PRIVACY POLICY.

WHO WE ARE.

GO BARE LAB, SL (CIF: B70896881), registered at Carrer Santa Rita 9, 2-1, 08173 Sant Cugat del Vallès, Barcelona, Spain, is the data controller responsible for your personal data collected through this website.

WHAT DATA WE COLLECT.

Name and contact details (email, address, phone) when you place an order or contact us
Payment information — processed securely by our payment providers; we do not store card details
Order history and purchase data
Browsing data and cookies — see our Cookies Policy for details
Any information you voluntarily provide via our contact form

WHY WE COLLECT IT.

To process and fulfil your orders
To communicate with you about your orders or enquiries
To send you marketing communications, where you have consented
To comply with our legal obligations
To improve our website and services

LEGAL BASIS.

We process your data on the following legal bases under GDPR: performance of a contract (order fulfilment), compliance with legal obligations, legitimate interests (website improvement, fraud prevention), and consent (marketing communications).

WHO WE SHARE IT WITH.

We do not sell your data. We share it only with trusted third parties necessary to operate our business, including:

Shopify Inc. — e-commerce platform and order management
Klaviyo Inc. — email marketing
Payment processors (Stripe, PayPal, Apple Pay, Google Pay)
Shipping and logistics carriers

All third parties are required to handle your data securely and in accordance with applicable law.

HOW LONG WE KEEP IT.

We retain your personal data for as long as necessary to fulfil the purposes outlined above, or as required by law. Order data is retained for a minimum of 5 years in accordance with Spanish tax law.

YOUR RIGHTS.

Under GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You also have the right to withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at hello@gobare.co. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

INTERNATIONAL TRANSFERS.

Some of our third-party providers are based outside the EEA. Where data is transferred internationally, we ensure appropriate safeguards are in place in accordance with GDPR requirements.