Privacy & cookies.

This policy explains what personal data we collect when you use our website and buy from us, why we use it, who we share it with and what your rights are. We process your data in line with the EU General Data Protection Regulation (GDPR).

• Contact and order details - name, email, phone, billing and delivery address, and what you order.
• Age information - your confirmation that you are 18 or over and, if needed, proof of age.
• Account details - login email, password (encrypted) and order history, if you create an account.
• Payment details - handled securely by our payment providers. We never see or store your full card number.
• Messages - what you send us through contact, return or wholesale forms.
• Device and usage data - IP address, browser, pages visited and cookies (see below).

• To process, deliver and support your orders.
• To verify that you are 18 or over, as required by law.
• To manage your account and answer your messages.
• To send newsletters and offers — only if you sign up, and you can unsubscribe at any time.
• To prevent fraud and keep our website secure.
• To meet our legal and tax obligations.

We process your data because it is needed to perform our contract with you (your order), to meet legal obligations (such as age verification and tax records), for our legitimate interests (such as fraud prevention and improving our website), or with your consent (such as newsletters and non-essential cookies).

We only share your data with trusted partners who help us run our store, and only as much as they need:

• Our e-commerce platform (Shopify) and payment providers.
• Couriers, to deliver your order and check your age on delivery.
• Email and customer service tools.
• Authorities, when the law requires it.

We never sell your personal data.

Some of our providers may process data outside the European Economic Area. When this happens, we make sure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses.

We keep order and invoice records for as long as tax law requires (usually 6 years). Account data is kept until you delete your account. Newsletter data is kept until you unsubscribe. Other data is deleted when it is no longer needed.

You have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Delete your data, where we don't need to keep it by law.
• Restrict or object to how we use your data.
• Receive your data in a portable format.
• Withdraw consent at any time, for example for newsletters or cookies.

To use any of these rights, email us at [privacy email]. You can also complain to your data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD).

Cookies are small files stored on your device when you visit our website. We use them to make the store work, remember your choices and understand how the website is used.

• Essential cookies - needed for the cart, checkout, login, security and remembering your age confirmation. These can't be turned off.
• Preference cookies - remember your language and country choices.
• Analytics cookies - help us understand how visitors use the website so we can improve it.
• Marketing cookies - used to show relevant offers, only with your consent.

When you first visit, you can accept or reject non-essential cookies in our cookie banner, and change your choice at any time. You can also block or delete cookies in your browser settings — note that some parts of the store may not work without essential cookies.

We use secure, encrypted connections (HTTPS) and trusted providers to protect your data. Access to personal data is limited to people who need it to do their job.

Our store is only for adults aged 18 or over. We don't knowingly collect data from anyone under 18. If we find that we have, we delete it.

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated.

If you have any questions about your privacy or want to use your rights, email us at [privacy email] and we'll reply within one month, as required by the GDPR.