1. Who We Are

Company name: WATA Towels
Email: info@watatowels.com
Website: watatowels.com

WATA is the data controller for personal data collected through the website watatowels.com, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679).

2. Personal Data We Collect

We collect the following personal data depending on how you interact with our website:

Identification and contact data:

• First and last name
• Email address
• Phone number (optional)
• Delivery and billing address

Transaction data:

• Order history
• Payment method (securely processed by Shopify Payments — we do not store card data)

Browsing data:

• IP address
• Device type and browser
• Pages visited and time spent
• Cookie data (see Section 7)

Communication data:

• Messages submitted via the contact form
• Email address for newsletter subscription

3. Purposes and Legal Basis for Processing

Order fulfilment (legal basis: performance of a contract)
We use your data to process, confirm and deliver your orders, issue invoices and manage returns.

Marketing communications (legal basis: consent)
If you subscribe to our newsletter, we use your email to send communications about new products, promotions and relevant content. You may unsubscribe at any time via the link in the footer of each email.

Website improvement (legal basis: legitimate interest)
We analyse browsing data to improve user experience, optimise website performance and personalise content.

Targeted advertising (legal basis: consent)
With your consent, we use browsing and behaviour data to serve personalised advertisements via Meta Pixel and Google Ads.

Compliance with legal obligations (legal basis: legal obligation)
We retain certain data to fulfil applicable tax and legal obligations.

4. Sharing Data with Third Parties

Your data may be shared with the following service providers, solely for the purposes indicated:

• Shopify Inc. — e-commerce platform and payment processing
• Klaviyo Inc. — email marketing and automation platform
• Meta Platforms Ireland Ltd. — targeted advertising (Meta Pixel)
• Google LLC — traffic analytics (Google Analytics/GA4) and advertising (Google Ads)
• Carriers and logistics partners — for order delivery

All service providers are bound by data processing agreements ensuring levels of protection equivalent to those required by the GDPR. We do not sell or transfer your data to third parties for their own commercial purposes.

5. International Data Transfers

Some of our service providers operate outside the European Economic Area (EEA), including in the United States. In such cases, we ensure transfers are carried out under appropriate legal mechanisms, including Standard Contractual Clauses approved by the European Commission or adequacy decisions.

6. Retention Periods

• Order and billing data: 10 years (tax and legal obligation)
• Customer account data: for as long as the account is active + 3 years after last access
• Newsletter data: until unsubscription
• Browsing data and cookies: as indicated in the Cookie Policy
• Contact/support data: 3 years after last contact

7. Cookies

Our website uses cookies and similar technologies. Below is a summary of the categories used:

• Essential cookies — required for website functionality (shopping cart, user session). No consent required.
• Analytics cookies — Google Analytics/GA4, for traffic and behaviour analysis. Consent required.
• Marketing cookies — Meta Pixel and Google Ads, for targeted advertising and campaign measurement. Consent required.
• Functional cookies — Klaviyo, for personalised communications. Consent required.

You can manage your cookie preferences at any time through the cookie settings panel available on the website.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations
• Right to restriction of processing — limit the use of your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest or for direct marketing purposes
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at info@watatowels.com. We will respond within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority. In Portugal: Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt. In Belgium: Autorité de protection des données — www.autoriteprotectiondonnees.be. In the Netherlands: Autoriteit Persoonsgegevens — www.autoriteitpersoonsgegevens.nl.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure, including SSL/TLS encryption, restricted employee access to data and regular security audits. Our Shopify platform is PCI DSS certified for secure payment processing.

10. Minors

Our website is not directed at individuals under the age of 16 and we do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us so we can arrange for its deletion.

11. Changes to This Policy

We may update this Privacy Policy periodically. In the event of material changes, we will notify registered users by email and/or via a prominent notice on the website. The date of the last update is indicated at the top of this document.

12. Contact

For any questions regarding this Privacy Policy or the processing of your personal data:

Email: info@watatowels.com