Privacy policy

PRIVACY POLICY

Last updated: March 2026

Who We Are VIII28 ("we", "us", "our") operates the online store at viii28.com. Our registered address is Passeig de Joan de Borbó, 08003 Barcelona, Spain. VAT: ESY8455141X. Contact: info@viii28.com.

What Data We Collect We collect the following personal data when you interact with our store:

  • Contact information: name, email address, phone number
  • Billing & shipping information: delivery address, payment details (processed securely — we never store full card details)
  • Order & transaction data: purchase history, order status
  • Device & usage data: IP address, browser type, pages visited, time spent on site (via Google Analytics 4)
  • Marketing preferences: email subscription status and engagement (via Klaviyo)

How We Use Your Data We use your data to:

  • Process and fulfil your orders
  • Send order confirmations and shipping updates
  • Respond to customer service enquiries
  • Send marketing emails if you have opted in (you can unsubscribe at any time)
  • Analyse store performance and improve your shopping experience (GA4)
  • Comply with legal obligations

Legal Basis for Processing (GDPR) We process your data under the following legal bases:

  • Contract performance: to fulfil your order
  • Legitimate interests: to improve our store and prevent fraud
  • Consent: for marketing communications — you can withdraw consent at any time
  • Legal obligation: where required by law

Third Parties We Share Data With We share data only where necessary with:

  • Shopify — our e-commerce platform (data processor)
  • Klaviyo — email marketing platform
  • Google Analytics 4 — website analytics
  • Shipping carriers — to fulfil and deliver your order
  • Payment providers — to process transactions securely

We do not sell your personal data to third parties.

International Data Transfers Some of our third-party providers (e.g. Klaviyo, Google) may process data outside the EU/EEA. Where this occurs, appropriate safeguards are in place (e.g. Standard Contractual Clauses).

Your Rights Under GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Restrict or object to processing
  • Data portability — receive your data in a structured format
  • Withdraw consent for marketing at any time

To exercise any of these rights, contact us at info@viii28.com. We will respond within 30 days.

Cookies We use cookies to improve your browsing experience and analyse site traffic. You can manage cookie preferences through your browser settings or our cookie consent tool.

Data Retention We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by law (typically up to 7 years for financial records under Spanish law).

Children's Privacy Our store is not directed at children under 16. We do not knowingly collect data from minors.

Changes to This Policy We may update this policy from time to time. The latest version will always be available at viii28.com.

Complaints If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD) at www.aepd.es.