Privacy policy

Last updated: September 2026

This policy explains what personal data we collect when you visit shambhalabarcelona.com, shop with us or get in touch, what we use it for, who we share it with and what rights you have. We keep it as simple as we can.

1. Who is responsible for your data

  • Company: Shambhala Europe S.L. (trading as Shambhala Barcelona)
  • NIF: B66575523
  • Registered address: Calle Numancia 117-121, 1º 2ª, 08029 Barcelona, Spain
  • Email: info@shambhalabarcelona.com

2. What data we collect

  • Order data: name, email, phone number, shipping and billing address, the products you buy and your order history.
  • Payment data: payments are processed directly by our payment providers. We never see or store your full card details.
  • Account data: if you create an account, the details linked to it.
  • Newsletter: your email address and language, if you subscribe.
  • Messages: what you send us by email, through the contact form or by Instagram DM.
  • Reviews: your name, rating, review text and any photos you choose to upload.
  • Browsing data: device, browser, pages visited and similar information collected through cookies, as explained in section 8.

3. Why we use it and on what legal basis

  • To process and deliver your order, handle returns and exchanges, and answer your questions: performance of the contract with you.
  • To issue invoices and keep accounting and tax records: legal obligation.
  • To send you our newsletter and your welcome discount: your consent. You can unsubscribe at any time from the link in every email.
  • To invite you to review a product after your purchase: our legitimate interest in hearing from our customers. You can opt out at any time.
  • To measure how the website is used and show you relevant ads on Instagram and Facebook: your consent, given through the cookie banner.
  • To prevent fraud and keep the website secure: our legitimate interest.

4. Who we share it with

We never sell your data. We share it only with the providers we need to run the shop, and only as much as each one needs:

  • Shopify: hosts our online store, checkout and customer data, and sends our emails.
  • Shopify Payments and PayPal: process your payment.
  • Correos, UPS and envia.com: deliver your order and handle returns.
  • Judge.me: sends review requests and publishes the reviews you choose to leave.
  • Meta (Facebook and Instagram): advertising and measurement, only if you accept marketing cookies.
  • Google (Google Analytics): website statistics, only if you accept analytics cookies.
  • Our tax and accounting advisors, and public authorities when the law requires it.

5. International transfers

Some of these providers (such as Shopify, PayPal, Meta and Google) may process data outside the European Economic Area, mainly in the United States. When they do, the transfer is protected by the EU-US Data Privacy Framework or by the Standard Contractual Clauses approved by the European Commission.

6. How long we keep it

  • Order and invoice data: for as long as the law requires, generally six years.
  • Newsletter: until you unsubscribe.
  • Messages and customer service: for as long as we need them to help you, and then deleted.
  • Reviews: while they are published, or until you ask us to remove them.
  • Cookies: for the duration of each cookie, as described in the cookie banner.

7. Your rights

You can ask us at any time to access, correct or delete your data, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it whenever you like.

Just write to info@shambhalabarcelona.com and tell us what you need. We will reply within one month. If you think we have not handled your data properly, you can also file a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Cookies

We use essential cookies to make the shop work, for example to keep items in your cart. We only use analytics and marketing cookies (Google Analytics and Meta Pixel) if you accept them in the cookie banner. You can change your choice at any time, and you can also delete cookies from your browser settings.

9. Minors

Our shop is not aimed at children under 14, and we do not knowingly collect their data.

10. Security

We use secure, encrypted connections (SSL) and trusted providers to protect your data, and only the people who need it to serve you can access it.

11. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date.