Privacy policy

PRIVACY POLICY

Last updated: July 4, 2026

This Privacy Policy explains how The Celestial Hours collects, uses, stores, shares, and protects personal information when you visit thecelestialhours.com, place an order, create an account, contact us, subscribe to marketing communications, submit a review, or otherwise use our website and services.

This Privacy Policy should be read together with our Cookie Policy, Terms of Service, Shipping Policy, and Refund & Returns Policy.

1. Data controller

The data controller is:

Arturo González García
Trading as The Celestial Hours
NIF: 47708579R
Cáceres, Spain
Email: contact@thecelestialhours.com
Website: thecelestialhours.com

2. Personal information we collect

Depending on how you interact with the website, we may collect the following categories of personal information.

Information you provide directly:

• Name
• Email address
• Billing and shipping address
• Telephone number, when provided or required for delivery
• Order and transaction information
• Customer account details and preferences
• Customer-service communications
• Reviews, photographs, or other content you voluntarily submit
• Marketing preferences and consent records
• Cookie and privacy preference choices
• Information you provide when exercising privacy rights

Information collected automatically:

• IP address
• Browser and device information
• Approximate location derived from technical data
• Pages viewed and links selected
• Date, time, and duration of visits
• Product views
• Cart activity and checkout activity
• Purchase events
• Referral source and campaign information
• Cookie identifiers and similar technical information
• Information used to detect fraud, abuse, and security incidents

Payment information:

Payments are processed by Shopify Payments, PayPal, or other payment providers made available at checkout.

We do not receive or store complete payment-card numbers. Payment providers process payment information under their own privacy and security terms.

Sensitive information:

We do not intentionally collect sensitive personal information, such as health information, government identification documents, precise geolocation, biometric information, or information about religious beliefs, political opinions, or similar protected categories. Please do not send sensitive information to us unless it is strictly necessary for your request.

3. How we collect personal information

We collect personal information:

• Directly from you
• Automatically through the website, cookies, pixels, tags, and similar technologies
• From Shopify and applications connected to our store
• From payment providers
• From Gelato and shipping providers
• From customer-service, email, analytics, advertising, or review providers that we use
• From fraud-prevention and security services
• From social networks or advertising platforms, where legally permitted and relevant to your interaction with us
• From privacy tools, cookie banners, consent-management systems, and opt-out mechanisms

4. Why we use personal information

We may use personal information to:

• Process payments and confirm orders
• Produce, fulfil, and deliver purchases
• Send order, dispatch, delivery, and account notifications
• Provide customer support
• Respond to your questions or requests
• Handle cancellations, returns, refunds, defects, and delivery claims
• Maintain customer accounts
• Save privacy, cookie, and marketing preferences
• Prevent fraud, misuse, abuse, and security incidents
• Protect the website, our business, and our customers
• Comply with tax, accounting, invoicing, consumer-protection, and legal obligations
• Improve the website, products, services, and customer experience
• Measure website performance and ecommerce activity
• Understand how visitors discover and use our website
• Send marketing communications where permitted
• Display, personalize, or measure advertising where you have given any consent required by law
• Create or measure advertising audiences where permitted
• Analyse campaign performance
• Request, collect, display, or manage product reviews where permitted
• Establish, exercise, or defend legal claims
• Enforce our Terms of Service and other policies

5. Legal bases for processing in the EEA and United Kingdom

Where the GDPR, UK GDPR, or equivalent legislation applies, we rely on one or more of the following legal bases.

Performance of a contract:
We process information required to accept, produce, fulfil, deliver, and support your order, manage your account, and provide the services you request.

Legal obligation:
We process and retain information where required by tax, accounting, invoicing, consumer-protection, anti-fraud, and other applicable laws.

Consent:
We rely on consent for activities such as optional marketing communications and non-essential cookies, pixels, analytics, or advertising tracking where consent is legally required.

Legitimate interests:
We may process information to secure and improve the website, prevent fraud, understand general business performance, provide customer service, manage legal claims, and protect our rights, provided those interests are not overridden by your rights and freedoms.

6. Shopify

Our store is hosted by Shopify.

Shopify processes information required to operate the website, storefront, checkout, customer accounts, payments, security features, privacy tools, analytics, and related ecommerce services.

In some circumstances, Shopify acts as a processor or service provider on our behalf. In other circumstances, Shopify may act as an independent controller for its own services, security, analytics, network intelligence, personalized features, or legal obligations.

Information submitted through the store may be transmitted to Shopify and its service providers in countries outside your place of residence.

Where enabled, Shopify Network Intelligence may allow Shopify to use data from our store together with data from other Shopify services and merchants to help provide, improve, personalize, and secure Shopify services, including services related to analytics, fraud prevention, product improvement, advertising, and marketing measurement. No other merchant can see your personal information from our store.

Further information about Shopify’s processing and privacy rights is available through Shopify’s Consumer Privacy Policy and Shopify Privacy Portal.

7. Production, fulfilment, and delivery

We use Gelato and its network of production, printing, logistics, and carrier partners to manufacture and deliver orders.

To fulfil a purchase, we may share information including:

• Customer name
• Delivery address
• Contact information required by the carrier
• Products ordered
• Order reference
• Delivery and tracking information
• Information needed to resolve delivery, damage, or fulfilment issues

Gelato and its production, printing, logistics, and carrier partners may process this information in the country of production, transit, or delivery.

8. Analytics, advertising, and measurement

With your consent where required, we may use analytics and advertising technologies to understand how visitors use our website, measure ecommerce activity, improve the shopping experience, and measure the effectiveness of advertising campaigns.

These technologies may include:

• Google Analytics 4, to understand website performance, product views, user journeys, ecommerce activity, and conversion performance.
• Google advertising technologies, where enabled, to measure advertising performance, support conversion tracking, and improve advertising campaigns.
• Meta Pixel and Facebook & Instagram by Meta technologies, to measure advertising performance, understand how visitors interact with our store, associate visits, cart activity, or purchases with advertising campaigns, and support advertising audiences where permitted.
• Meta Conversions API, where enabled, to support server-side advertising measurement and improve event reliability, subject to applicable consent and privacy settings.
• Shopify analytics and privacy technologies, to operate the store, measure performance, support customer privacy controls, and remember privacy choices.

Depending on your consent choices and applicable law, information shared with analytics and advertising providers may include:

• Device and browser information
• IP address and approximate location
• Cookie or pixel identifiers
• Product views
• Cart and checkout activity
• Purchase events
• Order value and currency
• Referral source and campaign information
• Hashed contact information, where enabled and permitted
• Consent and opt-out status

We do not use analytics or advertising technologies that require consent in regions where consent is legally required unless you have provided that consent through our cookie banner or preference tools.

9. Other service providers

We may share personal information with providers that help us operate the business, including:

• Shopify
• Gelato
• Payment processors
• Shipping and postal carriers
• Hosting and cloud providers
• Email and customer-service providers
• Review and feedback platforms
• Analytics providers
• Advertising platforms
• Social-media platforms
• Fraud-prevention and cybersecurity providers
• Consent-management and privacy-preference providers
• Accountants, professional advisers, authorities, and legal representatives where necessary

These providers receive only the information reasonably required to perform their services, subject to their roles and applicable data-protection requirements.

10. Marketing communications

We may send promotional emails when you have subscribed or where another lawful basis permits us to do so.

Every promotional email will include an unsubscribe method.

Unsubscribing from marketing does not prevent us from sending transactional communications about your order, account, payment, delivery, security, or customer-service request.

We do not require marketing consent as a condition of purchasing a product.

Marketing communications may be sent through Shopify, Shopify Email, Klaviyo, or another email provider if used. We will update this policy if we introduce material new marketing providers or practices.

11. Reviews, photos, and user-submitted content

If you submit a product review, photograph, testimonial, or other content, we may process the information you provide to collect, moderate, display, and manage that content.

Unless clearly stated otherwise at the time of submission, reviews, ratings, first name or display name, photographs, and submitted content may be displayed publicly on our website, marketing channels, or related promotional materials.

Please avoid submitting photographs or content that include other people unless you have their permission.

12. Cookies and similar technologies

The website uses cookies and similar technologies.

Essential technologies may be used without optional consent when required to operate:

• The shopping cart
• Checkout
• Payments
• Security
• Customer accounts
• Privacy preferences
• Fraud prevention
• Website functionality

With your consent where required, we may also use analytics, personalization, and advertising technologies, which may include tools provided by Shopify, Google, Meta, or similar providers.

These technologies may collect information about your device, browsing activity, interactions, cart activity, checkout activity, and purchases.

You can accept, reject, or manage non-essential technologies through the cookie banner or Cookie Preferences link.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Where supported and legally required, we recognise Global Privacy Control as an opt-out signal for the relevant browser or device.

For more information, please see our Cookie Policy.

13. Personalized advertising and U.S. privacy choices

We do not sell personal information for money.

However, certain uses of advertising cookies, pixels, network identifiers, audience tools, or advertising measurement technologies may be considered a “sale,” “sharing,” or targeted advertising under some United States privacy laws.

Depending on your state of residence and whether applicable legal thresholds are met, you may have the right to opt out of such processing.

You may submit an opt-out request through:

• The Cookie Preferences tool
• The Your Privacy Choices page
• The Do Not Sell or Share My Personal Information page, where available
• A recognised Global Privacy Control signal
• Emailing contact@thecelestialhours.com

If you opt out, we will apply your choice as required by applicable law. Essential cookies and technologies required to operate the store may still be used.

14. Social media and third-party platforms

We may maintain profiles or advertise on third-party platforms such as Instagram, Facebook, Pinterest, TikTok, Google, or similar services.

If you interact with us through a third-party platform, that platform may process your information under its own privacy policy and terms. We do not control how independent third-party platforms process your information.

Where we receive information from these platforms, we use it in accordance with this Privacy Policy and applicable law.

15. International data transfers

We are established in Spain, but some service providers may process personal information in the United States or other countries.

Where personal information is transferred outside the European Economic Area, the United Kingdom, or another protected jurisdiction, we rely on an appropriate legal mechanism where required, such as:

• An adequacy decision
• Standard Contractual Clauses
• The EU–U.S. Data Privacy Framework where applicable
• Another legally recognised safeguard

16. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Retention periods may depend on:

• Whether you maintain a customer account
• Whether an order or customer-service matter remains open
• Tax, accounting, invoicing, and legal obligations
• Fraud-prevention requirements
• Dispute and limitation periods
• Consent and marketing records
• Privacy request records
• The need to establish, exercise, or defend legal claims

When information is no longer required, we delete, anonymise, securely restrict, or aggregate it, unless continued retention is required by law.

17. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss, or misuse.

Payments are processed through specialised payment providers, and we do not store complete payment-card numbers.

No online system or transmission method can be guaranteed to be completely secure. Please avoid sending sensitive information through ordinary email unless requested through a secure process.

18. Automated decision-making

We do not use personal information to make decisions that produce legal or similarly significant effects based solely on automated processing.

Some service providers may use automated systems to help detect fraud, protect the website, secure payments, prevent abuse, or measure advertising performance. Where required by law, such processing is subject to appropriate safeguards.

19. Your privacy rights

Depending on where you live, you may have the right to:

• Request access to your personal information
• Request correction of inaccurate information
• Request deletion of information
• Request restriction of processing
• Object to certain processing
• Receive information in a portable format
• Withdraw consent at any time
• Opt out of targeted advertising, sale, or sharing where applicable
• Request information about categories of data collected, used, disclosed, sold, or shared
• Appeal a decision regarding a privacy request where applicable
• Lodge a complaint with a supervisory authority

These rights may be subject to legal limitations and verification requirements.

20. Exercising your rights

To submit a privacy request, email:

contact@thecelestialhours.com

Please provide enough information for us to identify the relevant account, order, transaction, browser, or device and understand your request.

We may need to verify your identity before completing the request. Authorised agents may be required to provide evidence of their authority.

We will respond within the period required by applicable law.

21. Complaints

Please contact us first if you have concerns about how your information is handled.

Residents of the European Economic Area may also lodge a complaint with their local data-protection authority.

In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD).

22. Children

The website and products are not directed to children under 16.

We do not knowingly collect personal information directly from children under 16 without appropriate authorisation.

If you believe that a child has provided personal information, contact us so that we can review and, where appropriate, delete it.

23. Third-party websites

The website may contain links to platforms or services that we do not control.

Their collection and use of personal information are governed by their own privacy notices. We are not responsible for the privacy, content, or security practices of independent third-party websites.

24. Changes to this policy

We may update this Privacy Policy to reflect operational, technological, legal, or regulatory changes.

The updated version will be published on this website with a revised “Last updated” date. We will provide additional notice when required by law.

25. Contact

Data controller:
Arturo González García
Trading as The Celestial Hours
NIF: 47708579R
Cáceres, Spain
Email: contact@thecelestialhours.com
Website: thecelestialhours.com