PRIVACY POLICY

Last updated: July 27, 2026

This Privacy Policy explains how The Celestial Hours collects, uses, stores, shares, and protects personal information when you visit thecelestialhours.com , place an order, create an account, contact us, subscribe to marketing communications, submit a review, exercise a privacy choice, or otherwise use our website and services.

This Privacy Policy should be read together with our Cookie Policy, Terms of Service, Shipping Policy, and Refund & Returns Policy.

1. DATA CONTROLLER

The data controller is:

Arturo González García
Trading as The Celestial Hours
NIF: 47708579R
Calle Antonio Floriano Cumbreño 8
10005 Cáceres, Spain 
Email: contact@thecelestialhours.com
Website: thecelestialhours.com

2. PERSONAL INFORMATION WE COLLECT

Depending on how you interact with the website, we may collect the following categories of personal information.

Information you provide directly:

• Name
• Email address
• Billing and shipping address
• Telephone number, when provided or required for delivery
• Order and transaction information
• Customer account details and preferences
• Customer-service communications
• Reviews, ratings, photographs, testimonials, display names, or other content you voluntarily submit
• Interactions with review requests, including whether a review invitation was sent, opened, selected, completed, or unsubscribed from, where available
• Marketing preferences and consent records
• Cookie and privacy preference choices
• Information you provide when exercising privacy rights

Information collected automatically:

• IP address
• Browser and device information
• Approximate location derived from technical data
• Pages viewed and links selected
• Date, time, and duration of visits
• Product views
• Cart and checkout activity
• Purchase events
• Referral source and campaign information
• Advertising click identifiers
• Cookie, pixel, browser-storage, and similar technical identifiers
• Consent and opt-out status
• Review-widget and review-request interaction data, where Judge.me features are used
• Information used to detect fraud, abuse, and security incidents
• Technical connection data generated when Judge.me storefront assets load, which may include an IP address, browser and device information, user agent, requested resource, page or referring URL, date and time, and delivery, security, caching, or diagnostic logs.

Payment information:

Payments are processed by Shopify Payments, PayPal, or other payment providers made available at checkout.

We do not receive or store complete payment-card numbers. Payment providers process payment information under their own privacy, security, and contractual terms.

Sensitive information:

We do not intentionally collect sensitive personal information such as health information, government identification documents, precise geolocation, biometric information, religious beliefs, political opinions, or similar protected categories.

Please do not send sensitive information to us unless it is strictly necessary for a request and we have asked you to provide it.

3. HOW WE COLLECT PERSONAL INFORMATION

We collect personal information:

• Directly from you
• Automatically through the website, cookies, pixels, tags, browser storage, and similar technologies
• From Shopify and applications connected to our store
• From payment providers
• From Gelato and shipping providers
• From and through Judge.me. Judge.me remains installed in our Shopify store. Its storefront scripts and style sheets may load even when public rating and review widgets are not displayed. If review features are enabled, Judge.me may also process information relating to reviews, ratings, photographs, verification, moderation, display, and review requests.
• From customer-service, email, analytics, advertising, social-media, or other review providers
• From fraud-prevention and security services
• From Meta, Google, Pinterest, and other advertising platforms where legally permitted and relevant to your interaction with us
• From privacy tools, cookie banners, consent-management systems, and recognised opt-out mechanisms

4. WHY WE USE PERSONAL INFORMATION

We may use personal information to:

• Process payments and confirm orders
• Produce, fulfil, and deliver purchases
• Send order, dispatch, delivery, and account notifications
• Provide customer support
• Respond to questions, complaints, or requests
• Handle cancellations, returns, refunds, defects, and delivery claims
• Maintain customer accounts
• Save privacy, cookie, and marketing preferences
• Prevent fraud, misuse, abuse, and security incidents
• Protect the website, our business, service providers, and customers
• Comply with tax, accounting, invoicing, consumer-protection, and legal obligations
• Improve the website, products, services, and customer experience
• Measure website performance and ecommerce activity
• Understand how visitors discover and use the website
• Send marketing communications where permitted
• Display, personalise, or measure advertising where legally permitted
• Create, measure, or improve advertising audiences
• Analyse advertising and campaign performance
• Send review invitations where enabled and permitted
• Collect, authenticate, moderate, display, manage, and measure product reviews, ratings, photographs, and related interactions
• Establish, exercise, or defend legal claims
• Enforce our Terms of Service and other policies

5. LEGAL BASES FOR PROCESSING IN THE EEA AND UNITED KINGDOM

Where the GDPR, UK GDPR, or equivalent legislation applies, we rely on one or more of the following legal bases.

Performance of a contract:

We process information required to accept, produce, fulfil, deliver, and support your order, manage your account, and provide the services you request.

Legal obligation:

We process and retain information where required by tax, accounting, invoicing, consumer-protection, anti-fraud, and other applicable laws.

Consent:

We rely on consent for optional marketing communications and non-essential cookies, pixels, analytics, personalisation, or advertising tracking where consent is legally required.

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Legitimate interests:

We may process information to secure and improve the website, prevent fraud, understand business performance, provide customer service, maintain and diagnose limited technical integrations with service providers, manage reviews, protect the integrity of review systems, manage legal claims, and protect our rights, provided those interests are not overridden by your rights and freedoms.

This may include the limited processing of technical connection data required to deliver and secure installed Judge.me storefront assets, maintain compatibility, and diagnose technical errors. We do not rely on legitimate interests to place or read non-essential identifiers on your device, or to conduct optional review analytics, where consent is required by law.

6. SHOPIFY

Our online store is hosted and operated through Shopify.

Shopify processes information required to provide the storefront, checkout, customer accounts, payment functionality, security features, privacy tools, fraud prevention, analytics, and related ecommerce services.

Shopify processes personal information when you visit our website, interact with the store, create an account, use Shopify consumer services, or make a purchase.

In some circumstances, Shopify acts as a processor or service provider on our behalf. In other circumstances, Shopify may act as an independent controller for its own services, legal obligations, security, analytics, Network Intelligence, personalisation, and consumer features.

Information submitted through our store may be transmitted to Shopify and its service providers in countries outside your place of residence.

You can learn more about how Shopify processes consumer information by reviewing the Shopify Consumer Privacy Policy .

7. SHOPIFY NETWORK INTELLIGENCE AND ENHANCED SERVICES

We use Shopify to operate our online store.

When Shopify Network Intelligence is enabled, Shopify may securely use information from our store together with information from other merchants and Shopify services to provide Enhanced Services.

These services may include:

• Improved store and checkout functionality
• Personalised shopping experiences
• Product search and recommendations
• Fraud prevention and security
• Performance and business insights
• Marketing and advertising measurement
• Advertising services
• Services based on interactions with Shopify, our store, and other Shopify merchants

Shopify may process information relating to your interactions with our store, Shopify services, and other merchants to provide these services. Personal information may also be shared with Shopify and other service providers that may operate in countries outside your place of residence.

No other Shopify merchant can directly view personal information collected through our store.

Under our current configuration, we display a prior-consent cookie banner to visitors, including visitors in the United States. Through the banner and Cookie Preferences, you can accept, decline, or manage optional personalisation, analytics, and marketing technologies. Optional categories remain disabled unless and until you provide the relevant consent.

You may review, change, or withdraw your cookie choices at any time through Cookie Preferences in the footer. If you reject non-essential cookies, device data from our site will be marked so that Shopify Network Intelligence does not use it for non-essential purposes, including advertising, where Shopify’s privacy tools, consent systems, and the relevant integration settings apply.

Visitors in the United States may also use Your Privacy Choices to opt out of activities considered a sale or sharing of personal information, targeted advertising, or cross-context behavioural advertising under applicable state privacy laws. We make this mechanism available throughout the United States, including in states where providing this additional choice is not expressly required by applicable law.

Cookie Preferences and Your Privacy Choices perform different functions. Cookie Preferences manages consent for optional personalisation, analytics, and marketing technologies. Your Privacy Choices manages applicable opt-outs from sale, sharing, targeted advertising, or cross-context behavioural advertising. Using one control does not replace the other, and an advertising-related opt-out does not necessarily disable every analytics or measurement technology.

Where required by applicable law and technically supported, we also process recognised opt-out preference signals, including Global Privacy Control (GPC). A recognised opt-out signal is not necessarily equivalent to rejecting all optional cookies.

You may also visit the Shopify Privacy Portal to learn more about Shopify’s processing of personal information and to exercise applicable rights relating to processing performed directly by Shopify for its own consumer services or Enhanced Services, including access, deletion, or advertising-related choices.

You may also contact us at contact@thecelestialhours.com regarding personal information processed in connection with our store.

8. PRODUCTION, FULFILMENT, AND DELIVERY

We use Gelato and its network of production, printing, logistics, and carrier partners to manufacture and deliver orders.

To fulfil a purchase, we may share information including:

• Customer name
• Delivery address
• Contact information required by the carrier
• Products ordered
• Order reference
• Delivery and tracking information
• Information needed to resolve delivery, damage, or fulfilment issues

Gelato and its production, printing, logistics, and carrier partners may process this information in the country of production, transit, or delivery.

9. ANALYTICS, ADVERTISING, MEASUREMENT, AND REVIEW TECHNOLOGIES

Not every technology described in this section is active on every visit, in every region, or at all times. A technology operates only when the relevant Shopify app, integration, account setting, or feature is enabled and when applicable consent and privacy choices permit its use. The Cookie Policy provides additional information about technology availability and operation.

With your consent where required, we may use analytics and advertising technologies to understand how visitors use our website, measure ecommerce activity, improve the shopping experience, and measure advertising effectiveness.

These technologies may include:

• Google Analytics 4, to measure website performance, product views, user journeys, ecommerce activity, and conversions.
• Google advertising technologies, where enabled, to support advertising measurement, conversion tracking, campaign attribution, and advertising improvement.
• Meta Pixel and Facebook & Instagram by Meta technologies, to measure advertising performance, understand store interactions, associate visits or purchases with campaigns, and support advertising audiences where permitted.
• Meta Conversions API, where enabled, to support server-side advertising measurement and improve event reliability.
• Pinterest Tag and Pinterest advertising technologies, where enabled, to measure visits, product views, cart activity, checkouts, purchases, and Pinterest advertising performance.
• Pinterest Conversions API, where enabled, to support server-side conversion measurement and improve event attribution.
• Shopify analytics, Network Intelligence, and privacy technologies, to operate the store, provide Enhanced Services, measure performance, support customer privacy controls, and remember privacy choices.
• Judge.me review and integration technologies. Judge.me remains installed in our Shopify store. Under our current configuration, public star-rating badges, review widgets, and review-submission forms are not displayed. Base JavaScript and style-sheet resources may nevertheless be requested from Judge.me or its content-delivery infrastructure when a storefront page loads. These requests may disclose limited technical connection data, such as IP address, browser or device information, user agent, requested resource, page or referring URL, date and time, and delivery, security, caching, or diagnostic information. Our technical test on July 27, 2026 did not identify a Judge.me cookie or Judge.me value in local or session storage before a visitor made a cookie choice. This is a point-in-time result and the operation of the integration may change. Where review features are enabled, Judge.me may also collect, authenticate, moderate, display, manage, and measure product reviews, ratings, photographs, display names, verified-purchase information, and review-request interactions. We do not use Judge.me as an advertising provider.

Depending on your consent choices, configuration, and applicable law, information shared with these providers may include:

• Device and browser information
• IP address and approximate location
• Cookie, pixel, browser-storage, or similar identifiers
• Product views
• Cart and checkout activity
• Purchase events
• Order value and currency
• Referral source and campaign information
• Advertising click identifiers
• Hashed contact information, where enabled and permitted
• Review content, ratings, photographs, display names, and review-request interactions
• Consent and opt-out status

We do not use analytics or advertising technologies that require prior consent in regions where consent is legally required unless you have provided that consent through our cookie banner or privacy tools. The limited delivery of base integration assets is distinguished from optional analytics or device storage. Optional analytical technologies, identifiers, or non-essential browser storage used by any review tool are subject to consent where required.

10. PINTEREST

Where the relevant Pinterest integration or feature is enabled, we use or may use the Pinterest app, Pinterest Tag, Pinterest advertising tools, Pinterest conversion tracking, enhanced matching, and Pinterest Conversions API.

Pinterest technologies may help us:

• Measure visits and advertising performance
• Attribute product views, cart activity, checkouts, and purchases to Pinterest campaigns
• Understand how visitors interact with our store after viewing or selecting Pinterest content
• Create or measure advertising audiences
• Improve Pinterest advertising campaigns
• Support conversion measurement and event deduplication

Depending on configuration, consent, and applicable law, Pinterest may receive:

• IP address
• Browser and device information
• Page and product views
• Cart, checkout, and purchase events
• Order value and currency
• Pinterest click and cookie identifiers
• Referral and campaign information
• Hashed contact information where enhanced matching is enabled and permitted

Where prior consent is required, Pinterest advertising technologies are not used for optional advertising or tracking purposes until marketing consent has been provided.

11. OTHER SERVICE PROVIDERS

We may share personal information with providers that help us operate the business, including:

• Shopify
• Gelato
• Judge.me, as a provider of the installed technical review integration and, where enabled, review collection, authentication, moderation, display, verified-purchase, review-request, and related review functionality
• Payment processors
• Shipping and postal carriers
• Hosting and cloud providers
• Email and customer-service providers
• Other review and feedback platforms
• Analytics providers
• Meta, Google, Pinterest, and other advertising platforms
• Social-media platforms
• Fraud-prevention and cybersecurity providers
• Consent-management and privacy-preference providers
• Accountants, professional advisers, authorities, and legal representatives where necessary

These providers receive only the information reasonably required to perform their services, subject to their role, contractual terms, and applicable data-protection requirements.

12. MARKETING COMMUNICATIONS

We may send promotional emails when you have subscribed or where another lawful basis permits us to do so.

Every promotional email will include an unsubscribe method where required.

Unsubscribing from marketing does not prevent us from sending transactional or service-related communications about:

• Orders
• Payments
• Delivery
• Accounts
• Security
• Returns or refunds
• Customer-service requests
• Changes affecting our services or policies

We do not require marketing consent as a condition of purchasing a product.

Review requests sent through Judge.me are separate from general promotional marketing. Where required, you may unsubscribe from review-request communications using the method provided in the message or by contacting us.

13. REVIEWS, PHOTOGRAPHS, AND USER-SUBMITTED CONTENT

At the date of this Privacy Policy, public Judge.me star-rating badges, review widgets, and review-submission forms are not displayed on our storefront. Judge.me remains installed and may process the limited technical connection data described in Section 9 when its storefront assets are requested.

If Judge.me review features are enabled, we use Judge.me to support the collection, authentication, moderation, display, management, and measurement of product reviews and related interactions.

When you submit or interact with a review, Judge.me and The Celestial Hours may process:

• Review content and review titles
• Ratings
• Photographs or other media you choose to submit
• Your first name, display name, or anonymous display choice
• Email address and order information used to request or verify a review
• Review-request interactions, including delivery, opening, selection, completion, and unsubscribe information where available
• Moderation, verification, publication, display, and status information
• Technical information needed to provide and secure the review service

Unless clearly stated otherwise at the time of submission, reviews, ratings, first name or display name, photographs, and submitted content may be displayed publicly on our website, social-media profiles, marketing channels, or related promotional materials.

Please do not submit photographs or content that include other identifiable people unless you have their permission.

For personal information received from us through Shopify or our store in connection with review functionality, Judge.me generally acts as a data processor or service provider on our behalf. When a reviewer creates or uses a Judge.me account, interacts directly with Judge.me services, or uses features for which Judge.me determines its own purposes and means of processing, Judge.me may act as an independent data controller.

Judge.me may process personal information in countries outside your country or region. Where applicable, international transfers are addressed through legally recognised safeguards, as described in Section 17 and in Judge.me’s applicable privacy and data-processing terms.

You can learn more by reviewing the Judge.me Privacy Policy .

14. COOKIES AND SIMILAR TECHNOLOGIES

The website uses cookies, pixels, tags, scripts, browser storage, server-side events, and similar technologies. These technologies are described in detail in our Cookie Policy, which also explains that not every provider, app, integration, or feature is active on every visit.

Required technologies may be used without optional consent when necessary to operate:

• The shopping cart
• Checkout
• Payments
• Security
• Customer accounts
• Privacy preferences
• Fraud prevention
• Website functionality

We display a cookie banner to visitors and use Cookie Preferences as the mechanism for accepting, rejecting, managing, or withdrawing consent for optional personalisation, analytics, and marketing technologies. Optional categories remain disabled unless and until you provide the relevant consent, where consent is required.

You may change or withdraw your choices at any time through Cookie Preferences in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Changes apply prospectively, and some previously stored cookies may remain until they expire or you delete them through your browser unless the relevant tool removes them.

Your Privacy Choices is a separate mechanism for opting out of activities that may be considered a sale or sharing of personal information, targeted advertising, or cross-context behavioural advertising under applicable United States privacy laws. It does not replace Cookie Preferences and does not necessarily disable all analytics or measurement technologies.

Where required by applicable law and technically supported, we recognise Global Privacy Control as an opt-out signal for the relevant browser or device. GPC is not treated as a universal instruction to reject every optional cookie.

All visitors may also block or delete cookies through browser settings. Blocking all cookies may prevent the cart, checkout, account, or other parts of the website from functioning correctly.

For more information, please review our Cookie Policy.

15. PERSONALISED ADVERTISING AND U.S. PRIVACY CHOICES

Depending on where you live, you may have the right to opt out of the use of personal information for targeted advertising or activities considered a sale or sharing under applicable United States privacy laws.

You may exercise this choice through Your Privacy Choices .

We make the Your Privacy Choices mechanism available to visitors across all United States states, including where providing this additional choice is not expressly required by applicable state law. This voluntary availability does not mean that every state provides identical legal rights.

Your Privacy Choices applies to activities considered sale, sharing, targeted advertising, or cross-context behavioural advertising. It does not replace the cookie banner or Cookie Preferences and does not necessarily disable all analytics or measurement technologies. To reject optional personalisation, analytics, and marketing technologies, use Cookie Preferences.

Depending on the provider, configuration, consent status, and applicable law, restricted data processing, aggregated measurement, cookieless measurement, or non-personalised analytics may continue after an advertising-related opt-out.

Where required by applicable law and technically supported, we process recognised opt-out preference signals, including Global Privacy Control (GPC).

You may contact us at contact@thecelestialhours.com to exercise an applicable privacy right or request assistance.

We do not sell personal information for money. However, certain uses of advertising, audience, attribution, Shopify Enhanced Services, or cross-context tracking technologies may be considered a sale, sharing, or targeted advertising under some United States privacy laws.

16. SOCIAL MEDIA AND THIRD-PARTY PLATFORMS

We may maintain profiles, publish content, or advertise on third-party platforms such as Instagram, Facebook, Pinterest, TikTok, Google, or similar services.

If you interact with us through a third-party platform, that platform may process your information under its own privacy policy and terms.

We do not control how independent third-party platforms process personal information.

Where we receive information from these platforms, we use it in accordance with this Privacy Policy and applicable law.

17. INTERNATIONAL DATA TRANSFERS

We are established in Spain, but some service providers may process personal information in the United States, Canada, the United Kingdom, Norway, or other countries.

Where personal information is transferred outside the European Economic Area, the United Kingdom, or another protected jurisdiction, we rely on an appropriate legal mechanism where required, such as:

• An adequacy decision
• Standard Contractual Clauses
• The EU–U.S. Data Privacy Framework where applicable
• Another legally recognised safeguard

18. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal obligations, operational needs, dispute periods, security requirements, and the instructions or retention settings of relevant service providers.

Order, payment, invoicing, and transaction records:

We retain these records for as long as needed to fulfil the order, process payments and refunds, provide support, comply with tax, accounting, invoicing, consumer-protection, and recordkeeping obligations, and establish or defend legal claims.

As a general rule, business books, correspondence, documentation, and supporting records connected with our commercial activity are retained for six years from the last relevant accounting entry, in accordance with the Spanish Commercial Code. Tax-relevant records are generally retained for at least the applicable tax limitation period, which is commonly four years under Spanish tax law. A longer period may apply where another legal obligation, inspection, dispute, chargeback, investigation, or claim remains open.

Customer-service, complaint, and dispute records:

We retain these records while the request, claim, complaint, chargeback, or dispute remains open and afterwards for as long as reasonably needed to document the outcome, comply with legal obligations, and establish or defend legal claims.

Marketing subscriptions and unsubscribe records:

We retain active subscription information while you remain subscribed. We may retain limited suppression or unsubscribe information for as long as needed to respect your choice, prevent further marketing, and demonstrate compliance.

Consent, cookie, and privacy-choice records:

We retain records of consent, withdrawal, Cookie Preferences, Your Privacy Choices, GPC signals, and privacy requests for the duration of the relevant choice and afterwards for as long as reasonably necessary to demonstrate compliance, resolve disputes, respond to complaints, and comply with applicable limitation periods. We do not retain detailed identifiers for longer than reasonably necessary for those purposes.

Technical data, cookies, analytics, and advertising identifiers:

We retain technical logs, device and browser data, cookie and browser-storage records, analytics information, and advertising identifiers according to the purpose of the technology, relevant provider settings, consent choices, browser controls, security needs, campaign or measurement needs, and applicable legal requirements. We review, restrict, delete, or anonymise these records when they are no longer reasonably necessary or when consent or an applicable opt-out is withdrawn, subject to technical and legal limitations.

Technical connection and integration records processed through Judge.me may be retained according to the purpose of the request, security and diagnostic needs, the provider’s documented settings and contractual terms, and applicable legal requirements. We apply the shortest retention reasonably available to us and request restriction or deletion when the information is no longer required, subject to legal and technical limitations.

Fraud-prevention and security records:

We retain these records for as long as reasonably necessary to detect, investigate, prevent, and document fraud, abuse, unauthorised access, payment risk, and security incidents, and to comply with legal or contractual obligations.

Reviews, photographs, and user-submitted content:

We retain this content while it is published, under moderation, required to verify authenticity, or otherwise needed to provide the review service. We may retain related records for as long as reasonably necessary to handle removal requests, disputes, moderation, fraud prevention, and legal claims.

Customer-account information:

We retain account information while the account remains active and afterwards for as long as reasonably needed to complete outstanding transactions, respond to requests, maintain security, comply with legal obligations, and resolve disputes.

When information is no longer required, we delete, anonymise, securely restrict, or aggregate it unless continued retention is required or permitted by law.

19. SECURITY

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss, or misuse.

Payments are processed through specialised payment providers, and we do not store complete payment-card numbers.

No online system or transmission method can be guaranteed to be completely secure. Please avoid sending sensitive information through ordinary email unless requested through an appropriate process.

20. AUTOMATED DECISION-MAKING

We do not use personal information to make decisions that produce legal or similarly significant effects based solely on automated processing.

Some service providers may use automated systems to help detect fraud, secure payments, prevent abuse, personalise services, moderate or verify reviews, or measure advertising performance.

Where required by law, such processing is subject to applicable rights and safeguards.

21. YOUR PRIVACY RIGHTS

Depending on where you live, you may have the right to:

• Request access to your personal information
• Request correction of inaccurate or incomplete information
• Request deletion or erasure
• Request restriction of processing
• Object to certain processing
• Receive information in a portable format
• Withdraw consent at any time
• Opt out of targeted advertising, sale, or sharing where applicable
• Request information about categories of information collected, used, disclosed, sold, or shared
• Appeal a decision regarding a privacy request where applicable
• Lodge a complaint with a supervisory authority
• Exercise applicable privacy rights without unlawful discrimination

These rights may be subject to legal limitations, exceptions, and identity-verification requirements.

22. EXERCISING YOUR RIGHTS

To submit a privacy request concerning The Celestial Hours, email:

contact@thecelestialhours.com

Please provide enough information for us to identify the relevant account, order, transaction, browser, device, review, or other record and understand your request.

We may need to verify your identity before completing the request. Authorised agents may be required to provide evidence of their authority.

We will respond within the period required by applicable law.

Where applicable law gives you a right to appeal our decision, you may appeal by replying to the email that communicated the decision or by writing to contact@thecelestialhours.com . We recommend using the subject line “Privacy Appeal”.

Please include your name and contact details, the date or reference of the original request and decision, the privacy right or request concerned, and the reasons you believe the decision should be reconsidered. You may also include any additional information that you believe is relevant to the review.

We will review the appeal and respond within the period required by applicable law. If the appeal is denied, we will explain the outcome and, where required, provide information about any further complaint options available to you.

Where applicable law permits, you may also contact the competent state attorney general, data-protection authority, consumer-protection authority, or other regulator with jurisdiction over your complaint.

For personal information processed directly by Shopify for Shopify’s own consumer services or Enhanced Services, you may also use the Shopify Privacy Portal .

23. COMPLAINTS

Please contact us first if you have concerns about how personal information is handled.

Residents of the European Economic Area may also lodge a complaint with their local data-protection authority.

In Spain, the competent supervisory authority is the Agencia Española de Protección de Datos (AEPD).

24. CHILDREN

The website and products are intended for a general adult audience and are not directed to children.

We do not knowingly collect personal information from children under 13. If we become aware that personal information has been collected from a child under 13 without the authorisation required by the U.S. Children’s Online Privacy Protection Act or another applicable law, we will review the information and take appropriate steps to delete it.

Where processing is based on a child’s own consent under the GDPR, the applicable age is 16 unless the relevant national law provides for a lower age. In Spain, a person may generally consent to the processing of personal information from the age of 14, subject to any other legal requirement that may apply.

We do not knowingly sell or share the personal information of consumers under 16, and we do not knowingly use their personal information for targeted advertising.

As a matter of policy, we do not direct the website, its products, or its marketing to anyone under 16.

If you believe that a child has provided personal information to us, contact us at contact@thecelestialhours.com so that we can review the matter and, where appropriate, delete the information.

25. THIRD-PARTY WEBSITES

The website may contain links to platforms or services that we do not control.

Their collection and use of personal information are governed by their own privacy notices.

We are not responsible for the privacy, content, availability, or security practices of independent third-party websites.

26. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect operational, technological, legal, contractual, or regulatory changes.

The updated version will be published on the website with a revised “Last updated” date.

We will provide additional notice where required by applicable law.

27. CONTACT

Data controller:

Arturo González García
Trading as The Celestial Hours
NIF: 47708579R
Calle Antonio Floriano Cumbreño 8
10005 Cáceres, Spain 
Email: contact@thecelestialhours.com
Website: thecelestialhours.com