Privacy policy

Last updated: 26 August 2026

1. Who is responsible for your personal data

The controller of the personal data described in this policy is:

Manuel Dreesmann, a self-employed sole trader in Spain, trading as Manuel Dreesmann and Atelier Madre
Carrer del Rec 20, Baixa 2
08003 Barcelona, Spain
NIF: Y4714701Z
EU VAT number: ESY4714701Z
Email: info@manuel-dreesmann.com
Telephone: +34 605 575 325
Website: www.manuel-dreesmann.com

In this policy, “we”, “us” and “our” refer to Manuel Dreesmann. “You” means a visitor, customer, account holder, newsletter subscriber or other person who interacts with us.

2. Scope of this policy

This policy explains how we collect, use, disclose and retain personal data when you:

visit or use our website and online store;
create or use an account;
place or receive an order;
request a personalised or made-to-order product;
contact us by email, telephone, form or website chat;
subscribe to marketing communications;
visit our physical shop or otherwise interact with us; or
exercise a privacy right or manage your cookie and data-sharing choices.

It also explains the cookies, pixels, tags, local storage and similar technologies used on our website.

The website is hosted by Shopify. Shopify provides the commerce platform, checkout, customer accounts and related services that allow us to operate the store.

3. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

Identity and contact data: name, billing and delivery address, email address, telephone number, account identifiers and, where needed for customs or legal compliance, tax or identification information.
Order and transaction data: products viewed or ordered, sizes, colours, initials or other customisation instructions, order number, price, currency, discounts, payment status, delivery method, tracking information, returns, refunds and correspondence about an order.
Payment and fraud-prevention data: payment method, billing details, transaction identifiers, authentication results, risk indicators and limited card details such as card brand and last digits. Full payment-card credentials are normally collected directly by the payment provider and are not stored by us.
Account data: login and account status, saved addresses, preferences and account activity.
Communications and content: emails, chat messages, form submissions, product enquiries, support requests, reviews, photographs or other content you send to us.
Marketing and preference data: newsletter status, consent records, language, country or region, communication preferences, referral and campaign information, and advertising choices.
Device and usage data: IP address, browser and device type, operating system, approximate location derived from IP, language, time zone, cookie or pixel identifiers, pages and products viewed, clicks, scrolling, referring page, session information, cart and checkout events, and diagnostic or security logs.
Inferences and audience data: interests or likely preferences inferred from website and campaign interactions, where permitted and subject to your choices.

Please do not send us sensitive personal data unless it is genuinely necessary and we have requested it. If you order for another person or provide their delivery details, you must be authorised to provide that information and should tell them about this policy.

4. How we obtain personal data

We obtain personal data:

directly from you when you order, create an account, complete a form, chat with us, subscribe, contact us or exercise a right;
automatically from your browser or device through Shopify, server logs, cookies, pixels, tags and similar technologies;
from payment providers, delivery companies and fraud-prevention services in connection with a transaction;
from advertising, analytics and affiliate partners when you interact with a campaign or arrive through a referral link; and
from another person, for example when someone purchases a gift for you or names you as the recipient.

5. Purposes and legal bases

Where the EU General Data Protection Regulation (“GDPR”), UK GDPR or a comparable law applies, we rely on the legal bases below. More than one basis may apply to the same information in different circumstances.

Purpose	Data typically used	Legal basis
Provide the website, cart, checkout, customer account and requested website functions	Identity, contact, account, device, session, preference and cart data	Performance of a contract or steps requested before a contract under Article 6(1)(b) GDPR; our legitimate interest in operating a secure and usable store under Article 6(1)(f) GDPR
Process, make, personalise, fulfil and deliver orders; handle returns, refunds and warranties	Identity, contact, order, customisation, payment-status, delivery and communication data	Performance of a contract under Article 6(1)(b) GDPR
Process payments, authenticate transactions and manage chargebacks	Identity, contact, order, payment, device and fraud-risk data	Performance of a contract under Article 6(1)(b) GDPR; compliance with financial and accounting obligations under Article 6(1)(c) GDPR; legitimate interests in preventing loss and fraud under Article 6(1)(f) GDPR
Provide customer service through email, forms, telephone and Shopify Inbox	Identity, contact, order and communication data	Performance of a contract or pre-contract steps under Article 6(1)(b) GDPR; legitimate interests in answering enquiries and improving customer service under Article 6(1)(f) GDPR
Prevent fraud, abuse, unauthorised access and other security incidents	Account, transaction, device, network, authentication and risk data	Legal obligations where applicable under Article 6(1)(c) GDPR; legitimate interests in protecting customers, our store and our legal rights under Article 6(1)(f) GDPR
Keep tax, accounting, customs, product-safety and other legally required records; respond to authorities	Identity, contact, order, payment-status, delivery and communication data	Compliance with a legal obligation under Article 6(1)(c) GDPR
Establish, exercise or defend legal claims and resolve disputes	Relevant account, order, payment, delivery, communication and technical records	Legitimate interests in protecting and enforcing legal rights under Article 6(1)(f) GDPR; legal obligations where applicable under Article 6(1)(c) GDPR
Send requested newsletters and promotional messages	Identity, contact, purchase history, interests and marketing preferences	Consent under Article 6(1)(a) GDPR; for similar products offered to existing customers, legitimate interests only where applicable marketing law permits this and always with a simple opt-out under Article 6(1)(f) GDPR
Measure website use and improve pages, navigation and products using non-essential analytics tools	Device, cookie, session and interaction data	Consent under Article 6(1)(a) GDPR where required, including for non-essential analytics in the EEA and UK; otherwise our legitimate interest in improving the store, subject to applicable law, under Article 6(1)(f) GDPR
Measure campaigns, attribute sales, create audiences and deliver or personalise advertising	Device, cookie, referral, interaction, order and conversion data	Consent under Article 6(1)(a) GDPR where required. We do not rely on legitimate interests for non-essential personalised-advertising cookies in the EEA or UK
Record and apply cookie, privacy and data-sharing choices	Consent record, region, browser, device and request data	Compliance with legal obligations under Article 6(1)(c) GDPR; legitimate interests in demonstrating and respecting your choices under Article 6(1)(f) GDPR
Operate and improve the business using aggregated or de-identified reporting	Aggregated order, product and usage information	Legitimate interests in business planning and service improvement under Article 6(1)(f) GDPR. We use personal data only where necessary and de-identify it where reasonably possible

When processing is based on consent, you may withdraw consent at any time without affecting processing that occurred before withdrawal. When processing is based on legitimate interests, we consider the necessity of the processing, its effect on you and safeguards such as minimisation, access controls, aggregation and opt-outs.

If information is required to enter into or perform a contract, refusing to provide it may mean that we cannot create an account, process an order, deliver a product or answer a related request. Optional marketing and analytics choices do not affect your ability to purchase.

6. Shopify services

Shopify International Limited and other Shopify group companies provide the infrastructure used to operate this store. Depending on the feature you use, Shopify may process identity, contact, account, order, payment, device, browsing, security and support data for:

the online storefront, cart, checkout, customer accounts, hosting and security;
Shopify Payments, Shop Pay, login with Shop and the Shop app;
Shopify Forms and Shopify Inbox chat;
store analytics, fraud detection and customer privacy controls;
Shopify Collabs referral or creator-attribution functions; and
Shopify Network Intelligence and related enhanced services, where enabled.

For core store functions, Shopify generally processes personal data on our behalf. For certain services, such as Shop, Shop Pay, payment, security, legal compliance or Shopify’s own enhanced services, Shopify may also act as an independent controller under its own notices. Read Shopify’s Consumer Privacy Policy and Cookie Policy.

Where applicable, you may use our data-sharing opt-out page to opt out of qualifying use or disclosure of personal data for targeted advertising, sale or sharing. This opt-out is separate from the cookie choices described in Section 9.

7. Other recipients and service providers

We disclose personal data only as reasonably necessary for the purposes described in this policy. A provider’s role as our processor, joint controller or independent controller depends on the service and the provider’s own purposes.

Payments and fraud prevention

Shopify Payments and Shop Pay: process checkout, payment, authentication, fraud screening, refunds and chargebacks. Shopify privacy information
PayPal: processes payments when PayPal is selected and may independently perform identity, fraud and legal checks. PayPal Privacy Statement
Apple Pay and Google Pay: transmit tokenised payment credentials when you choose the relevant wallet. Apple Privacy Policy and Google Privacy Policy
Payment-card networks: American Express, Mastercard, Visa and UnionPay may receive transaction and authentication data when their cards are used. Their own privacy notices apply to processing they perform independently.

Payment processing is necessary to perform the purchase contract and to meet legal obligations. Payment and fraud providers may transfer data internationally and may retain transaction records under financial law.

Delivery

UPS: receives the recipient’s name, delivery address, telephone or email where needed, parcel information, customs information and delivery instructions to transport and track orders. UPS Privacy Notice

We may use another carrier where shown at checkout or agreed with you. Delivery disclosures are necessary to perform the purchase contract and, for customs documentation, to comply with law.

Email, forms and customer communication

Klaviyo: provides newsletter subscriptions, email marketing, audience management and, where enabled with consent, onsite behaviour and campaign measurement. It may process name, email address, subscription status, purchase and product events, browsing events, campaign interactions, device information and identifiers. Transactional messages may also be sent through connected store systems. Klaviyo Privacy Notice
Shopify Forms: collects information you submit through a Shopify form, such as your email address and marketing preferences.
Shopify Inbox: provides website chat and may process messages, contact details, order context and device or session data needed to deliver the chat.

We use contract or legitimate interests for requested service communications and consent for optional electronic marketing, except where applicable law permits messages about similar products to existing customers. Every marketing email includes an unsubscribe method.

Analytics, experience and website improvement

Google Analytics and Google Ads: Google Analytics measures visits, traffic sources, devices, website interactions and ecommerce events. Google Ads is used for campaign measurement and conversion attribution. These services are connected through Shopify’s Google & YouTube channel. Google may process online identifiers, IP and device or request information, page and event data, campaign information, order values and conversion data. Where consent is required, non-essential analytics, advertising storage and advertising personalisation are controlled by your cookie choices. Depending on the consent-mode configuration, Google may receive limited technical request and consent-status signals when storage is denied, where permitted by applicable law. Google Privacy Policy
Shogun: provides page-building and page-performance functionality. Its code may process browser, device, page, session and interaction data to display, operate and analyse Shogun-built pages. Shogun Privacy Policy

Non-essential analytics technologies are used only with consent where required.

Consent management

Shopify Customer Privacy provides the website’s cookie banner, preference controls, regional consent settings and consent records. It may process your consent status, category choices, country or region, browser and device information, request data and technical identifiers needed to store and apply your choices.

This processing is necessary to comply with privacy and cookie-law obligations and supports our legitimate interest in recording and respecting your choices. Technologies used only to store or apply a privacy choice are treated as strictly necessary. You can change or withdraw your choices at any time through the Cookie preferences control in the website footer. Read Shopify’s Cookie Policy.

Advertising, conversion measurement and referrals

Pinterest: Pinterest technologies connected through Shopify may measure campaigns, conversions and audiences. They may process device and cookie identifiers, browsing and product interactions, referral data and purchase or conversion events. Pinterest Privacy Policy
Meta Platforms, including Facebook and Instagram: Meta technologies connected through Shopify’s Facebook & Instagram channel may measure campaign results, attribute conversions and create audiences. Depending on your choices, Meta may process browser or device identifiers, referral information, product interactions and purchase or conversion events. Meta Privacy Policy
Shopify Collabs: supports creator, affiliate and referral attribution. It may process referral parameters, browser or device information, page and product events, and conversion or order identifiers.
Multifeeds for Google Shopping by WoolyTech: creates and synchronises product feeds with connected sales and advertising platforms. Where its tracking functions are enabled, it may also relay permitted ecommerce and conversion events to connected services. WoolyTech Privacy Policy

We use non-essential advertising, conversion, attribution and audience technologies only with consent where required. Some US privacy laws use the terms “sale”, “sharing” or “targeted advertising” broadly. Applicable requests can be made through our data-sharing opt-out page.

Store presentation, translation and product options

LangShop by Aheadworks: provides language and localisation functions and may process language, locale, page and technical request data. LangShop Privacy Policy
Variant Image Wizard and Swatch by ProductWiz: displays product variants, images and swatches and may process technical request data and product or variant interactions. ProductWiz Privacy Policy
Globo Product Options: provides product-option and customisation fields and may process the selections, text, files or other customisation information you submit for an order. Globo Privacy Policy
Tabs Studio by Station: displays product information in tabs and may process limited device and request data needed to load the feature. Station Privacy Policy
Other storefront and content-delivery providers: theme, font, review, media and content-delivery services may receive limited technical request data, such as IP address, browser information and the requested page or asset, where necessary to display and secure the website.

These services are used to provide requested storefront and product functions, perform or prepare a contract, and support our legitimate interest in presenting the store efficiently. Any non-essential analytics performed through them is subject to consent where required.

Professional, legal and business recipients

We may also disclose relevant data to accountants, legal advisers, insurers, IT and security providers, auditors, banks, tax or customs authorities, courts, regulators and law-enforcement bodies where necessary to obtain professional services, comply with law, protect rights or respond to a valid request. If the business or relevant assets are reorganised, transferred or sold, data may be disclosed to advisers and a successor subject to appropriate safeguards and applicable law.

8. Cookies and similar technologies

Cookies are small text files placed on a browser or device. We also use pixels, tags, local storage, software development tools and server-side event transmission. These technologies can remember a cart or language, keep the store secure, save a privacy choice, measure use, attribute a sale or support advertising.

Cookie categories

Strictly necessary: required for security, network management, cart, checkout, payment, account, language or consent-recording functions requested by you. These technologies are not used for optional advertising and do not require consent where the law permits their use without it.
Preferences and functional: remember optional choices or provide enhanced features. We request consent where these technologies are not strictly necessary for a service you requested.
Analytics: help us understand visits, page performance and customer journeys. We request consent where required, including in the EEA and UK.
Marketing: measure campaigns, attribute sales, create audiences or personalise advertising. We request consent before using these technologies where required.

Current cookie and storage schedule

The table below describes cookies and similar identifiers identified in our current store configuration and additional cookies the configured services may set when the relevant feature is used. “Session” means until the browser session ends. Durations are typical maximums and may be shortened by browser settings, provider changes or your deletion of cookies.

Provider and category	Cookies or storage	Purpose	Typical duration
Shopify: strictly necessary	`_shopify_essential`, `_shopify_test`, `keep_alive`, `secure_customer_sig`, `_secure_session_id`, `cart`, `cart_sig`, `cart_currency`, `localization`, `discount_code`, `shopify_pay`, `shopify_pay_redirect`, `login_with_shop_finalize`, `cookietest`, `wpm-domain-test`	Store security, sessions, cart, checkout, currency, country or language, discounts, Shop or Shop Pay login and cookie capability	Session to 1 year; cart-related cookies are generally 2 weeks; login-test cookies may last only a few minutes
Shopify: strictly necessary consent records	`_tracking_consent`, `_cmp_a` and related Shopify consent records	Store, retrieve and apply privacy and cookie choices	Generally up to 1 year
Shopify: analytics	`_landing_page`, `_orig_referrer`, `_shopify_s`, `_shopify_y`, `_shopify_analytics`, `_shopify_sa_p`, `_shopify_sa_t`, `_shopify_d`	Traffic source, session and storefront-performance measurement	About 30 minutes to 1 year; landing and referral cookies are generally 2 weeks
Shogun: analytics	`_shg_session_id`, `_shg_user_id`	Distinguish sessions and visitors on Shogun-built pages	About 30 minutes and 1 year respectively
Google Analytics: analytics	`_ga`, `_gid`, `_gat`, related `_ga_*` cookies and similar identifiers	Distinguish visitors and sessions, throttle requests and measure website and ecommerce use	`_ga` cookies up to 2 years; `_gid` about 24 hours; `_gat`about 1 minute
Klaviyo: analytics and marketing	`__kla_id` and Klaviyo browser or local-storage identifiers	Associate permitted onsite and campaign activity with a browser or subscriber and support email attribution	Up to 2 years; browser restrictions may shorten this
Google Ads: marketing	`_gcl_au`, `IDE` and related Google advertising identifiers	Conversion measurement, campaign attribution, frequency control and, with consent, advertising personalisation	Commonly about 90 days for `_gcl_au`; `IDE` may last up to about 13 months depending on region and configuration
Meta: marketing	`_fbp` and related Meta pixel identifiers, where enabled	Measure advertising, attribute conversions and create audiences	Commonly up to 90 days
Pinterest: marketing	`_pin_unauth`, `_pinterest_ct_ua`, `_epik`, `_derived_epik`, `_routing_id`, `_pin_aem` and related identifiers, where set	Conversion measurement, campaign attribution and audiences	Commonly up to 1 year
Shopify: marketing	`_shopify_marketing` and permitted Shopify pixel identifiers	Store marketing data for storefront or checkout surfaces and support permitted attribution	Up to 1 year

The exact set can vary by page, country, browser, login status, payment method and consent choice. A service may use a pixel or server-side event without placing a browser cookie. We periodically review this schedule after changing themes, applications or pixels.

9. Your cookie choices

Where consent is required, you can accept or reject non-essential categories through the cookie banner. Rejecting analytics or marketing cookies does not prevent you from browsing or purchasing, although some optional features and measurement may be reduced.

You can change or withdraw your choices at any time using the Cookie preferences control in the website footer. Withdrawal does not affect processing that occurred before withdrawal. You can also delete or block cookies in your browser, but doing so may remove your saved choice and may affect cart, checkout, account or localisation functions.

Cookie consent and a data-sharing opt-out serve different purposes:

use Cookie preferences to allow or reject analytics, preferences and marketing technologies on your device; and
use the data-sharing opt-out page to opt out of qualifying sale, sharing or targeted-advertising processing under applicable privacy law.

We recognise universal opt-out signals such as Global Privacy Control where applicable law requires us to do so. Browser “Do Not Track” signals are not standardised and may not be acted on unless required by law.

10. International transfers

We are established in Spain, but Shopify and several providers listed above operate internationally. Personal data may therefore be processed outside Spain, the European Economic Area (“EEA”), the United Kingdom or your country, including in Canada and the United States.

Where European data-protection law requires a transfer safeguard, we rely as appropriate on:

an adequacy decision adopted by the European Commission or relevant UK authority, including the EU-US Data Privacy Framework for a certified recipient where applicable;
approved Standard Contractual Clauses, the UK International Data Transfer Addendum or another approved transfer mechanism; and
supplementary technical, contractual or organisational measures where appropriate.

You may contact us for more information about the safeguard relevant to a transfer and, where available, a copy of it. Provider privacy notices linked in Section 7 contain further information about their locations and transfer practices.

11. Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, including contractual, accounting, tax, customs, warranty, dispute and legal-compliance requirements. We use the following criteria:

Orders, invoices, payments, shipping and returns: for the transaction and warranty period and then for applicable tax, commercial-record and limitation periods. Commercial records may need to be retained for six years under Spanish law, and particular information may be retained longer where a claim, audit or legal hold applies.
Customer accounts: while the account is active and afterwards for a limited period needed to close the account, prevent fraud, resolve requests and meet recordkeeping duties. Transaction records are not automatically deleted when an account is closed if law requires their retention.
Enquiries and customer support: until the request is resolved and afterwards for the period reasonably needed for follow-up, quality control or legal claims.
Marketing records: until you unsubscribe, withdraw consent or we determine that the contact is no longer active, plus a minimal suppression record so that we can respect the opt-out.
Cookie and privacy choices: for the duration shown in the cookie schedule and as reasonably necessary to demonstrate compliance and respect the choice.
Analytics and advertising data: according to our account settings, the cookie schedule and the connected provider’s retention controls. We aggregate, anonymise or delete this information when it is no longer needed for the stated purpose.
Security logs and fraud records: for the period reasonably necessary to investigate incidents, protect the store and establish or defend claims.

When retention is no longer justified, we delete or anonymise the data unless deletion is technically impossible in a backup, in which case the backup remains protected and is removed under the normal backup cycle.

12. Your rights

Depending on where you live and the law that applies, you may have the right to:

request confirmation of whether we process your personal data and obtain access to it;
correct inaccurate or incomplete personal data;
request deletion;
restrict processing;
receive data you provided in a structured, commonly used and machine-readable format and transmit it to another controller where the right to portability applies;
object to processing based on legitimate interests, including profiling based on those interests;
object at any time to direct marketing and related profiling;
withdraw consent at any time;
opt out of qualifying targeted advertising, sale or sharing of personal data;
appeal our refusal of a request where applicable US state law provides that right; and
complain to a competent data-protection authority.

To exercise a right, email info@manuel-dreesmann.com or use our data-sharing opt-out page for the opt-outs available there. Please describe your request and the country or state in which you reside. We may need to verify your identity and authority before acting. You may use an authorised agent where applicable law permits it, but we may require proof of authorisation.

We will respond within the period required by applicable law. Exercising a right is normally free, although we may charge a lawful fee or refuse a manifestly unfounded or excessive request. Some rights are subject to exceptions, including information we must retain for tax, accounting, fraud-prevention, warranty or legal-claim purposes.

If you are in Spain, you may complain to the Agencia Española de Protección de Datos (AEPD) at www.aepd.es. If you live elsewhere in the EEA or UK, you may contact the supervisory authority in your habitual residence, place of work or place of the alleged infringement. We would appreciate the opportunity to address your concern first.

13. Automated decisions and profiling

Shopify, payment providers and fraud-prevention services may use automated indicators to identify suspicious transactions, account abuse or payment risk. This can result in a payment being declined, an order being held for review or a temporary restriction. Advertising and analytics providers may also use permitted interaction data to create audiences or infer interests, but we do not use that profiling to make decisions that produce legal or similarly significant effects on you.

We do not ordinarily make decisions based solely on automated processing that have a legal or similarly significant effect. If you believe an automated decision has materially affected you, contact us so that we can explain the available review options.

14. Security

We use reasonable technical and organisational measures appropriate to the nature of the data and the risks, including access controls, secure communications, service-provider controls, account authentication and minimisation. No internet transmission or storage system is completely secure. You should protect your account credentials and tell us promptly if you suspect unauthorised use.

15. Children

The store is not directed to children and we do not knowingly use children’s data for behavioural advertising. A minor may purchase only with the permission and supervision required by applicable law. If you believe a child has provided personal data without appropriate authorisation, contact us so that we can investigate and take appropriate action.

16. External websites and social media

Our website may link to Facebook, Instagram, TikTok or other third-party websites. Following a link may allow that third party to collect information under its own privacy policy. A link alone does not mean that we control the third party’s processing. Review the relevant service’s privacy and account settings before interacting with it.

17. Changes to this policy

We may update this policy when our services, providers, technology or legal obligations change. The date at the top shows when the current version was last updated. If a change materially affects how we use data already collected, we will provide any additional notice or obtain any consent required by law.

18. Contact

Questions, requests and complaints about privacy can be sent to:

Manuel Dreesmann
Carrer del Rec 20, Baixa 2
08003 Barcelona, Spain
info@manuel-dreesmann.com
+34 605 575 325