Política de privacidad
What we hold, why we hold it, and the extra rules for anything about a child
Written to be read rather than skimmed past. The section on children's data is the one that matters most here: a head measurement is used to pick a size and then it goes away.
Last updated 15 August 2026
Who is responsible for your data
The controller of the personal data collected through this site is COSTA Y SOLER SL, trading as Chapelin, of Avenida de la Marina Alta 141, 03740 Gata de Gorgos, Alicante, Spain. You can reach us about anything in this policy at support@costaysoler.shop or on +34 1608015921.
Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD). The supervisory authority is the Agencia Española de Protección de Datos (AEPD).
What we collect, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone, delivery address | Taking and fulfilling your order, delivery, after-sales contact | Performance of the contract (Art. 6.1.b) |
| Order contents, amounts, invoices | Issuing invoices, tax and accounting records, handling returns and guarantee claims | Legal obligation (Art. 6.1.c) |
| Contact form entries | Answering your enquiry and keeping a record of the answer | Consent (Art. 6.1.a) and our legitimate interest in customer service |
| Group order enquiries | Preparing a written quotation and repeating an order later | Steps prior to a contract (Art. 6.1.b) |
| Child age band and head measurement, if you send them to us | Recommending a size. Nothing else | Consent of the parent or guardian (Art. 6.1.a) |
| Marketing email address, if you opt in | Occasional product emails | Consent (Art. 6.1.a), withdrawable at any time |
| Technical logs and strictly necessary cookies | Keeping the site secure and the bag working | Legitimate interest (Art. 6.1.f) |
| Measurement and marketing cookies | Aggregated statistics and advertising measurement | Consent (Art. 6.1.a), off by default |
We do not ask for and do not want special category data. We do not collect payment card numbers: cards are entered on the secure page of the payment provider configured for this store and never reach our servers.
Data about children
Our customers are adults. Our products are for children. That means some of the information we handle is about a child even though it comes from a parent, and it is treated with more care than anything else on this site.
- A parent or guardian provides it. We never collect an age or a measurement from a child directly, and no part of this site invites a child to enter anything.
- It is used to recommend a size, and for nothing else. An age band and a head circumference in centimetres are used to return a size. They are never used to build a profile, to segment an audience or to target advertising.
- The Grow Fit planner runs in your browser. What you type into it is not transmitted to us at all unless you choose to include it in an enquiry or an order note.
- Retention is capped at 12 months. Where a measurement does reach us, it is deleted no later than twelve months after we receive it, and sooner if you ask.
- No marketing automation is triggered by a child. We do not send “time to size up” emails, birthday emails, or any message generated from a child's age or growth. Our emails are the same for every subscriber.
- No child's name. We do not ask for one and we ask you not to give one. If a name reaches us in a free-text field we remove it.
- Deletion on request, no questions. Write to support@costaysoler.shop and we delete every measurement held against your orders and enquiries, keeping only what invoicing law requires.
Age of the account holder. Orders may be placed only by persons aged 18 or over. We do not knowingly allow anyone under 13 to submit personal data through this site; where a person between 13 and 17 contacts us, we act only with the involvement of a parent or guardian. If you believe a child has sent us data, write to support@costaysoler.shop and we will delete it.
How long we keep things
- Order and invoicing records: for the period required by Spanish tax and commercial law, currently six years from the end of the relevant financial year.
- Guarantee-related records: for the three-year guarantee period plus one year, so that a late claim can still be checked.
- Contact messages and group enquiries: 24 months, then deleted.
- Child age band and head measurement: a maximum of 12 months, and less on request.
- Marketing consent and subscriber address: until you withdraw consent, plus a record of the withdrawal itself.
- Cookie choices: 12 months, after which we ask again.
Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing. Data is disclosed only to the processors we need in order to run the shop, each under a written data processing agreement:
- the hosting and application platform that serves this site,
- the database provider that stores orders and enquiries,
- the transactional email provider that sends confirmations,
- the payment provider configured for this store, which handles the card transaction directly with you,
- carriers, which receive the delivery address and phone number,
- our accountants and, where legally required, tax and consumer authorities.
International transfers. Some providers operate outside the European Economic Area. Where that is the case, transfers are made under an adequacy decision or, in its absence, the European Commission's standard contractual clauses together with the supplementary measures required after assessment. You can ask us for a copy of the safeguards applied to a particular transfer.
Your rights
You may at any time ask us to:
- confirm whether we hold data about you, and give you a copy,
- correct anything inaccurate,
- delete data we no longer need, including any measurement about a child,
- restrict processing while a dispute is resolved,
- port data you gave us to another controller in a machine-readable form,
- object to processing based on our legitimate interest, and withdraw consent at any time without affecting what was done before.
Write to support@costaysoler.shop. We reply within one month and tell you at once if we need to extend that, and why. Exercising these rights is free.
You also have the right to complain to the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, if you believe we have handled your data wrongly.
Security
The site is served over HTTPS. Access to order data is restricted to the staff who need it, and administrative access requires individual accounts. We keep no card data of any kind.
If a breach occurs that is likely to result in a risk to your rights, we notify the AEPD within 72 hours and tell you directly where the risk is high.
Changes to this policy
If we change this policy we update the date at the top of the page. Where a change materially affects how we use data you have already given us, we tell you by email before it takes effect.
Contacto
support@costaysoler.shop+34 1608015921
COSTA Y SOLER SL · Avenida de la Marina Alta 141, 03740 Gata de Gorgos, Alicante, Spain