Cris & ME Privacy Policy

Last updated: 31 October 2026

Cris and Me Art, S.L. (the "Company"), with tax ID B56506232 and registered office at Hoces de la Hermida 84, Madrid, registered in the Madrid Commercial Registry, volume 45990, folio 100, sheet M 808093, and contact email info@crisandme.es, is the controller responsible for processing your personal data.

The Company operates this store and website, including its data, content, features, tools, products and services (the "Services"), to offer a curated shopping experience. Cris & ME uses Shopify technology to provide these Services.

This Privacy Policy describes how the Company collects, uses and discloses your personal information when you visit, use or make a purchase or other transaction through the Services, or when you contact us in any other way. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy prevails with regard to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you confirm that you have read and understood this Privacy Policy, which describes how your personal information is collected, used and disclosed under the legal bases set out here.

1. Personal information we collect or process

By "personal information" we mean any information that identifies you or can reasonably be linked to you or another person. Depending on how you interact with the Services, we may collect or process the following categories of personal information:

• Contact details: name, address, billing address, shipping address, phone number and email address.
• Financial information: credit or debit card numbers, financial account details, transaction details, payment method and payment confirmation.
• Account information: username, password, preferences and settings.
• Transaction information: items you view, add to your cart, save to your wishlist or purchase, return, exchange or cancel, and your past transactions.
• Communications with us: the information you give us when you contact us, for example in a customer service enquiry.
• Device information: information about your device, browser, IP address and other identifiers.
• Usage information: how you interact with the Services, including how and when you browse them.

2. Cookies

We use cookies and similar technologies for the operation of the store, analytics and marketing:

• Necessary cookies (Shopify): essential for the store, the shopping cart and the checkout to work. They do not require consent.
• Analytics cookies: help us understand how the website is used (pages visited, browsing time) to improve the shopping experience.
• Marketing cookies (Omnisend): used for our email marketing communications and automations (welcome, order confirmation).
• Third-party shipment tracking cookies (AfterShip): to let you track your order.
• Advertising cookies (Meta): used by the Meta Pixel to measure the effectiveness of our ads on Facebook and Instagram and to show relevant advertising. More information in section 4.

Analytics and marketing cookies are only activated if you give your consent through the cookie banner. You can withdraw your consent or change your preferences at any time from the banner. Analytics and marketing cookies are kept for a maximum of 13 months. For more information, see our Cookie Policy.

3. Sources of personal information

We may collect personal information directly from you, automatically through the Services (including cookies), from our service providers, and from our partners or other third parties.

4. Advertising and measurement on Facebook and Instagram

On crisandme.es we use the Meta Pixel and the Meta Conversions API, tools provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). They let us know how visitors reach our website from our ads on Facebook and Instagram, measure the effectiveness of those ads and show relevant advertising to people who have already visited our store.

Data processed: information about your browsing on the website (pages visited, products viewed, items added to the cart and purchases), technical data about your device and browser and, when you make a purchase, your name and email address, which are encrypted before being sent to Meta.

Legal basis: your consent, which you give through the cookie notice. We only share this data with Meta if you accept. You can withdraw it at any time from "Manage preferences" in the cookie notice, without affecting the lawfulness of processing carried out before withdrawal.

Joint controllership: for the collection and transmission of this data to Meta, Cris and Me Art, S.L. and Meta Platforms Ireland Limited act as joint controllers. Meta's subsequent use of the data is governed by its own privacy policy, available at https://www.facebook.com/privacy/policy

International transfers: Meta may process data in the United States. Meta Platforms, Inc. participates in the EU-US Data Privacy Framework, which ensures an adequate level of protection.

Your rights: you can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@crisandme.es. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

5. How we use your personal information and legal basis

We use your personal information for the following purposes, on the following legal bases:

• To provide, personalise and improve the Services (processing payments, managing orders, shipping and returns), on the basis of performing the sales contract.
• For marketing and advertising (commercial communications and promotions), on the basis of your consent.
• For security and fraud prevention, on the basis of our legitimate interest.
• To communicate with you and provide customer service, on the basis of performing the contract and our legitimate interest.
• For legal reasons, such as regulatory compliance or requests from authorities, on the basis of our legal obligations.

6. How we disclose personal information

We may disclose your personal information to the following categories of recipients:

• Shopify, suppliers and other third parties who provide services on our behalf (IT management, payment processing, data analytics, customer service, cloud storage, order management and shipping, including Omnisend, AfterShip, Packlink and the carriers who deliver your order).
• Business and marketing partners, to provide marketing services and personalised advertising, including Meta Platforms Ireland Limited, as described in section 4.
• Third parties when you request or expressly consent to it.
• Competent authorities when there is a legal obligation.

7. Relationship with Shopify

The Services are hosted by Shopify, which processes personal information about your access to and use of the Services in order to provide and improve them. For more information about how Shopify uses your personal information, see the Shopify Consumer Privacy Policy.

8. Children's data

The Services are not intended for children under 14, and we do not knowingly collect personal information from children under that age, in accordance with the Spanish Data Protection Act (LOPDGDD). If you are the parent or legal guardian of a child who has given us their personal information, you can contact us to request its deletion.

9. Security and retention of your information

No security measure is perfect or infallible. We keep your personal information for as long as necessary to maintain your account, provide the Services, comply with legal obligations or resolve disputes.

Retention periods are determined as follows: account and transaction data are kept for the duration of the contractual relationship and then for the legal limitation periods (for example, 6 years for tax and accounting purposes); marketing data are kept until you withdraw your consent; and communication data are kept for as long as needed to handle the enquiry or complaint and then for the applicable legal periods.

10. Your rights

As a user, you have the right to:

• Access: request access to your personal information.
• Erasure: request the deletion of your personal information.
• Rectification: request the correction of inaccurate information.
• Portability: receive a copy of your information and ask for it to be transferred to a third party.
• Objection and restriction: ask us to stop or limit the processing of your information.
• Withdrawal of consent: where processing is based on your consent, withdraw it at any time, without affecting the lawfulness of prior processing.
• Managing communications: unsubscribe from our promotional emails at any time using the unsubscribe link.

You can exercise these rights by writing to info@crisandme.es. We may need to verify your identity before processing your request.

11. Complaints

If you have a complaint about how we process your personal information, please contact us first at info@crisandme.es. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

12. International transfers

We may transfer, store and process your personal information outside the country where you live. If we transfer information outside the European Economic Area or the United Kingdom, we will use recognised transfer mechanisms, such as the European Commission's Standard Contractual Clauses, unless the transfer is to a country recognised as providing an adequate level of protection.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish the updated version on this website and update the "Last updated" date.

14. Contact

If you have any questions about our privacy practices or want to exercise your rights, write to info@crisandme.es or by post to Calle de Hoces de la Hermida, 84, 28023 Madrid, Spain. For the purposes of data protection law, we are the controller of your personal information.