Privacy Policy

Last updated: September 16, 2026

cedarloria (“cedarloria,” “we,” “us,” or “our”) operates https://cedarloria.com and the related online store, content, features, purchasing functions, and services (collectively, the “Services”).

Our ecommerce store is hosted by Shopify, which provides the ecommerce platform that enables us to offer the Services.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you visit or use the Services, place an order, create an account, subscribe to communications, contact us, or otherwise interact with cedarloria.

It also explains the rights and choices that may be available to you under applicable data-protection law, including the EU General Data Protection Regulation (“GDPR”) and applicable Spanish data-protection law.

1. Who Is Responsible for Your Personal Data

Where cedarloria determines why and how personal data is processed, cedarloria acts as the relevant data controller.

Our contact details are:

cedarloria
Website: https://cedarloria.com
Email: amentwarnack93@hotmail.com
Phone: +34 696 60 14 65
Business Address:
Calle de San Enrique de Oss6 151
28055 Madrid
Esparia

2. Personal Data We Collect

Depending on how you interact with the Services, we may collect the following categories of personal data.

Contact Information

This may include:

• Your name;

• Email address;

• Telephone number;

• Billing address; and

• Shipping address.

Order and Transaction Information

This may include:

• Products viewed or purchased;

• Shopping-cart activity;

• Order history;

• Purchase amounts;

• Discounts or promotions used;

• Returns;

• Refunds;

• Delivery information;

• Order status; and

• Communications relating to an order.

Payment-Related Information

Payments are processed by Shopify and authorised third-party payment providers.

cedarloria does not ordinarily receive or store complete payment-card numbers.

We may receive limited payment or transaction information necessary to:

• Confirm transactions;

• Prevent fraud;

• Process refunds;

• Resolve payment issues; and

• Maintain legally required transaction records.

Account Information

If customer-account functionality is available, we may collect:

• Account or login information;

• Saved addresses;

• Saved preferences;

• Order history; and

• Account activity.

Device and Usage Information

When you use the Services, we and our service providers may automatically collect information such as:

• IP address;

• Browser type;

• Device type;

• Operating system;

• Device identifiers;

• Cookie identifiers;

• Network information;

• General location derived from an IP address;

• Referring websites or pages;

• Pages viewed;

• Products viewed;

• Links clicked;

• Cart activity;

• Session information; and

• Other interactions with the Services.

Marketing and Preference Information

This may include:

• Newsletter subscriptions;

• Marketing preferences;

• Advertising preferences;

• Cookie choices;

• Privacy choices;

• Responses to promotions; and

• Interactions with marketing communications.

Communications and Customer-Service Information

We may collect information you voluntarily provide when communicating with us, including:

• Emails;

• Customer-service enquiries;

• Return or refund requests;

• Product reviews;

• Feedback;

• Photographs;

• Videos; and

• Other information you choose to provide.

3. How We Collect Personal Data

We may collect personal data in the following ways.

Directly From You

For example, when you:

• Place an order;

• Create an account;

• Provide billing or shipping information;

• Complete a form;

• Subscribe to communications;

• Request a return or refund;

• Submit a review; or

• Contact customer support.

Automatically

We and our service providers may collect information automatically using technologies such as:

• Cookies;

• Pixels;

• Tags;

• Log files;

• Scripts;

• Local storage;

• Device identifiers; and

• Similar technologies.

From Service Providers and Partners

We may receive information from third parties that assist us in operating the Services, including:

• Shopify;

• Payment processors;

• Fraud-prevention providers;

• Analytics providers;

• Advertising and marketing providers;

• Fulfilment providers;

• Warehouses;

• Delivery carriers;

• Returns providers; and

• Customer-service or technology providers.

4. How We Use Personal Data

We may use personal data to:

• Provide and operate the Services;

• Process payments;

• Confirm and manage orders;

• Fulfil purchases;

• Arrange shipping and delivery;

• Provide tracking information;

• Process returns, replacements, and refunds;

• Provide customer support;

• Create and maintain customer accounts;

• Save customer preferences;

• Send transactional and service-related communications;

• Send order, delivery, security, account, and policy updates;

• Detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity;

• Protect customers, our website, systems, and business;

• Analyse how customers use the Services;

• Maintain and improve our website, products, Services, and customer experience;

• Personalise content or product recommendations where permitted;

• Measure marketing and advertising performance;

• Provide or evaluate advertising where permitted by law;

• Send promotional communications where legally permitted;

• Maintain business, accounting, tax, and transaction records;

• Comply with legal, regulatory, contractual, and law-enforcement obligations;

• Establish, exercise, or defend legal claims; and

• Enforce our Terms of Service and other policies.

We seek to collect and process only personal data that is reasonably necessary for the relevant purpose.

5. Lawful Bases for Processing

Where the GDPR requires a lawful basis for processing, the basis we rely upon depends on the purpose and circumstances of the processing.

Performance of a Contract

We may process personal data where necessary to enter into or perform a contract with you, including to:

• Process an order;

• Accept payment;

• Fulfil a purchase;

• Arrange delivery;

• Provide customer support;

• Process a return; or

• Issue a refund.

Compliance With a Legal Obligation

We may process personal data where necessary to comply with applicable legal obligations, including obligations relating to:

• Tax;

• Accounting;

• Consumer protection;

• Regulatory compliance;

• Product safety;

• Fraud prevention; or

• Valid legal or governmental requests.

Legitimate Interests

Where permitted by applicable law, we may process personal data where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and freedoms.

These interests may include:

• Operating and improving our business;

• Providing effective customer service;

• Protecting our website and systems;

• Preventing and detecting fraud;

• Understanding website performance;

• Maintaining appropriate business records; and

• Establishing, exercising, or defending legal claims.

Consent

Where required, we may rely on your consent for activities such as:

• Certain marketing communications;

• Non-essential cookies;

• Certain analytics technologies;

• Personalisation technologies;

• Advertising technologies; and

• Other processing requiring consent.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. Cookies and Similar Technologies

cedarloria, Shopify, and other service providers may use cookies, pixels, tags, scripts, local storage, and similar technologies to:

• Operate the website;

• Maintain shopping-cart and checkout functionality;

• Authenticate users;

• Remember preferences;

• Protect against fraud;

• Understand website usage;

• Measure website performance;

• Analyse interactions;

• Measure marketing effectiveness;

• Personalise content where permitted; and

• Provide or evaluate advertising.

Some technologies may be technically necessary to provide Services requested by the user or to enable essential website functionality.

Other technologies, including certain analytics, personalisation, and advertising cookies, may require prior consent under applicable Spanish and EU rules.

Where consent is required, non-essential cookies or similar technologies will not be used until the required consent has been obtained.

You should be able to reject or manage applicable non-essential cookies through the cookie controls made available on https://cedarloria.com.

Where consent has been provided, it may be withdrawn through the available cookie-management controls.

Disabling certain technologies may affect features such as:

• Account access;

• Shopping carts;

• Saved preferences;

• Personalisation; or

• Checkout.

7. Marketing Communications

We may send marketing communications only where permitted by applicable law.

Depending on the circumstances, this may include situations where:

• You have provided valid consent; or

• Applicable law permits communications to an existing customer concerning our own similar products or services.

Where marketing is permitted, we will provide an appropriate method to object or unsubscribe.

If you receive promotional emails from cedarloria, you may unsubscribe using the unsubscribe mechanism included in the message.

You may also contact:

amentwarnack93@hotmail.com

to object to the use of your personal data for direct marketing.

Opting out of promotional communications does not prevent us from sending necessary non-promotional communications concerning:

• Orders;

• Payments;

• Shipping;

• Returns;

• Refunds;

• Accounts;

• Security; or

• Customer-service matters.

8. Advertising and Privacy Choices

We may work with advertising, analytics, and marketing providers to:

• Understand customer interactions;

• Measure advertising performance;

• Attribute conversions;

• Personalise marketing where permitted; and

• Provide or evaluate advertising.

These activities may involve information such as:

• Cookies;

• Pixels;

• Device identifiers;

• IP addresses;

• Browsing activity;

• Product-viewing activity;

• Cart activity; and

• Purchase interactions.

Where consent is required for advertising or tracking technologies, those technologies will be subject to the applicable consent choices.

cedarloria does not exchange personal data for money.

Some jurisdictions outside the European Economic Area may use terms such as “sale,” “sharing,” or “targeted advertising” for certain advertising-related processing.

Where such laws apply to cedarloria and provide an applicable opt-out right, eligible individuals may exercise that right using available privacy controls or by contacting us.

9. How We Disclose Personal Data

We may disclose personal data where reasonably necessary to the following categories of recipients.

Shopify

Shopify hosts and supports our ecommerce store and processes personal data in connection with providing ecommerce and related services.

Payment and Financial-Service Providers

We may disclose necessary information to:

• Payment processors;

• Banks;

• Financial-service providers; and

• Fraud-prevention providers

for purposes including payment authorisation, transaction processing, refunds, verification, and fraud prevention.

Fulfilment and Delivery Providers

We may disclose information necessary to fulfil orders to:

• Fulfilment providers;

• Warehouses;

• Logistics providers;

• Delivery carriers; and

• Returns providers.

Technology and Business-Service Providers

We may use providers supporting:

• Website functionality;

• Information technology;

• Cloud infrastructure;

• Data storage;

• Customer support;

• Email delivery;

• Analytics;

• Security; and

• Fraud prevention.

Advertising and Marketing Providers

Subject to applicable law and your choices, we may disclose certain information to advertising, analytics, and marketing providers for:

• Measurement;

• Attribution;

• Personalisation; or

• Advertising.

Professional Advisers

We may disclose information where reasonably necessary to:

• Lawyers;

• Accountants;

• Auditors;

• Insurers; and

• Other professional advisers.

Government and Legal Authorities

We may disclose personal data to courts, regulators, government authorities, law-enforcement bodies, or other authorised parties where:

• Required by law;

• Required by valid legal process;

• Necessary to investigate fraud or unlawful activity;

• Necessary to establish or protect legal rights; or

• Necessary to protect the rights or safety of customers or others.

Business Transactions

If cedarloria is involved in a merger, acquisition, financing, restructuring, sale of assets, transfer of business, or similar transaction, relevant personal data may be disclosed to prospective or actual purchasers, advisers, or successors, subject to appropriate safeguards.

10. Shopify

Our ecommerce store is powered by Shopify.

Depending on the service involved, Shopify may process customer personal data on behalf of cedarloria and may also process certain information for purposes described in Shopify's own privacy notices.

Customers using Shopify consumer services such as Shop or Shop Pay may have a separate relationship with Shopify.

We encourage customers to review Shopify's applicable privacy notices for further information about Shopify's processing practices and available privacy rights.

11. International Transfers of Personal Data

cedarloria is based in Spain.

Shopify and other service providers may process, store, or access personal data in countries outside Spain or outside the European Economic Area (“EEA”).

Where a transfer to a country outside the EEA is subject to GDPR international-transfer restrictions, we will rely on an appropriate lawful mechanism where required.

Depending on the circumstances, this may include:

• A European Commission adequacy decision;

• Standard Contractual Clauses approved by the European Commission;

• Binding Corporate Rules;

• Another appropriate safeguard recognised by the GDPR; or

• A permitted derogation for a specific situation where applicable.

Where appropriate, additional assessments or supplementary safeguards may also be implemented to protect transferred personal data.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and as required or permitted by applicable law.

Retention periods may depend on:

• The type of personal data;

• The purpose of processing;

• The duration of our relationship with you;

• Whether an account remains active;

• Tax and accounting requirements;

• Transaction-record requirements;

• Product-guarantee or return periods;

• Fraud-prevention requirements;

• Legal and regulatory obligations;

• Dispute resolution; and

• The need to establish, exercise, or defend legal claims.

When personal data is no longer reasonably required, we may delete, anonymise, aggregate, or securely dispose of it, subject to applicable legal obligations.

13. Security

We use reasonable administrative, organisational, and technical safeguards designed to protect personal data against:

• Unauthorised access;

• Unauthorised disclosure;

• Accidental loss;

• Misuse;

• Alteration; and

• Destruction.

However, no internet transmission, website, network, database, or electronic storage system can be guaranteed to be completely secure.

Customers are responsible for protecting their passwords, account credentials, and authentication information.

If you believe your account or personal information has been compromised in connection with cedarloria, please contact us promptly.

Where a personal-data breach occurs, we will take the steps required by applicable data-protection law, including notification to the relevant supervisory authority or affected individuals where legally required.

14. Your GDPR Data Protection Rights

Subject to applicable legal conditions and exceptions, you may have the following rights.

Right of Access

You may request confirmation of whether we process your personal data and obtain access to qualifying personal data and related information.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete personal data.

Right to Erasure

In certain circumstances, you may request deletion of your personal data.

This right is not absolute and may be subject to legal exceptions.

Right to Restriction of Processing

In certain circumstances, you may request that processing of your personal data be restricted.

Right to Data Portability

Where applicable, you may request qualifying personal data in a structured, commonly used, machine-readable format.

Where technically feasible and legally applicable, you may request that qualifying data be transmitted to another controller.

Right to Object

You may have the right to object to processing based on legitimate interests.

You have the right to object at any time to processing of your personal data for direct-marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Rights Relating to Automated Decisions

Where applicable, you may have the right not to be subject to certain decisions based solely on automated processing, including profiling, where the decision produces legal effects or similarly significantly affects you.

These rights are subject to the conditions and exceptions established by applicable law.

15. How to Exercise Your Privacy Rights

To exercise an applicable privacy right, please contact:

Email: amentwarnack93@hotmail.com

Where possible, use the subject line:

Privacy Request

Please describe your request and provide sufficient information for us to identify the relevant records.

We may request additional information where reasonably necessary to verify your identity and protect personal data from unauthorised access or disclosure.

We will respond within the period required by applicable law.

For rights exercised under the GDPR, we will generally respond within one month of receiving the request.

Where permitted because of the complexity or number of requests, this period may be extended by up to a further two months, and we will provide the notice required by law.

Exercise of GDPR rights is generally free of charge.

However, applicable law may permit a reasonable administrative fee or refusal to act where a request is manifestly unfounded or excessive, particularly where requests are repetitive.

An authorised representative may submit a request where permitted by applicable law, subject to appropriate verification of identity and authority.

16. Privacy Rights Outside the EEA

Customers located outside Spain or the European Economic Area may have additional privacy rights under laws applicable in their jurisdiction.

Depending on applicable law, these may include rights to:

• Access personal information;

• Correct inaccurate information;

• Request deletion;

• Obtain a portable copy;

• Opt out of direct marketing;

• Opt out of targeted advertising;

• Opt out of processing treated as a sale or sharing; or

• Appeal certain privacy-request decisions.

These rights apply only where the relevant law applies to cedarloria and the particular processing activity.

17. Children's Privacy

The Services are intended for a general shopping audience and are not specifically directed towards children.

We do not knowingly collect or process children's personal data in circumstances prohibited by applicable law.

Where parental or guardian authorisation is legally required for processing a child's personal data, we will seek to comply with the applicable requirements.

If you believe a child has provided personal data to us inappropriately, please contact:

amentwarnack93@hotmail.com

so that we can review the matter and take appropriate action.

18. Third-Party Websites and Services

The Services may contain links to websites, applications, platforms, or services operated by independent third parties.

Their privacy and security practices are governed by their own policies.

cedarloria does not control and is not responsible for the privacy practices of independent third parties.

We encourage you to review the applicable privacy notice before providing personal data directly to an independent third party.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our operations;

• The Services;

• Technology;

• Service providers;

• Privacy practices;

• Advertising practices; or

• Legal and regulatory requirements.

When this Policy is updated, we will publish the revised version on https://cedarloria.com and update the “Last updated” date.

Where applicable law requires additional notice or consent for a material change, we will provide such notice or obtain consent as required.

20. Complaints to the AEPD

If you have a concern about how cedarloria processes your personal data, please contact us so that we can review the matter.

You may also have the right to lodge a complaint with the competent supervisory authority.

For cedarloria's establishment in Spain, the relevant national supervisory authority is the:

Agencia Española de Protección de Datos (AEPD)

Contacting cedarloria first does not remove any right you may have to lodge a complaint with the AEPD or another competent data-protection authority.

21. Contact Us

For privacy questions, requests, or complaints, please contact:

Privacy Contact — cedarloria

Website: https://cedarloria.com
Email: amentwarnack93@hotmail.com
Phone: +34 696 60 14 65
Business Address:
Calle de San Enrique de Oss6 151
28055 Madrid
Esparia