Privacy Policy

How we collect, use, and protect personal data.

Last updated: 23 October 2026

This Privacy Policy explains how Alrromoda SL, which runs the Bounty Canarias online shop, collects, uses and protects your personal data when you browse our website, create an account or place an order.

Data controller

Alrromoda SL, Tax ID (NIF) B38489464, Calle El Pilar 40, 38002 Santa Cruz de Tenerife, Canary Islands, Spain. For privacy questions, to exercise your rights or for general enquiries, contact hola@bountycanarias.com.

What we collect

Account and contact details: name, email, phone and preferences.
Order and delivery details: billing and shipping address, items purchased and returns.
Payment information: payment method and transaction references (we do not store full card details).
Usage data: pages viewed, device and browser information, and cookie identifiers (where permitted).

Technical logs of visits

When you visit this online shop, our hosting provider (Vercel) records technical data about each request: your IP address and the approximate country derived from it, your browser and device (user agent), the page requested and the method, the referring page, the response status, and the date and time. These records can also include technical messages our website writes while handling the request, for example errors.

We keep a copy of these records in our log service on Amazon Web Services, in the Frankfurt region (European Union), for 60 days; they are then deleted automatically. Vercel also keeps its own copy for its standard period, which is shorter. We use them to keep the shop secure, to prevent fraud and abuse (including misuse of invitations), and to fix errors. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f) GDPR).

To ask us to delete the records linked to your IP address, or for a copy of our sub-processor register, contact hola@bountycanarias.com.

Analytics, advertising and other website services

Google Analytics 4 (Google Ireland Limited), only if you accept Analytics: we measure how the shop is used and the steps of a purchase (product viewed, added to the bag, checkout started and order placed), with the products, the amounts and the order number. With that number we can link these measurements to your order. We use a random identifier of your browser; we do not use Google Signals or allow ad personalisation. Before we send a page address to Google, we remove from it any data that could identify you. If you accept Analytics, we also keep that identifier with your order, so our server can send the purchase to Google Analytics if your browser did not. Google keeps this data for 14 months. Legal basis: your consent (Art. 6(1)(a) GDPR).
Our own speed measurements, only if you accept Analytics: the type of page, the type of device and the load times, with no identifier of yours. Legal basis: your consent (Art. 6(1)(a) GDPR).
Google Ads through Google Analytics (Google Ireland Limited), only if you also accept Advertising: Google Ads can learn which of our ads led to a visit or an order. If you arrive from an ad, we send Google Analytics the click code Google adds. We do not let your data be used to personalise the ads you see. Legal basis: your consent (Art. 6(1)(a) GDPR).
Product search and listings (Meilisearch): our search provider receives the filters you choose, the words you search for and your IP address, and, for the "Recently viewed" list, the codes of the products you opened (never your name or email). Legal basis: our legitimate interest in showing you the catalogue and the results you ask for (Art. 6(1)(f) GDPR).
Store map (Google Maps, from Google Ireland Limited): when you open the stores page, your browser connects to Google, which receives your IP address. Legal basis: our legitimate interest in helping you find our stores (Art. 6(1)(f) GDPR).
Error monitoring (Amazon Web Services, Frankfurt, EU): your browser sends us the page's technical errors and, if a payment fails, the codes of your bag and of the payment and the reason for the error, with the page where it happened. Only if you accept Analytics, also which pages you visit. Before a page address is sent, we remove the order number from it. Amazon keeps this data for 30 days. Legal basis: our legitimate interest in a working shop and working payments (Art. 6(1)(f) GDPR); for the pages you visit, your consent.
Your cookie choice: we keep a record of your choice (a random identifier, what you chose, the notice version and the date) for 13 months, so we can show what you consented to and when. Legal basis: our obligation to be able to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR).

You can accept, reject or withdraw Analytics and Advertising at any time from "Cookie settings" at the bottom of every page. Each cookie is described in our Cookie Policy.

How we use your data

To process and deliver orders and handle returns and refunds.
To provide customer support and respond to requests.
To prevent fraud and keep our services secure.
To meet legal obligations (for example, tax and accounting).
With your consent, to send newsletters and personalised communications.
With your consent, to measure how the shop is used and which of our ads work.

Legal bases

We process personal data based on the performance of a contract (your order), compliance with legal obligations, legitimate interests (for example, fraud prevention and service improvement), and consent (marketing, analytics and advertising).

Sharing and service providers

We may share your data with trusted providers who help us run our business, such as our payment provider, shipping carriers, hosting and IT providers, email delivery, product search (Meilisearch), error monitoring (Amazon Web Services) and, if you accept them, Google Analytics and Google Ads. Where required for fulfilment, we may also share limited information with the brand or boutique fulfilling your order.

International transfers

Some providers may process data outside the European Economic Area. Google may do so with Google Analytics and Google Ads data; that transfer relies on the EU-US Data Privacy Framework, under which Google LLC is certified, and on the European Commission's Standard Contractual Clauses. In other cases we use the appropriate safeguards the law requires (such as Standard Contractual Clauses).

Retention

We keep personal data only for as long as needed for the purposes described above. Order and invoice records are retained for the period required by tax and accounting rules. Technical logs of visits are kept for 60 days. Google Analytics data is kept for 14 months, error-monitoring data for 30 days and the record of your cookie choice for 13 months.

Your rights

You may have the right to access, correct, delete, restrict or object to processing, and to request portability. You can withdraw consent to marketing at any time. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Security

We implement technical and organisational measures designed to protect your data. No online service can be 100% secure, but we work continuously to reduce risk.