Privacy policy and legal notice
Last updated: August 2026
1. Data controller
In compliance with Spanish law (LSSI-CE):
- Owner: Estela Martínez (Chromara Studio)
- Tax ID (NIF): 17496391S
- Registered address: C/ Sta. Teresa de Jesús, 2C, 28909 Getafe, Madrid (Spain)
- Email: info@chromarastudio.com
- Phone: +34 644 98 31 25
2. Data we collect
We collect only the data needed to process your order: name, shipping address, email and, if you contact us, whatever you choose to give us. Payment data is processed entirely by Stripe and we never store it.
3. Purpose
Your data is used only to manage your order, to contact you about production and shipping, and to meet our legal obligations (invoicing, tax).
4. Legal basis (GDPR)
- Performance of the sales contract (Art. 6.1.b GDPR)
- Compliance with legal obligations (Art. 6.1.c)
- Consent, where it applies (Art. 6.1.a)
5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to info@chromarastudio.com. You may also file a complaint with the Spanish data protection authority, the AEPD.
6. Cookies
We ask you the first time you visit. Until you accept, we do not load Google Analytics or store anything of its on your device.
Rejecting is as easy as accepting, and you can change your mind any time from the Cookies link in the footer of any page. If you say nothing, we take that as a no.
What we store, and what for:
- Necessary, always on. We do not ask permission for these, because without them the shop does not work.
- chromara-cart: what is in your cart. It stays in your browser and never reaches us.
- user_region: whether you see prices in euros or dollars. Lasts 30 days.
- chromara_cookies: your answer to this question and the date. Lasts 12 months, then we ask again.
- Measurement, only if you accept. Google Analytics, to see which pages are useful to you and which are not. We use no advertising cookies, we do not combine this data with anything, and we neither sell nor share information with anyone.
Google processes that data as a processor and may transfer it outside the European Economic Area under the safeguards of the EU-US adequacy framework.
7. Payments
Payments are processed by Stripe Inc. (USA) under its own privacy policy and under the international transfer safeguards approved by the European Commission.
8. Data retention
Data linked to orders is kept for the legal minimum (5 years for tax purposes). Contact details you give voluntarily are kept until you ask us to delete them.