Privacy Policy
1. Who we are (Data Controller)
COBELIO is the art studio of Teresa Marco and Jose Viciana, where we make unique photographic reliefs in plaster. This policy explains what we do with your personal data when you visit , buy a piece, or write to us.
- Controller: COBELIO
- Address: Calle Pitágoras Nº 1, 08191 Rubí, Barcelona, Spain
- Email:
- Website:
We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. What data we collect
- Identification and contact data: name, surname, email address, telephone number.
- Order data: billing and shipping address, country, items purchased, order history, invoices.
- Payment data: we never see or store your full card number. Payments are processed directly by our payment providers, who confirm to us only the result of the transaction and the last digits of the card.
- Communications: the content of the messages you send us by email or through our contact form, including enquiries about commissions or availability.
- Browsing data: IP address, device and browser, pages visited and interactions with the site, collected through cookies and similar technologies — only those that are strictly necessary, unless you consent to the rest.
You do not have to give us anything you do not want to give us. Some fields are, however, necessary to complete a purchase or to reply to you; where that is the case, we say so at the point where we ask.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Processing and shipping your order, issuing the invoice and dealing with returns | Performance of the contract |
| Answering your enquiries, requests or commission proposals | Performance of the contract, or your consent |
| Keeping accounting, tax and commercial records | Legal obligation |
| Sending you our newsletter or news about new work | Your consent, which you may withdraw at any time |
| Operating, securing and improving the website; preventing fraud | Our legitimate interest |
| Analytics, personalisation and advertising through cookies and pixels | Your consent, given through the cookie banner |
We do not make any automated decisions that produce legal effects on you, and we do not profile you in a way that significantly affects you.
4. How long we keep it
- Order and invoicing data: for the duration of the commercial relationship and then for the periods required by Spanish law — six years under the Commercial Code and four years under tax legislation.
- Enquiries that do not lead to a purchase: for up to one year after our last exchange.
- Newsletter data: until you unsubscribe or withdraw your consent.
- Cookie data: for the period stated in our Cookies Policy.
Once those periods end, we delete or anonymise the data securely.
5. Who we share it with
We never sell your personal data. We do share it with the service providers we need in order to run the studio and the shop, all of them bound by data processing agreements:
- Payment providers: WooPayments (Stripe) and PayPal, which also make Klarna available. They process your payment data as controllers in their own right, under their own privacy policies.
- Shipping and logistics: the carriers we use to deliver your piece, who receive your name, address and telephone number so that they can complete the delivery.
- Hosting and site infrastructure: our hosting provider and Cloudflare, which serve and protect the website.
- Marketing and analytics: Google (Analytics, Ads and Merchant Center) and Meta (Facebook and Instagram), through their pixels and catalogue integrations — only where you have accepted the corresponding cookies.
- Public authorities and courts, where we are legally required to do so.
- Email delivery: MailerLite, the provider we use to manage our mailing list and send you the guide and our news, with data hosted in the European Union.
6. International transfers
Some of the providers above are based in the United States: WooPayments (Stripe), PayPal, Google and Meta. This means that your data may be transferred outside the European Economic Area. These transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, by the EU–US Data Privacy Framework, together with the additional safeguards these providers apply. You can ask us for further information at .
7. Cookies
We use cookies to make the site work, to understand how it is used and — if you agree — to show you our work on other platforms. Only the strictly necessary cookies are installed before you make a choice. You can accept, reject or change your preferences at any time from the cookie banner. Full details are in our .
8. Your rights
You may at any time ask us to:
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data (right to be forgotten).
- Restrict the processing of your data in certain cases.
- Object to processing based on our legitimate interest.
- Port your data to another provider, where applicable.
- Withdraw your consent at any time, without affecting the lawfulness of what we did before you withdrew it.
Write to or to Calle Pitágoras Nº 1, 08191 Rubí, Barcelona, Spain, stating which right you wish to exercise and attaching a copy of a valid identity document so that we know it is really you. We will reply within one month. If someone acts on your behalf, we will need proof of their authority.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, , C/ Jorge Juan 6, 28001 Madrid).
9. Security
We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encrypted connections (HTTPS) across the whole site and restricted access to the systems where the data is held. No system is completely immune to risk, but we treat your data with the same care we treat our own.
10. Minors
This website is not aimed at children. We do not knowingly collect data from anyone under 14 without the consent of a parent or guardian. If you believe a minor has provided us with personal data, please write to us and we will delete it.
11. Changes to this policy
We may update this policy to reflect changes in the way we work or in the applicable legislation. The version published on this page is always the one in force. If the change is significant, we will let you know on the website.
