respond within a maximum of one month.

If you believe we are processing your data improperly, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es, C/ Jorge Juan 6, 28001 Madrid, Spain.

10. Security

We apply appropriate technical and organisational measures to protect your data from unauthorised access, loss or misuse. Communications with the website take place over an encrypted connection (SSL/TLS), and payments are processed by gateways certified to the PCI DSS standard.

11. Minors

Our products and services are not aimed at children under 14, and we do not knowingly collect their data through the website. If you are a parent or guardian and believe a minor has provided us with their data, please contact us and we will delete it.

For in-person workshops involving minors, we will explicitly request written authorisation from the person exercising parental authority or guardianship, and we will provide specific information about the processing of their data (including the use of photographs or videos, where applicable) before the event.

12. Changes to this policy

We may update this policy to adapt it to regulatory changes or changes in how we work. The current version will always be published on this page, with the date of the last update indicated at the top. We will notify you by email or by a prominent notice on the website when changes are significant.

13. Contact

For any questions about this policy or the processing of your data:

Boya Porcelana
Bojana Brkić
Carrer de la Reina Na Germana, 7, 46005 València, Spain
Email: studio@boyaporcelana.com
Phone: +34 664 29 88 68