Privacy policy
This policy explains what personal data Albor collects, why we collect it, what we do with it and what you can do about it. It is written to be read, not skimmed past. If anything here is unclear, write to us at privacy@alborkids.com and we will explain it in plain terms.
It applies to alborkids.com and to any order, account, newsletter subscription or enquiry made through it.
1) Who is responsible for your data?
| Data controller |
Albor Empowering Childhood, S.L. |
| CIF | B27543032 |
| Registered office | Spain |
| Data protection contact | privacy@alborkids.com |
| Data Protection Officer | Not appointed |
We are the controller of the personal data described below. That means we decide why and how it is processed, and we are accountable for it under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
We have not appointed a Data Protection Officer. The GDPR requires one only where an organisation is a public authority, carries out large-scale systematic monitoring of individuals, or processes special categories of data on a large scale. None of those applies to Albor, so no appointment is required. You can raise any data protection question directly with us at privacy@alborkids.com.
2) What data do we process?
We only collect what we actually need. Depending on how you use the site, that may include:
- Identification and contact data - name, surname, email address, postal address, telephone number.
- Order data - the products you bought, order number, date, amount, delivery address, billing address, order history.
- Payment data - handled by our payment provider. We receive confirmation that a payment succeeded and the last four digits of the card; we never see or store your full card number.
- Account data - if you create an account, your login credentials and saved preferences.
- Communications - the content of emails, contact forms and support messages you send us, including withdrawal and return requests.
- Marketing data - whether you subscribed to our newsletter, and whether you opened or clicked our emails.
- Technical and usage data - IP address, device and browser type, pages visited and how you reached the site. This is collected through cookies and only where you have consented.
We do not process special categories of data (health, beliefs, biometrics), and we do not ask for them. Please do not send us such data.
3) Why do we process it, on what legal basis, and for how long?
| Purpose | Legal basis | How long we keep it |
| To process your order, take payment, deliver it and handle returns and withdrawals | Performance of a contract (GDPR Art. 6.1.b) | For the life of the contract, then blocked for the legal limitation periods |
| To keep accounting and invoicing records | Legal obligation (Art. 6.1.c) — Spanish Commercial Code and tax law | 6 years from the end of the financial year for accounting records; 4 years for tax records |
| To answer your questions and provide customer service | Performance of a contract, or our legitimate interest in responding (Art. 6.1.b / 6.1.f) | Until the matter is resolved, then blocked for the limitation period |
| To send you our newsletter and brand communications | Your consent (Art. 6.1.a) | Until you unsubscribe or ask us to stop |
| To send updates about products similar to ones you bought | Legitimate interest (Art. 6.1.f), permitted by Spanish LSSI Art. 21.2 | Until you object or unsubscribe |
| To understand how the site is used and improve it | Your consent, given through the cookie banner (Art. 6.1.a) | For the lifetime of each cookie — see the Cookie Policy |
| To show you Albor content on other platforms and measure our campaigns | Your consent, given through the cookie banner (Art. 6.1.a) | For the lifetime of each cookie — see the Cookie Policy |
| To prevent fraud and keep the site secure | Legitimate interest (Art. 6.1.f) | As long as necessary for that purpose |
| To deal with claims or defend our legal position | Legitimate interest (Art. 6.1.f) | Until the relevant limitation period expires |
“Blocked” means the data is kept but not used, and is available only to courts, public authorities and the purposes required by law, until the limitation period expires. After that it is deleted.
4) Who receives your data?
We do not sell your personal data. We never have and we do not intend to.
We do share it with service providers who process it on our behalf, under a contract that requires them to act only on our instructions and to keep it secure. At the date of this policy these are:
| Provider | What it does | Where |
| Shopify | The e-commerce platform running the store, checkout and order management | Ireland / Canada |
| Payment provider via Shopify | Authorising and settling card payments | EU / United States |
| Google (Analytics 4) | Measuring how the site is used, only with your consent | EU / United States |
| Brevo | Sending the newsletter and transactional email, and linking on-site activity to a contact record | France / EU |
| Consentmo | Recording and storing your cookie consent choices | EU |
| Meta Platforms | Meta Pixel — measuring and attributing advertising, only with your consent | Ireland / United States |
| Google Tag Manager | Loading measurement and advertising tags according to your consent choice | EU / United States |
We may also disclose data where the law requires it — to tax authorities, courts, police or the Spanish Data Protection Agency.
5) Is your data sent outside the European Union?
Some of the providers above are based in, or have infrastructure in, the United States. Where data leaves the European Economic Area, we rely on the safeguards the GDPR requires: the European Commission's Standard Contractual Clauses, and where applicable the provider's certification under the EU–US Data Privacy Framework.
You can ask us for a copy of the safeguards that apply by writing to privacy@alborkids.com.
6) What are your rights?
You can exercise any of the rights below free of charge, at any time, by writing to privacy@alborkids.com from the address you gave us, or by post to our registered office. We may ask you to confirm your identity before we act, to make sure we are not disclosing your data to someone else. We will reply within one month.
Access
You can ask us to confirm whether we process data about you, and to give you a copy of it together with an explanation of what we do with it.
Rectification
You can ask us to correct data that is inaccurate, or to complete data that is incomplete. If you have an account you can also correct most of it yourself.
Erasure
You can ask us to delete your data. We will do so unless we are required to keep it — for example, invoices we are legally obliged to retain.
Restriction of processing
You can ask us to pause processing while a dispute about accuracy or legitimacy is resolved. We will keep the data but not use it.
Portability
For data you gave us that we process by consent or under a contract, you can ask for it in a structured, commonly used, machine-readable format, or ask us to send it directly to another provider.
Objection
You can object to processing based on our legitimate interest. If you object to direct marketing, we will stop immediately and without question.
Withdrawing consent
Where processing is based on your consent, you can withdraw it at any time. Withdrawing does not affect anything we did lawfully before you withdrew. Every marketing email carries an unsubscribe link, and cookie consent can be changed from the cookie settings on the site.
Automated decisions
We do not make decisions about you by purely automated means, and we do not profile you in any way that produces legal effects or similarly significant effects.
7) Complaining to the supervisory authority
If you think we have handled your data badly, we would like the chance to put it right — write to privacy@alborkids.com first. You also have the right to complain directly to the Spanish Data Protection Agency:
Agencia Española de Protección de Datos — C/ Jorge Juan 6, 28001 Madrid — www.aepd.es
8) Children
Albor makes clothing for children, but this website is intended for adults. We do not knowingly collect personal data from children, and we do not market to them.
Under Spanish law, a person must be at least 14 years old to consent to the processing of their own data. Orders, accounts and newsletter subscriptions must be made by an adult. If you believe a child has given us personal data, write to privacy@alborkids.com and we will delete it.
9) Security
We apply technical and organisational measures appropriate to the risk: encrypted connections across the whole site, access limited to people who need it, and providers chosen for their own security standards. No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you.
10) Links to other websites
This site links to pages we do not control. Once you follow such a link, this policy no longer applies. We encourage you to read the privacy policy of any site you visit.
11) Changes to this policy
We may update this policy as our business, our tools or the law change. The version published here is the one in force, and it carries the date of its last update. If a change materially affects how we use your data, we will tell you directly.
Last updated: 14 September 2026
