Privacy Policy

Last updated: 24 September 2026

At ABANUC we take care of your personal data. This policy explains what data we process, why, for how long and what your rights are, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on information society services and electronic commerce (LSSI).

1. Data controller

  • Controller: BOXNOX, S.L. (ABANUC)
  • Tax ID (NIF): B84084474
  • Address: C/ Guzmán el Bueno, 127, 28003 Madrid (Spain)
  • Email: abanuc@abanuc.com
  • Telephone: +34 91 446 51 21

2. What data we process

  • Identification and contact data: first name, last name, email, telephone, shipping and billing address.
  • Purchase data: products, amounts, order history, returns and incidents.
  • Payment data: payment method and transaction confirmation. Full card details are processed directly by the payment providers; ABANUC does not store them.
  • Customer account data: login credentials and preferences.
  • Communications: what you tell us by email, telephone, WhatsApp, chat or forms.
  • Browsing data: IP address, device, browser, pages visited and interaction with the website and our emails, through cookies and similar technologies, according to your preferences.

We do not process special categories of data. Our services are not aimed at children under 14.

3. Why we use your data and on what legal basis

  • To manage your orders (payment, shipping, delivery, returns, guarantees and customer service). Legal basis: performance of the sales contract (Art. 6(1)(b) GDPR).
  • To manage your customer account, if you choose to create one. Legal basis: performance of the contract.
  • To answer your enquiries and complaints. Legal basis: your request and our legitimate interest in responding (Art. 6(1)(b) and 6(1)(f) GDPR).
  • To send you our newsletter and marketing communications by email or SMS about new products, promotions and products. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI). If you are already a customer, we may send you emails about products similar to those you purchased, unless you object (Art. 21(2) LSSI). You can unsubscribe at any time using the link included in every communication.
  • To personalise our communications based on your purchases and your interaction with our emails and the website. Legal basis: your consent and our legitimate interest. We do not make automated decisions that produce legal effects concerning you.
  • Analytics and advertising through non-essential cookies. Legal basis: your consent, which you can withdraw at any time.
  • To prevent fraud and ensure the security of the website and payments. Legal basis: our legitimate interest.
  • To comply with legal obligations relating to accounting, tax and consumer law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. How long we keep your data

  • Order and billing data: for the duration of the commercial relationship and thereafter for the legally required periods (6 years for accounting records under Article 30 of the Spanish Commercial Code, and the applicable tax limitation periods).
  • Customer account: until you ask us to close it.
  • Newsletter and marketing communications: until you unsubscribe or withdraw your consent.
  • Enquiries and complaints: for as long as necessary to resolve them and thereafter for the limitation periods of any possible liability.
  • Cookies: for the periods set out in section 9.

5. Who we share your data with

We do not sell your data. We only share it with providers who render services to us and act as data processors, under contract and with appropriate safeguards, or where required by law:

  • Shopify: online store platform and, where applicable, card payment processing.
  • Payment providers: PayPal, Google Pay and Klarna, when you choose these methods. Klarna may process your data as an independent controller to assess instalment payments.
  • Transport and logistics: GLS and Sendcloud, to deliver your orders.
  • Klaviyo: sending our newsletter, store emails and SMS, and measuring opens and interaction.
  • Analytics and advertising: Google (Google Analytics and Google Ads) and Hotjar, only if you have accepted the corresponding cookies.
  • Consent management and privacy requests: Consentmo.
  • Other technology providers: website translation (Transcy), affiliate programme (Affiliatly), internal management and invoicing (Odoo) and website security.
  • Public authorities, courts and tribunals, where there is a legal obligation.

Relationship with Shopify. Shopify hosts the store and processes data about your access and use in order to provide its service to us. In addition, to protect and improve the store, we use Shopify features that use data from your interactions with our store, with other merchants and with Shopify; for those purposes, Shopify acts as a data controller. You can read the Shopify Consumer Privacy Policy and exercise your rights with Shopify through its privacy portal.

6. International transfers

Some providers, such as Shopify, Klaviyo and Google, may process data outside the European Economic Area, mainly in the United States and Canada. In such cases, the transfer is based on adequacy decisions of the European Commission (Canada and, for certified US companies, the EU-U.S. Data Privacy Framework) or on the standard contractual clauses approved by the European Commission. Klaviyo, in particular, stores data in the United States, is certified under the EU-U.S. Data Privacy Framework and also applies standard contractual clauses.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time and free of charge, and withdraw any consent you have given, without affecting the lawfulness of processing carried out before its withdrawal.

To do so, write to us at abanuc@abanuc.com or by post to the address in section 1, or use our privacy requests page. We may ask you for additional information to verify your identity. We will reply within one month, which may be extended by two further months for complex requests.

If you consider that we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid) or with the supervisory authority of your country of residence.

8. Security

We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or alteration. If a security breach were to result in a high risk to your rights, we would notify you without undue delay, in accordance with the GDPR.

9. Cookie policy

Cookies are small files stored on your device when you visit a website. At ABANUC we use our own and third-party cookies:

  • Technical or strictly necessary (Shopify, Consentmo): these enable the store to work (basket, checkout, login, security) and remember your cookie preferences. They do not require consent.
  • Preference cookies (Shopify, Transcy): these remember your language, country and currency.
  • Analytics cookies (Google Analytics, Hotjar, Shopify): these help us understand how the website is used so that we can improve it.
  • Advertising and marketing cookies (Google Ads, Klaviyo, Affiliatly): these measure the effectiveness of our campaigns and allow us to show you more relevant communications and ads.

Apart from technical cookies, we only set cookies if you accept them in the cookie banner. You can accept, reject or configure them by category, and change your choice at any time using the cookie preferences link on the website. Rejecting them does not prevent you from shopping. Cookies last from the browsing session up to a maximum of 2 years, depending on the provider. You can also block or delete cookies in your browser settings (Chrome, Safari, Firefox or Edge), although some store features may stop working.

10. Changes to this policy

We may update this policy to reflect legal changes or changes to our services. We will always publish the current version on this page, with its date of update.