Privacy policy

Your data accompanies your order. Here we explain how we use it and how you can exercise your rights.

Last updated: 5 November 2026.

1. Data controller

The controller is Anna Huang, with NIF X8701088G, trading under the brand Yumi & Co. Address: Carrer d’Olot 35, 08227 Terrassa, Barcelona, España. Contact: info@yumiandco.com.

2. Data we process

Depending on your relationship with the store, we process the data you provide when purchasing, creating an account, subscribing or contacting us: name, email address, telephone number, addresses, order contents and history, payment information and messages. The platform may also collect technical data, such as IP address, browser and device, to provide and protect the service. Optional technologies are managed according to your preferences.

Mandatory fields are necessary to process the purchase or handle the request; without them, it may not be possible to provide that service. Avoid including unnecessary personal data in messages.

3. Purposes and legal bases

  • Manage purchases and accounts: prepare orders, manage payments, deliveries, returns and issues, and answer related enquiries. Basis: performance of the contract and pre-contractual steps requested by you.
  • Meet legal obligations: invoicing, accounting and compliance with applicable tax, consumer protection or food safety obligations. Basis: compliance with legal obligations.
  • Handle general enquiries and protect the store: respond to messages and prevent abuse or fraud. Basis: our legitimate interest in assisting those who contact us and maintaining a secure service, balanced against your rights.
  • Send news and promotions: when you subscribe voluntarily. Basis: your consent. You can withdraw it using the unsubscribe link or by writing to us. Purchasing does not require accepting advertising.
  • Use optional technologies: for the purposes described in the Cookie policy, when enabled and accepted by you. Basis: consent.

4. Service providers and recipients

To run the store, we use technology platform, payment, transport and professional support providers. They access the information needed for their functions; when acting on our behalf, they do so under the relevant data-processing terms. We also provide data to authorities and public bodies when required by a legal obligation.

The store uses Shopify for its e-commerce platform. Shopify processes data on our behalf to provide these services under its data processing agreement. The store has enabled Shopify Network Intelligence. In its enhanced services, Shopify also acts as controller for the processing it determines to develop and improve analytics, personalisation and advertising services, which may link interactions with this store, other stores and Shopify. This processing is described in its Consumer privacy policy. Personalised advertising and optional technologies requiring consent are subject to your consent, which you can withdraw.

Advertising and measurement with Meta (Facebook and Instagram). With your consent for the relevant purposes, we use the Facebook & Instagram by Meta channel, Meta Pixel, Conversions API and advanced matching to measure conversions, attribute purchases to campaigns and personalise or optimise ads. The integration may share with Meta the pages and products you view, searches, cart actions, checkout steps and purchases, together with click and browser identifiers, technical data and, where you have provided them, your name, email address, telephone number and address. Collection and sharing for these optional purposes are subject to your privacy choices, including when events are sent between servers. You can accept, reject or change these purposes through “Cookie preferences”. Meta may associate the information with your account and process it under its Privacy Policy. Its off-Meta activity controls are also available.

5. International transfers

Shopify may process data outside the European Economic Area. Depending on the destination and service, it uses adequacy decisions or other GDPR safeguards, including standard contractual clauses. You can consult its information on transfers and request information from us about the safeguards applicable to the store’s service providers.

Using Meta services may involve international transfers. You can consult how Meta transfers and safeguards information in its Privacy Policy and request information from us about the applicable safeguards.

6. How long we keep data

We keep data for as long as necessary to manage the order, account or enquiry. Afterwards, we retain only the information needed to comply with statutory periods and address potential liabilities. Promotional data is used until consent is withdrawn, retaining, where appropriate, the minimum information needed to demonstrate and respect your choice. Each cookie’s duration is stated in its specific information.

7. Your rights

Where applicable, you may request access, rectification, erasure, objection, restriction and portability, and exercise the rights concerning solely automated decisions recognised by the GDPR. You may withdraw consent without affecting the lawfulness of earlier processing.

Write to info@yumiandco.com stating your request. We will ask for additional information to verify your identity only when necessary. We will respond without undue delay and within one month at most. If the complexity or number of requests requires it, we may extend the period by a further two months, informing you of the extension and its reasons within the first month.

You may lodge a complaint with the Spanish Data Protection Agency. For processing for which Shopify is the controller, you can also use its privacy controls.

8. Updates

We will review this policy when our processing changes and inform you of significant changes where appropriate. You can also consult our Legal notice and the Cookie policy.