Privacy policy

Who is responsible

The controller is ESTILO NODOS SL, trading as NODOS by G, tax ID B75931782, at C/Luis Vives 14, 28002 Madrid, Spain. For privacy questions and rights requests, contact info@nodosbyg.com.

This notice concerns the fashion/accessories shop, Academy and website.

What we use personal data for

Orders, customer accounts and delivery

We use the identity and contact details you supply, billing and delivery information, selected items, order and payment references, and relevant correspondence to take and fulfil orders, manage an account you request, arrange delivery and provide customer support. Processing necessary for your purchase or requested account is based on the contract or steps you ask us to take before it. Accounting and tax records are processed to meet legal obligations.

We share the information needed for delivery with the relevant carrier and use hosting, shop and communications suppliers for the services they provide. We do not need optional marketing consent to fulfil your order.

Payments and transaction checks

The payment provider handles the payment information required for the method you choose. We use transaction references and payment status to reconcile your purchase, handle refunds and investigate payment problems. Stripe is the enabled payment integration in the inspected shop configuration.

Enquiries, complaints and rights requests

We use your contact details, the contents of your message and relevant purchase information to answer enquiries and handle complaints or privacy requests. The basis is precontractual steps or the contract where relevant, and legal obligations where applicable.

Academy learners

We use booking and contact details, the chosen course/location, learner information needed to provide the class, attendance and completed teaching hours to arrange teaching and issue the relevant completed-hours certificate. The purchasing adult and learner may be different people.

We do not record classes. Online teaching uses Google Meet. Any permission to publish a learner's photograph is requested separately; booking a class or accepting these terms does not give that permission.

Optional newsletters and commercial messages

If you subscribe, we use your chosen contact details and subscription preferences to send the commercial messages you requested. Where based on consent, you can withdraw it at any time. Buying, creating an account or accepting cookies does not, by itself, subscribe you to email or SMS marketing.

You can unsubscribe free of charge using the unsubscribe option in the message or by contacting info@nodosbyg.com. We do not routinely require an identity-document copy to unsubscribe. Objection to direct marketing ends that marketing use.

Website statistics, advertising and embedded media

With the relevant consent, optional services measure website use and advertising interactions or display embedded media. Our intended service inventory includes Google Analytics 4 via Google Tag Manager, Microsoft Clarity session replays, WooCommerce visit attribution, Meta Pixel and Conversions API, Google Ads, Pinterest Tag, Omnisend marketing forms/visit and basket-recovery features, and YouTube embeds.

These services can process identifiers, device/browser and usage information, referral or campaign information and relevant shop-event data. Advertising services can connect activity with provider accounts or advertising audiences. The precise data, providers, storage durations and controls are described in the cookie information.

Essential basket, requested shopping-session and language functions are separate from optional marketing. Cookie consent and permission to send commercial messages are separate choices. You can change or withdraw optional cookie choices through Cookie settings in the footer; withdrawal does not affect the lawfulness of earlier consent-based processing.

Required and optional information

We need sufficient contact, order, delivery and payment information to fulfil a physical purchase, and sufficient booking/learner information to supply the requested class. If necessary information is missing, we may be unable to provide that service. Optional marketing choices do not determine whether you can buy. Forms must identify which fields are required for their stated purpose.

Who receives information and international transfers

Recipients include the carriers needed for your delivery, payment providers, suppliers of hosting, shop administration, communications and Academy delivery, and the optional measurement/advertising providers selected through the relevant choices. Professional advisers and public authorities receive information where necessary for their role or a legal requirement. The data supplied must be limited to the purpose.

We use Hostinger for website hosting and Omnisend for marketing communications. Advertising and product-visibility channels include Google Ads, Google Merchant Center and Meta. Deliveries use the carrier needed for the order, usually Correos or DHL and sometimes ELTA for dispatches from Athens. The information shared depends on the service and the relevant choices or other applicable lawful basis.

How long information is kept

Order, invoice and payment records: for fulfilment, support and applicable accounting, tax and legal-claim requirements, with unnecessary information removed when no longer needed.
Account information: while the requested account is in use, then only as needed for applicable legal obligations or claims. Account closure does not automatically erase records that must legally be retained.
Enquiries and complaints: for answering and following up the matter and for any applicable legal obligations or claim period.
Academy records: for administering the purchased teaching and completed-hours certificate, then for any applicable legal obligations or claims.
Marketing: while the relevant permission or other verified lawful basis remains valid. A limited suppression record may be needed to respect an opt-out without continuing marketing.
Consent records: for recording and demonstrating the relevant choices for the applicable period.
Cookie and device storage: as stated for the particular service in the cookie information. This does not state how long a supplier keeps data already received.

Your rights

Contact info@nodosbyg.com to request access, rectification, erasure, restriction or portability of your personal data, or to object to processing, where the relevant right applies. You may object to direct marketing at any time. Where processing relies on legitimate interests, you may object on grounds relating to your situation under the applicable rules.

If processing is based on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal. Erasure and other rights have legal conditions; for example, a valid retention obligation may mean an invoice cannot yet be deleted.

We may request additional information if we have reasonable doubts about your identity, limited to what is necessary to confirm it. We will respond without undue delay and normally within one month. If the legal conditions for an extension apply, we will inform you within that month and explain why. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

Automated decisions and policy revisions

We date revisions so you can identify the notice version. A revised privacy notice does not itself supply consent for a new purpose. Any further information or permission required for a new use must be provided separately.

Open points before publication (10)

H11: Verify the actual contractual payment recipients and their roles, any payment/risk data returned or retained by the shop, and relevant provider processing/transfer information. Do not promise that NODOS never receives card-related data or that every payment provider acts only as our processor.
H09: Identify and document any separate legitimate-interest purpose actually used for general enquiries, claim defence or fraud/security processing, including the interest and necessity/balancing assessment. Do not label every contact or payment-risk activity contractual by default.
H12: Check the appropriate basis and notice for a learner who is not the contracting purchaser within the existing implementation review. The ordinary teaching-administration description above covers relevant teaching notes without a separate inventory. No health-data, identity-copy or other special-category collection is asserted, and no further owner questionnaire is required.
H12: Checkout email opt-in is already optional and initially unchecked in the completed release; do not reopen that correction. Confirm remaining channels, subscription wording/records, eligibility, suppression handling and any prior-customer/similar-products route. Cookie choice is not marketing subscription.
H11/H14: This is the intended coordinated notice, not a claim that production already enforces these controls. The consent repair is staged only. Verify actual server-side integrations, event fields, optional purposes retained and production consent controls before publication. Cookie lifetimes are not the retention periods for orders, subscribers or provider event records.
H12/H14: Verify the actual required fields, proportionate learner information and independent marketing choices; do not call unnecessary collection required just because a plugin marks a field mandatory.
H11: Complete the actual recipient categories/provider identities, processor-versus-independent-controller roles, international destinations and the applicable transfer mechanism for each relevant flow. Specify how a customer can obtain information about or a copy of the safeguards. Do not assert that all data remain in the EU, that a provider is covered by an adequacy decision without checking it, or that standard contractual clauses are signed merely because a provider advertises them.
H09: The following retention criteria are proposed for confirmation, not a statement that an automated deletion schedule already implements them. Resolve the actual practice and applicable statutory/claim periods before publication.
H09/H11: Confirm website/security logs, backups and provider-side retention/deletion as relevant. No specific automatic order/account deletion period was configured in the inspected WooCommerce options. That is not proof that all records are retained indefinitely or that other systems never delete them.
H11: Establish whether any NODOS processing involves solely automated decisions with legal or similarly significant effects, including the role of provider fraud blocks. If applicable, supply the required information and safeguards. Do not insert an unsupported blanket denial; a blocked payment alone does not resolve the classification.