Privacy Policy

Privacy Policy

At Óptica Palmanova we take the protection of your personal data very seriously. This Privacy Policy explains clearly and transparently who is responsible for processing your data, what data we collect, for what purpose and on what legal basis we process it, how long we keep it, with whom we share it and what rights you have. We recommend that you read it carefully before using our website opticapalmanova.com or providing us with any personal data.

This policy has been drafted in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (RGPD), Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) and Law 34/2002, on Information Society Services and Electronic Commerce (LSSI-CE).

1. Data Controller

The controller responsible for processing your personal data is:

  • Holder: Marc Capellà Troyano, who carries out his activity under the trade name Óptica Palmanova.
  • NIF: 35006995Y
  • Address: Avenida de la Playa 12, 07181 Palmanova, Calvià, Illes Balears, España
  • Telephone: 971 68 28 02
  • Mobile / WhatsApp: 633 57 42 25
  • Email: opticapalmanova@gmail.com
  • Website: https://opticapalmanova.com
  • Health authorization: 0407001226 (Consejería de Sanidad, Govern de les Illes Balears)
  • Optical healthcare establishment operating since 1986, with an optician-optometrist registered with the Col·legi Oficial d'Òptics Optometristes de les Illes Balears (COOIB).

For any matter relating to the processing of your data or to this policy, you can contact us through any of the means indicated, preferably by email at opticapalmanova@gmail.com.

2. Personal data we process

Depending on the service you use, we may process the following categories of data:

  • Identification and contact data: first and last name, DNI/NIF (when necessary for invoicing), postal address, email address and telephone number.
  • Order and billing data: products purchased, amount, delivery and billing address, and purchase history. Card or payment method data is processed directly by the payment gateway and we do not store full card numbers.
  • Browsing data: IP address, device and browser type, and information collected through cookies and similar technologies (see our Cookie Policy).
  • Communications data: the content of the messages you send us via the contact form, email, telephone or WhatsApp.
  • Health data (special category, art. 9 RGPD): in the context of providing optical healthcare services (eye examination, optical prescription, vision parameters, contact lens fitting data), we may process data relating to your visual health. This data is only collected in the context of in-person care at our establishment by a registered optician-optometrist, or when you provide it to us voluntarily (for example, when supplying your prescription to order contact lenses). When you buy prescription glasses online we process your refractive correction or prescription (health data, art. 9 RGPD) for the sole purpose of manufacturing your lenses and subject to your prior explicit consent; we do not request health data for the rest of our products (sunglasses, solutions and accessories).

You are required to provide truthful and up-to-date data. If you provide us with third-party data, you warrant that you have their consent to disclose it to us.

3. Purposes and legal basis of each processing activity

We process your data for the following purposes, each based on a legal basis in accordance with art. 6 (and, where applicable, art. 9) of the RGPD:

3.1. Order management and online sales

  • Purpose: to process, prepare and deliver the orders placed in the online store (sunglasses, contact lenses, solutions and accessories), and to manage payments, returns and after-sales service.
  • Legal basis: performance of a contract to which you are a party (art. 6.1.b RGPD).

3.2. Optical healthcare and made-to-measure products

  • Purpose: to perform eye examinations and provide optical-optometry services at the establishment, as well as to produce and fit made-to-measure medical devices (prescription glasses), which are dispensed exclusively by in-person appointment and are not sold over the internet.
  • Legal basis: performance of the services contract (art. 6.1.b RGPD) and, with respect to health data, the purposes of medicine/healthcare provided by a professional bound by professional secrecy (art. 9.2.h RGPD) and/or your explicit consent (art. 9.2.a RGPD). Compliance with the healthcare regulations on medical devices (RD 1591/2009) also constitutes a legal obligation (art. 6.1.c RGPD).

3.3. Invoicing and accounting and tax obligations

  • Purpose: to issue invoices and comply with legal obligations regarding commercial, accounting and tax matters.
  • Legal basis: compliance with a legal obligation (art. 6.1.c RGPD).

3.4. Handling enquiries and communications

  • Purpose: to respond to the enquiries, requests or complaints you send us through the contact form, email, telephone or WhatsApp.
  • Legal basis: your consent (art. 6.1.a RGPD) and/or the application of pre-contractual measures at your request (art. 6.1.b RGPD).

3.5. Commercial communications

  • Purpose: to send you information about our products, promotions and news by electronic means, when you have given your consent or there is a prior contractual relationship for similar products or services.
  • Legal basis: your consent (art. 6.1.a RGPD) or the legitimate interest in building loyalty among existing customers (art. 6.1.f RGPD and art. 21.2 LSSI-CE). You may object or unsubscribe at any time, free of charge.

3.6. Browsing analysis and cookies

  • Purpose: to ensure the website functions correctly, analyse its use and, where applicable, display personalised advertising.
  • Legal basis: your consent (art. 6.1.a RGPD), except for technically necessary cookies. More information in our Cookie Policy.

4. Retention periods

We will keep your data for as long as strictly necessary to fulfil the purposes for which it was collected:

  • Customer and order data: for as long as the commercial relationship is maintained and, thereafter, during the limitation periods for any legal actions that may arise.
  • Billing and accounting data: for the periods required by commercial and tax regulations (generally, up to 6 years under the Commercial Code and 4 years in tax matters).
  • Health data / optical records: for the time necessary to provide care and to comply with the obligations arising from the applicable healthcare regulations.
  • Data for commercial communications: until you withdraw your consent or request to unsubscribe.
  • Enquiries and messages: for the time necessary to handle them and, where applicable, for as long as liabilities may arise.

Once those periods have elapsed, your data will be securely deleted or anonymised.

5. Recipients and data processors

In order to provide you with our services, we share your data with third parties that act as data processors, with whom we have signed the corresponding contracts in accordance with art. 28 RGPD. These third parties process your data solely in accordance with our instructions and for the stated purposes:

  • Shopify International Limited / Shopify Inc., provider of the e-commerce platform on which our online store operates, which hosts and processes the website and order data.
  • Payment gateway: Shopify Payments and Bizum, which securely processes the payments made in the online store.
  • Transport / courier company: the transport agency designated by Óptica Palmanova at any given time, to which we disclose the data necessary for delivering the orders.
  • Technology, analytics and marketing service providers that assist us in operating the website and our communications.
  • Tax and accounting advisers, for compliance with legal obligations.

We may also disclose your data to Public Administrations, Law Enforcement Agencies, judges and courts when there is a legal obligation to do so. We do not transfer your data to third parties for their own commercial purposes without your consent.

6. International data transfers

Some of our technology providers (such as Shopify, as well as certain analytics or payment tools) may process data on servers located outside the European Economic Area (EEA), in particular in the United States.

In such cases, these international transfers are carried out with appropriate safeguards, through one of the following mechanisms provided for in the RGPD:

  • The importer's adherence to the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission), where applicable.
  • The signing of Standard Contractual Clauses approved by the European Commission, together with any additional measures that may be necessary.

You can request additional information about these safeguards by writing to us at opticapalmanova@gmail.com.

7. Your data protection rights

As the data subject, you may exercise the following rights at any time:

  • Access: to know what data of yours we process.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): to request the deletion of your data when it is no longer necessary.
  • Objection: to object to the processing of your data in certain circumstances, including objecting to commercial communications.
  • Restriction of processing: to request that the processing of your data be restricted in the cases provided for by law.
  • Portability: to receive your data in a structured, commonly used and machine-readable format, or to have us transmit it to another controller.
  • Withdraw the consent given, at any time, without this affecting the lawfulness of the processing carried out prior to its withdrawal.

To exercise these rights, you can send us a request to opticapalmanova@gmail.com or by post to the address indicated in section 1, enclosing a copy of your DNI or equivalent document allowing your identity to be verified. Exercising these rights is free of charge.

Complaint to the supervisory authority

If you consider that the processing of your data does not comply with the regulations, or that we have not properly handled the exercise of your rights, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), calle Jorge Juan 6, 28001 Madrid, or through its electronic office at www.aepd.es.

8. Security measures

We have adopted the appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with art. 32 RGPD, in order to protect your personal data against loss, misuse, unauthorised access, alteration or disclosure. These measures include, among others, the encryption of communications (HTTPS/SSL protocol), access control and the duty of confidentiality and professional secrecy of the healthcare staff with respect to health data.

9. Data of minors

Our online store is aimed at adults. We do not knowingly collect data from minors under 14 years of age without the consent of their parents or legal guardians. Minors may receive in-person optical care accompanied by their father, mother or legal guardian, who will authorise the processing of their data. If we detect that we have collected data from a minor without the proper authorisation, we will proceed to delete it.

10. Cookies

Our website uses cookies and similar technologies for its proper functioning and to analyse browsing. You can find all the information about their type, purpose and how to configure or disable them in our Cookie Policy.

11. Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy to adapt it to legislative developments or changes in our processing activities. We will publish the updated versions on this same page, indicating the date of the last update.

Last updated: 7 July 2026