Privacy policy

CASTA NOBLE, S.L., Spanish tax ID (NIF) B63983258, Passeig de Torras i Bages, 117, 08030 Barcelona (España). Registro Mercantil de Barcelona, Tomo 37990, Folio 196, Hoja B-314370. Contact for any privacy matter: info@castanoble.com or +34 932 200 650. We are not required to appoint a data protection officer (Article 34 LOPDGDD); we deal with every request personally.

The data marked as mandatory in each form are those strictly necessary to serve you; if they are not provided, we will not be able to process the order or request. Purchases are restricted to people aged 18 or over.

If you provide us with data relating to third parties, you guarantee that you are entitled to do so, and we will only use them for the purpose for which you give them to us.

Important: we never see or store your card number. Payment is made directly on the secure systems of our payment gateway.

• Order and billing data: for as long as the relationship lasts and, afterwards, blocked for the statutory periods — 4 years for tax purposes (Spanish General Tax Act, Ley General Tributaria) and 6 years for commercial records (Article 30 of the Spanish Commercial Code, Código de Comercio).
• Customer account: for as long as you keep it active. You can ask us to delete it whenever you like: we will close your account and delete everything we are not required to keep. The data of your orders and invoices are kept blocked for the statutory periods indicated above.
• Commercial communications: with your consent, until you withdraw it; as a customer (Article 21(2) LSSI), up to 3 years from your last purchase or until you object, if earlier. If you unsubscribe or object, we keep your email address and the record of your decision only in order to respect it and be able to prove it.
• Invitations to publish a review and their associated identifiers will be kept for a maximum of 12 months. Published reviews will be kept for as long as they remain published and are necessary to inform other customers about the experience with our products, without prejudice to the exercise of the rights recognised by data protection law. Data used exclusively to verify the authenticity of the review will be limited to what is strictly necessary.
• Reviews that are not published because they do not comply with our publication rules are deleted 30 days after they are reviewed.
• If you object to receiving invitations to rate your purchases, we keep that preference for as long as you maintain it, so as not to write to you again.
• Unfinished-order reminder: if the basket is not completed, it is deleted 30 days after it was last modified. Only one reminder is sent per basket. If you object to receiving them, we keep that preference for as long as you maintain it, so as not to write to you again.
• Technical server logs (which include the IP address): 12 months, for website security, fraud prevention and error diagnosis.
• Proof of your consents and objections to commercial emails (which text you saw and when): for as long as we send you those emails and for a further 3 years, the period within which a claim could be brought regarding their sending. It does not include your IP address.
• Customer service enquiries: the time needed to resolve them and to prove that they were resolved.
• Copies of the emails we send you (order confirmation and tracking, invoices, account notifications) and the result of their delivery: 6 years, the period that commercial law sets for business correspondence (Article 30 of the Spanish Commercial Code), so that we can prove what we told you and deal with complaints.

We do not sell your data to anyone. We only disclose it to those who need to be involved in serving you, and always with the appropriate safeguards:

• Lista Robinson — Asociación Española de la Economía Digital (Adigital), Spain: before sending advertising to customers who have not given us their consent, we check your email address against this advertising opt-out system (Article 23(4) LOPDGDD), so as not to write to anyone who has registered on it.
• Payment gateway — Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA): processes payment by card (including Apple Pay or Google Pay), Bizum and, if you pay from another country, PayPal or your local method (iDEAL, Bancontact, MB WAY, Satispay or EPS). If you pay while signed in to your account, Stripe also keeps a customer record with your name, email, telephone and billing address, in order to link your payments. The transfer to the USA is covered by the EU-U.S. Data Privacy Framework, under which Stripe is certified, with standard contractual clauses as an additional safeguard.
• PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): only if you choose to pay with PayPal (available if you pay from outside Spain); it receives the payment data and processes your PayPal account in accordance with its own privacy policy.
• Address autocomplete — Google (Google LLC, USA, certified under the Data Privacy Framework): receives, through our server, the address text you type in order to return suggestions. No Google cookies or identifiers in your browser.
• Reviews of our shop on Google (Google LLC, USA, certified under the Data Privacy Framework): when you reach the “How we're rated on Google” strip (on the home page and at the bottom of product pages), your browser loads a Google Maps component to display the rating, and Google receives your IP address and the technical browser data needed to serve it. If you do not reach that section, it is not loaded.
• Sign-in with your Google account (Google LLC, USA, certified under the Data Privacy Framework): only if you choose “Continue with Google” to sign in. Google verifies your identity and provides us with your name and email address (verified by Google), which we use only to create your account or sign you in; we do not retain the profile photo that Google also sends. We do not share any information about your orders, addresses or invoices with Google. You can unlink Google at any time from “Profile” (we delete your Google account identifier from your shop account) and withdraw permission in your Google account settings; your shop account will continue to work with an email code.
• Analytics and advertising — Google and Meta (Google Ireland Ltd. and Meta Platforms Ireland Ltd., Ireland, with possible transfers to the USA under the Data Privacy Framework): only if you accept it in the cookie notice, separately for each purpose, do they receive technical data about your browsing (public pages visited, products viewed and, if you make a purchase, the amount) to measure use of the shop and the results of our advertising. We do not send them your name, email address, postal address or telephone number. Details are in the Cookie policy.
• Logistics — Sendcloud B.V. (Netherlands, EEA) and the carriers that deliver your order (depending on the destination: Correos Express, Correos, InPost or others shown during checkout): they receive your name, address, telephone and email for the delivery and its notifications.
• Email delivery — Resend, Inc. (USA), processor: delivers order confirmations, shipping notifications and the codes for signing in to your account. Although the emails are sent from its European region, Resend processes and stores the service data (message content and delivery logs) in the United States: the transfer is covered by standard contractual clauses and the Data Privacy Framework.
• Hosting: our servers are in the European Union.
• Public authorities, banks and advisers: when a legal obligation requires it (for example, tax).

If we add payment methods with another provider, we will update this list.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by writing to info@castanoble.com (state which right you are exercising and, if necessary, information that allows us to verify your identity). We will reply within one month at the latest; if the request is complex or we receive a large number of requests, that period may be extended by two further months, and we will tell you so within the first month.

If you consider that we have not properly handled your rights, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD; www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the data protection supervisory authority of the EU country where you live, work or where you believe the infringement took place. We would, however, appreciate the opportunity to resolve it directly with you first.

We do not take automated decisions with legal effects concerning you, nor do we carry out profiling beyond reminding you of products similar to those you have already bought. If you accept advertising cookies, Meta and Google may use your browsing on this website to show you Castanoble ads; you can withdraw that consent whenever you like from “Cookie settings”.

We apply appropriate technical and organisational measures: encryption of communications (HTTPS), passwords that are not stored in plain text or in reversible form (only a cryptographic representation derived from them), restricted access to data and daily backups. We keep an internal record of processing activities in accordance with Article 30 GDPR.

Our international line (+34 932 200 650) is answered by Ainhoa, an artificial intelligence voice assistant. At the start of the call you are told that you are speaking to an AI and that the call is recorded (Regulation (EU) 2024/1689, Article 50, and Article 13 GDPR), and you are referred to this policy.

• What is processed: the audio recording of the call, its transcript, the telephone number you are calling from and the content of your enquiry. The assistant also estimates the tone or sentiment of the conversation for internal analysis of service quality.
• Order status: if you ask us about the status of an order, the assistant looks it up in our system using the order number and postcode you give, and only tells you the status and the shipping dates; it does not give out any other order details by telephone.
• Purpose: to answer and handle your enquiry, keep a record of what was discussed and improve the quality of the service.
• Legal basis: legitimate interests (Article 6(1)(f) GDPR) in the quality, security and evidence of our communications and, where the call concerns an order, the management of the contractual relationship (Article 6(1)(b)).
• Retention: recordings and transcripts are kept for 3 months on the assistant's platform, and a backup copy of the recording for 6 months on our telephone system, unless they need to be kept longer to deal with a complaint or comply with a legal obligation. The log of each call (number, date and duration) is kept for 2 years on our telephone system, to deal with complaints and keep a record of our communications.
• Providers: the voice assistant platform is Retell AI, Inc. (USA), which acts as a processor (Article 28 GDPR) and processes the data in the United States; the international transfer is covered by the safeguards of Chapter V of the GDPR (standard contractual clauses). The telephone system is Level 7 Systems Ltd (VoIPstudio, United Kingdom), which also acts as a processor and stores the data in the European Economic Area.

The assistant does not take automated decisions with legal effects concerning you: it provides information and, when necessary, puts you in touch with a member of the team. You can exercise your rights as set out in section 5. We recommend that you do not give sensitive data by telephone, nor more information than is necessary for your enquiry.

Analytics and advertising cookies are only installed with your consent. Full details are in the Cookie policy.