1. Data Controller
The controller responsible for processing personal data is ONARA LIFE S.L., Spanish Tax Identification Number (NIF) B05611736, registered address: Calle Nord, 43, ground floor, door 1, 08290 Cerdanyola del Vallès, Barcelona, Spain.
Contact and data protection email: [email protected].
2. Personal Data We Process
Depending on your relationship with our online store, we may process identification and contact details, billing and delivery addresses, order information, returns and refunds, transaction references, technical browsing data and preferences relating to marketing communications.
Payments are processed by specialised external providers. ONARA LIFE does not need to store complete payment card details to manage orders.
3. Purposes and Legal Bases for Processing
Purchases and Order Management
We process the data necessary to handle purchases, manage payments, prepare deliveries, provide order updates, respond to enquiries and manage returns, refunds, warranties and complaints. The legal basis is the performance of a contract or taking steps prior to entering into a contract, under Article 6(1)(b) of the GDPR.
Invoicing and Legal Obligations
We process and retain the data necessary to issue invoices, maintain accounting records and comply with tax, commercial and consumer protection obligations. The legal basis is compliance with legal obligations under Article 6(1)(c) of the GDPR.
Responding to Enquiries
We use the information you provide when contacting us to respond and carry out any necessary follow-up. Depending on the nature of the enquiry, the legal basis is taking pre-contractual steps, performance of a contract or legitimate interests.
Marketing Communications
We may send information about ONARA LIFE news, products, promotions and offers. During checkout, an optional checkbox, unticked by default, will be provided with the wording: “I would like to receive news and offers from ONARA LIFE”. Accepting marketing communications will not be required to complete a purchase.
Where marketing communications are based on consent, we will retain evidence of that consent. We may also send marketing communications to existing customers concerning our own products or services similar to those previously purchased, but only where the requirements of Article 21(2) of Spanish Law 34/2002 on Information Society Services and Electronic Commerce are met.
The legal basis is consent under Article 6(1)(a) of the GDPR, or legitimate interests where the statutory exception for existing customers applies. Every marketing email will include a free and straightforward unsubscribe mechanism. You may also opt out by emailing [email protected].
Analytics and Advertising
We use Google Analytics and Google Ads to analyse the performance of our website and measure the effectiveness of advertising campaigns. Processing activities requiring consent are activated only when users authorise them through our cookie consent management system. The legal basis is consent under Article 6(1)(a) of the GDPR.
Security and Fraud Prevention
We may process certain technical data to protect the website, prevent fraudulent activity and maintain transaction security. We use services such as reCAPTCHA, subject to the applicable consent settings. The legal basis is legitimate interests or consent where required.
4. Guest Checkout
Our store allows purchases without creating a customer account. The information provided is used to process the order and comply with the obligations arising from the transaction.
5. Recipients of Personal Data
We may disclose strictly necessary personal data to service providers involved in our operations:
- Payment providers: WooPayments and PayPal, to process transactions, manage refunds and prevent fraud.
- Delivery companies: primarily UPS and other logistics operators, to deliver products and handle delivery issues.
- Technology services: WordPress and WooCommerce for store management, and Google services relating to analytics, advertising, product visibility and security.
- Public authorities: where disclosure is required by law.
Our primary WordPress and WooCommerce hosting infrastructure is privately operated and located in Spain. We do not sell our customers’ personal data databases to third parties.
6. International Data Transfers
Although our primary infrastructure is located in Spain, certain external providers, including payment providers and Google services, may process information outside the European Economic Area.
Where international transfers of personal data occur, they must be supported by valid mechanisms under Chapter V of the GDPR, such as European Commission adequacy decisions or appropriate contractual safeguards. You may request further information by emailing [email protected].
7. Data Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal obligations.
- Orders: for as long as necessary to manage purchases, returns, warranties, complaints and legal obligations.
- Accounting and commercial documentation: for the legally required periods. As a general rule, the Spanish Commercial Code establishes a six-year retention period, without prejudice to other applicable requirements.
- Enquiries: for the time necessary to respond and address potential liabilities.
- Marketing communications: while a valid legal basis exists and consent has not been withdrawn or an objection raised. We may retain the minimum information necessary to demonstrate consent or honour an unsubscribe request.
- Browsing data: according to the retention periods applicable to each service and the user’s consent preferences.
WooCommerce currently has no automatic anonymisation periods configured for completed or refunded orders. Such data will be deleted or anonymised in accordance with applicable retention obligations and the store’s data management procedures.
8. Cookies and Similar Technologies
We use cookies necessary for the operation of the store and, where authorised by the user, analytics and advertising technologies. Complianz allows users to accept, reject or configure the relevant cookie categories.
Services requiring consent remain blocked until the user makes the relevant choice. Further information is available in our Cookie Policy (EU).
9. Data Protection Rights
Where applicable, you may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability. You may also withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, email [email protected] and describe your request. We will request additional identity verification only where necessary. We will respond within the time limits established by the GDPR.
If you believe your rights have not been adequately respected, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).
10. Information Security
We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or improper disclosure. Our store uses encrypted HTTPS connections and infrastructure access controls. Access to order information is restricted to people who need it to perform their duties.
11. Minors
Our store is not specifically intended for minors. Purchases must be made by individuals with sufficient legal capacity to enter into contracts or, where applicable, through their legal representatives.
12. Automated Decision-Making
ONARA LIFE does not use customer data to make decisions based solely on automated processing that produce legal effects or similarly significant effects. Certain payment and security providers may use automated fraud prevention mechanisms in accordance with their own privacy policies.
13. Changes to This Policy
We may update this Privacy Policy to reflect legal, technical or service-related changes. The current version will be available on our website, indicating its last update date. Where legally required, we will request consent again.
Last updated: 13 October 2026.