Privacy policy

This policy explains who processes your personal data when you visit or buy from nomacystore.com, what we do with it and what rights you have. As we're based in Spain and sell to customers in the UK, we apply the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as the EU General Data Protection Regulation (Regulation (EU) 2016/679) and Spain's Organic Law 3/2018.

Who is responsible for your data

  • Controller: Rubén Rodríguez Camacho, trading as Nomacy
  • Spanish tax ID (NIF): 49727903V
  • Address: Calle Ntra. Sra. de las Mercedes, 114, 21710 Bollullos Par del Condado, Huelva, Spain
  • Email: soporte@nomacystore.com
  • Phone: +34 664 56 61 71
  • Data protection officer: not applicable. Given the volume and type of processing, we're not required to appoint one.

Where your data comes from

  • From you directly, when you buy something, create an account, contact us or post a review.
  • Automatically when you browse, through cookies and similar technologies. This is explained in our cookie policy.
  • From our providers: the payment provider confirms whether your payment has gone through, and the courier tells us the status of your delivery.

What we process, why, on what legal basis and for how long

  • Handling your order. Name, delivery and billing address, email, phone number and details of what you bought. Legal basis: performance of a contract. Retention: for as long as our relationship lasts, and then for the periods required by tax and accounting law, up to six years.
  • Taking payment. Payment details are processed directly by the payment provider. We never store your full card number. Legal basis: performance of a contract.
  • Customer service, returns and guarantees. The details you give us in your enquiry and the history of the case. Legal basis: performance of a contract and, where no purchase is involved, our legitimate interest in helping you. Retention: for as long as the case is open and for the applicable guarantee and claim periods.
  • Customer account. Email, login details and order history. Legal basis: performance of a contract. Retention: until you ask us to close your account.
  • Product reviews. Name or nickname, rating, comment and any photos you choose to upload. Legal basis: consent. Retention: until you ask us to remove the review.
  • Fraud prevention. Order and device data and your IP address. Legal basis: our legitimate interest in preventing fraudulent orders and protecting customers. Retention: the same as for the order itself.
  • Cookies and analytics. Legal basis: consent. Retention: as set out in our cookie policy.
  • Google measurement and advertising. If you accept analytics or marketing cookies, the Google tag records which pages and products you view, whether you add something to your cart and whether you complete your purchase (products and amount, never your payment details), together with cookie identifiers, your IP address and details of your browser and device. We use this to see which visits and sales come from Google (free Google Shopping listings and Google Ads), to measure and improve our campaigns and, only if you accept marketing cookies, to show you Nomacy ads on Google services. If you accept marketing cookies and complete a purchase, the tag also sends Google the email address, phone number, name and address from your order, first converted into a code from which the original data cannot be read (SHA-256 hash). Google matches them against its own account data to see whether the purchase came from one of its ads, even if you used another device; Google calls this ‘enhanced conversions’. We never send these details to Google unconverted. Legal basis: consent, which you can withdraw at any time through ‘Cookie preferences’ at the bottom of every page. Retention: the duration of each cookie, as set out in our cookie policy.
  • Marketing emails. Your email address and, if you leave a purchase unfinished, what was in your cart. Legal basis: consent. Retention: until you unsubscribe.
  • Complying with legal obligations. Invoicing, accounting and guarantees. Legal basis: legal obligation. Retention: the periods set by each law.

Marketing emails

Apart from the emails needed for your order (confirmation, dispatch, tracking and any problems), we only send you marketing emails if you tick the box ‘Email me with news and offers’ at checkout, which is never ticked in advance. If you tick it, we may send you offers and news about our products and, if you leave a purchase unfinished, a reminder of what was in your cart. The legal basis is your consent. You can withdraw it at any time using the unsubscribe link in each email or by emailing soporte@nomacystore.com, and unsubscribing doesn't affect your orders.

Who else sees your data

  • Shopify, our shop platform, which hosts the website and processes card and digital wallet payments through Shopify Payments.
  • PayPal, when you choose to pay with PayPal.
  • Klarna, when you choose to pay with Klarna. Klarna processes that data as an independent controller and applies its own privacy notice.
  • Judge.me, which manages our product reviews.
  • Parcel Panel (CWILL), the app behind our order tracking page.
  • Our suppliers and warehouses in China, which prepare your order, and the courier that delivers it. They only receive what's needed for delivery: your name, address, phone number and what you bought.
  • Google (Google LLC if you're in the UK, Google Ireland Limited if you're in the EEA), only if you accept analytics or marketing cookies, through the Google tag, Google Merchant Center and Google Ads. For these uses Google acts as an independent controller and applies its own privacy policy (policies.google.com/privacy). Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.
  • Our accountants and the tax authorities, where the law requires it.

We don't sell your data. We only share it with Google for measurement and advertising if you accept this in the cookie notice, and you can withdraw that consent at any time through ‘Cookie preferences’ at the bottom of every page. If we add any other analytics or advertising tools, we'll update this list before we start using them.

Our relationship with Shopify

This shop runs on Shopify, which hosts the website, collects information about your access and use, and processes your order. Shopify processes your data on our behalf as a processor and, for some features of its own platform, on its own behalf as a controller. In that second case, it's Shopify that deals with your rights over those specific uses. You can read its policy at shopify.com/legal/privacy and exercise your rights with Shopify at privacy.shopify.com.

Links to third-party websites

This website may include links to other websites that we don't run. We don't control, and aren't responsible for, their privacy practices, so we recommend reading their policies before giving them any data. Anything you post in public areas, such as a product review, may be visible to other people.

International transfers

We're based in Spain, so your data is processed in the European Economic Area (EEA), which the UK recognises as providing an adequate level of protection. Some of our providers process data elsewhere. Shopify operates from Canada and the United States, Judge.me from the UK, and Google from Ireland and the United States. Canada is recognised as providing adequate protection by both the UK and the European Commission. Transfers to the United States rely on the EU–US Data Privacy Framework and its UK Extension, under which Google LLC is certified, or on standard contractual clauses. PayPal (Europe) is based in Luxembourg and Klarna in Sweden, both within the EEA.

Our lamps are prepared and shipped from China, which isn't recognised as providing adequate protection. To send you your order, the warehouse receives your name, delivery address, phone number and what you bought. This transfer is necessary to perform the purchase contract you ask us for (Article 49(1)(b) of the UK GDPR and the EU GDPR) and is limited to that data.

Automated decisions

We don't make automated decisions that have legal effects on you, and we don't create profiles that significantly affect you. The platform applies automatic anti-fraud filters to orders; if an order is flagged as suspicious, we review it manually before deciding anything.

Children

This shop isn't aimed at children, and we don't knowingly collect data from anyone under 13 in the UK (14 in Spain), the age from which the law allows a person to consent to the processing of their data online. If you're a parent or guardian and believe a child has given us personal data, email us and we'll delete it.

Security

We apply reasonable technical and organisational measures to protect data against loss, unauthorised access or alteration. The whole website runs over an encrypted connection, and access to order data is limited to the people who need it to handle orders. No system is infallible, so please don't send us sensitive information through insecure channels.

Your rights

You have the right to access, rectify and erase your data, to object to and restrict its processing, and to data portability. You can withdraw any consent you've given at any time, without affecting the lawfulness of the processing carried out before you withdrew it.

Email soporte@nomacystore.com telling us which right you'd like to exercise. We may ask you to verify your identity before dealing with your request. You can also authorise someone to make the request on your behalf, with proof that you've authorised them. We'll reply within one month at most.

We won't treat you any less favourably for exercising any of these rights.

If you think we haven't handled your request properly, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. As we're based in Spain, you can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos), calle Jorge Juan 6, 28001 Madrid, Spain, at www.aepd.es.

Changes to this policy

We may update this policy when our processing changes or for legal reasons. We'll publish the current version here with its date and, if the change is significant, we'll let you know.

Last updated

3 November 2026