Privacy policy

1. Data controller

Pholidota Studio SL
Tax ID (NIF): B06956163
Address: Calle de la Diligencia 9, 28018 Madrid (Spain)
Contact: [email protected]

Pholidota Studio SL, owner of NIAR, is the controller of the personal data collected through this website and app, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. What data we process, for what purpose and on what legal basis

Processing	Data	Purpose	Legal basis
User account	Email, password and profile data you provide.	Create and manage your account and let you sign in.	Performance of a contract (Art. 6(1)(b) GDPR).
Favourites and saved searches	Shops and products you save, searches and preferences.	Store your favourites and provide the requested feature.	Performance of a contract (Art. 6(1)(b) GDPR).
Geolocation	Approximate or precise device location.	Show you shops and products near your position.	Consent (Art. 6(1)(a) GDPR), requested by the device; withdrawable at any time.
Security and fraud prevention	Technical data (IP, behaviour) processed via Google reCAPTCHA.	Protect access and prevent abusive or automated use.	Legitimate interest (Art. 6(1)(f) GDPR) in service security.
Web analytics	Usage and browsing data (Google Analytics).	Measure site usage and improve it in aggregate.	Consent (Art. 6(1)(a) GDPR); only if you accept analytics cookies.
Support and communications	Email and the content of your enquiry.	Handle your support requests and reply to you.	Legitimate interest (Art. 6(1)(f)) or consent (Art. 6(1)(a)) as applicable.

The purposes are those described above and we do not use your data for purposes incompatible with them.

3. Retention periods

• Account and favourites data: for as long as your account is active. After closure, data is deleted or blocked during the limitation periods of applicable legal obligations, and then erased.
• Geolocation data: used on a one-off basis for the query and not kept linked to your profile unless needed for the requested feature.
• Analytics data: for the retention period configured in the analytics tool and until consent is withdrawn.
• Security and support communications: for as long as necessary for their purpose and to handle related liabilities.

4. Recipients, processors and international transfers

We do not sell your data. To provide the service, some providers access data as processors, under contract and following our instructions:

• Cloudflare, Inc. — website hosting and content delivery network.
• Google (Google Ireland Ltd. / Google LLC) — Google reCAPTCHA (security), Google Analytics (analytics, subject to consent) and Firebase (push notifications).
• Hosting and infrastructure providers necessary to operate the service and the database.

Some of these providers may process data outside the European Economic Area, in particular in the United States. Where this occurs, international transfers are carried out with the appropriate safeguards provided for in the GDPR, such as the EU-US Data Privacy Framework adequacy or the European Commission's Standard Contractual Clauses.

5. Your rights

You may exercise the following rights: access, rectification, erasure, objection, restriction of processing and data portability. You may also withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise them, write to [email protected] or to the address in section 1, identifying yourself appropriately and stating the right you wish to exercise.

If you believe the processing does not comply with the rules, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

6. Cookies

This site uses cookies and similar technologies. See the details and manage your preferences in our Cookie policy.

7. Changes to this policy

We may update this policy to reflect legal or service changes. The current version will be published on this page with its update date.