Privacy policy

WE RECOMMEND THAT YOU READ AND UNDERSTAND OUR PRIVACY POLICY BEFORE PROVIDING YOUR PERSONAL DATA AND CONSENTING TO ITS PROCESSING

This Privacy Policy applies to the processing of personal data carried out by ECOALF RECYCLED FABRICS, S.L. (hereinafter, “ECOALF”) collected through the following channels:

- communications by email

- the website https://ecoalf.com/

- physical stores

- customer service

- video surveillance in stores

- receipt of CVs

Data controller

ECOALF RECYCLED FABRICS, S.L. Tax ID B85910610

Registered office: Calle Gran Vía 1, 2º Izq, 28013 Madrid.

Data Protection Officer contact: gdpr@ecoalf.com.

Data we collect, purposes and legal basis

ECOALF will process your personal data for the purposes detailed below:

PROCESSING ACTIVITY	TYPE OF DATA			PURPOSE
When you send us an email	- Identification data (first name, surname). - Contact details (address, country, email address, telephone number). - Any other personal data included in the email communication.			Maintaining contractual, commercial or professional relationships with people who contact Ecoalf by email.
	Legal basis: Performance of a contract or pre-contractual measures to which the user is a party (Art. 6(1)(b) GDPR). Legitimate interest in achieving the controller's purpose of communicating with the person sending the email (Art. 6(1)(f) GDPR).
When you make an online purchase	- Identification data (first name, surname). - Contact details (address, country, email address, telephone number). - Payment method.			Processing purchase orders and managing payment transactions. Handling shipments, complaints, warranties, returns and refunds. Sending occasional commercial communications about promotions. Sending satisfaction surveys about your order.
	Legal basis: Performance of a contract or pre-contractual measures to which the user is a party (Art. 6(1)(b) GDPR). Legitimate interest for occasional commercial communications and surveys (Art. 6(1)(f) GDPR).
When you purchase in store and request an electronic receipt	- Identification data: first name, surname, email and telephone number.			Sending the receipt in electronic format.
	Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR).
When you register as a member of the Ecoalf Community, either in our physical store or online	- Identification data (first name, surname). - Contact details (postcode, country, email address, telephone number). - Date of birth.			Managing your Community membership profile. Providing purchase history, order information and invoices in electronic format. Offering discounts and commercial benefits, such as access to exclusive or early sales. Sending our Newsletter. Sending promotional communications and information about our brand philosophy. Getting to know ECOALF Community members better by segmenting them according to basic characteristics, as described in the Profiling and marketing processing activity.
	Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR). We carry out basic profiling on the basis of our legitimate interest (Art. 6(1)(f)).
When you defer a payment	- Identification data (first name and surname, address, telephone number, email address). - Bank account or card details needed to complete the purchase.	Deferring payments according to the options selected by the User. Disclosing data to the company financing the payments.
	Legal basis: Performance of a contract or pre-contractual measures to which the user is a party (Art. 6(1)(b) GDPR).
When you use the size calculator and virtual fitting room feature	Data relating to the User's usual clothing size, height, weight and fit preferences. Photograph of the body (and, if desired, the face) when using the “virtual fitting room” option.	Calculating a size recommendation based on information provided by the User. Allowing the User to virtually try on garments by providing a photograph, using artificial intelligence.
	Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR), deemed to be given by clicking “calculate my size” or “try on virtually” and, in the latter case, by voluntarily uploading a photograph. The “virtual fitting room” feature uses an artificial intelligence system to create a virtual visualisation of garments. The photograph is transmitted securely using encryption and is used exclusively to superimpose the garments, after which it is discarded. Consequently, no biometric data intended to uniquely identify individuals are processed, nor are special categories of data within the meaning of Article 9 GDPR.
When you ask us to send product availability alerts	- Contact details (email address).	Notifying you of the availability of the requested products.
	Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR).
When you subscribe to our Newsletter	- Contact details (email address).			Regularly preparing and distributing newsletters, advertising information and brand news, promotions and offers, invitations to events, competitions and prize draws through multiple communication channels.
	Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR).
Profiling and marketing	- Contact details (email address). - Identification data (subscription ID, IP address). - Data generated by the user in ECOALF environments.		Segmenting ECOALF customers according to their most basic characteristics to personalise commercial communications.
	Legal basis: Legitimate interest in carrying out profiling using the information we hold about you (such as browsing activity and/or purchase history) and/or the personal data you have provided. To this end, ECOALF has weighed the interests and rights of data subjects and the measures adopted by the controller to meet its general obligations in terms of proportionality and transparency, and has concluded that: 1.- the impact on individuals' fundamental rights and freedoms is limited; 2.- the data subject can reasonably foresee this processing; 3.- processing for this purpose does not result in exclusion, discrimination, defamation, or situations endangering the data subject's reputation and/or bargaining power.
When you browse the website	- Technical information, including IP address, login data, browser and browser version, and operating system. - Information about your visits to our website, uniform resource locator (URL), products viewed or searched for, time and date of the visit and time spent on the Website. - Website interaction information (for example, clicks and/or mouse movements), methods used to leave the website, unique device identifiers and other diagnostic data. - Information collected through cookies. You can find more information about these tools and how to manage them in our Cookie Policy.			Allowing you to take part in interactive features of our website when you choose to do so. Collecting statistical analyses, research and profiles based on browsing activity and interests in content, or other valuable information enabling us to improve our website and service. Detecting, preventing and addressing technical issues.
	Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR), except for information collected through functional cookies, which in that case would be based on legitimate interest (Art. 6(1)(f) GDPR).
Customer Service	- Contact details: Email address and/or telephone number. - Any other personal data provided in the course of a customer service enquiry.			Answering customer enquiries and managing complaints and claims relating to purchases. Providing technical support. Improving the customer experience.
	Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) where the enquiry concerns a purchase. Consent (Art. 6(1)(a) GDPR) where the enquiry is not related to any purchase or after-sales service, or where calls are recorded.
Video surveillance	- Identification data (image).			Ensuring the safety of people, property and premises. Protecting customers and visitors, assets and the business against violence, theft, misuse and other malicious activities.
	Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
When you send us your CV	- Identification data (first name, surname). - Professional and employment data. - Educational data. - Any other data included in the application and CV.			Managing staff recruitment processes.
	Legal basis: Performance of a contract or pre-contractual measures to which the user is a party (Art. 6(1)(b) GDPR).
When you use the Internal Whistleblowing Channel	- If the report is not anonymous: identification and contact data. - Any other personal information submitted in the report.			Management of the Internal Reporting Channel. Processing the report and reviewing it. Where appropriate, conducting the investigation and implementing the established procedure.
	Legal basis: Legal obligation (Art. 6(1)(c)); Law 2/2023 of 20 February governing the protection of persons who report regulatory breaches and the fight against corruption. More information.

Recipients

Disclosure of data

ECOALF will not disclose your personal data except where required by law, where necessary to fulfil our contractual obligations, or with your consent. Accordingly, only where needed to address potential legal liabilities or comply with statutory retention periods may your personal data be disclosed to the competent public authorities, in particular the competent data protection supervisory authority, judges, courts or the Public Prosecutor's Office under European Union law and/or domestic law.

DEFERRED PAYMENT METHOD

If you choose to pay for your purchase in instalments, you must provide your details in the form made available by Klarna on the Website so that it can assess your eligibility for financing and offer the available payment methods. Klarna will act as the controller of the personal data you provide and will process them in accordance with its privacy policy, available here.

More information about Klarna and instalment payments here.

MONEI

If you choose any of our payment methods, your data will be disclosed to MONEI DIGITAL PAYMENTS, S.L. (hereinafter “Monei”) so that it can offer the available payment methods and process payment for your purchase.

Monei will be the controller of your personal data and will process them in accordance with its privacy policy, available here.

Data processors

ECOALF uses service providers that may have access to your personal data and process them in our name and on our behalf as part of the services they provide. ECOALF applies strict service-provider selection criteria to meet its data protection obligations and undertakes to enter into the relevant data processing agreement with them.

In particular, ECOALF will engage third-party providers operating, by way of example and without limitation, in the following sectors: logistics, legal advice, multidisciplinary professional services, maintenance, technology services, IT services, physical security, instant messaging services, infrastructure management and maintenance, and the company providing the AI-powered virtual fitting room service, among others.

Transfers of data to third countries

ECOALF, as data controller, informs you that it does not intend to transfer your personal data to countries outside the European Economic Area.

However, if any processing activity is carried out by companies or individuals located in third countries, ECOALF will take all necessary measures to ensure that your data are processed securely and in accordance with this Privacy Policy, and will not transfer your personal data to an organisation or country outside the European Economic Area unless the country ensures an adequate level of protection or sufficient safeguards are provided, such as European Commission-approved Standard Contractual Clauses, together with enforceable rights and effective legal remedies for data subjects.

Retention

Personal data provided will generally be retained for only as long as strictly necessary to fulfil each stated purpose, or until you withdraw your consent to processing. They will subsequently be blocked for the limitation periods applicable to contractual or pre-contractual liabilities. In particular:

Data you provide to us by email will be kept no longer than necessary to respond to your enquiry. Where a contractual relationship exists, they will be kept for the duration of that relationship and, where applicable, for no longer than the five-year limitation period.

Data concerning your purchases will be retained for five years unless other limitation periods apply.

Data provided when registering as a member of the Ecoalf Community will be kept until you decide to unsubscribe, since until then we understand that you wish to remain a member of our Community; except for data that need to be retained in relation to purchases and associated incidents occurring as an Ecoalf Community member.

Data you provide to calculate your size will be used while we provide the service. The photograph is securely transmitted using encryption. Once processing is complete, the image is deleted and is not stored on our servers.

Data used to send newsletters and promotional communications will be kept until you withdraw consent, request to unsubscribe using the means provided in each communication, or exercise your rights of erasure or objection.

Data relating to enquiries made through our customer service channels will be kept until the enquiry has been resolved, unless they must be included in the purchase file, in which case the retention periods applicable to purchases will apply.

Data generated through browsing the website will be retained as described in our Cookie Policy.

Data collected for video surveillance purposes will be kept for up to one month after the images are captured.

Data you send when applying for employment will be kept for up to two years after receipt of the application.

Data provided when making a report through the established Internal Whistleblowing Channel will be retained for the time strictly necessary to decide whether an investigation should be initiated, and for a maximum of three months if the reported facts have not been substantiated or no investigative actions have been initiated.

Exercise of rights

You have the following rights in relation to the processing of your personal data: access, rectification, erasure, objection, restriction, portability and, where applicable, the right not to be subject to individual automated decisions. To exercise these rights you must contact the DPO at gdpr@ecoalf.com.

For processing based on consent, you have the right to withdraw that consent at any time through the channel indicated above, without affecting the lawfulness of processing based on consent before its withdrawal.

You may object to or withdraw your consent to receive commercial communications at any time by contacting gdpr@ecoalf.com, or using the link provided for that purpose in each commercial communication we send you.

If ECOALF fails to comply with its legal obligations concerning the protection of your personal data, you also have the right to lodge a complaint with the competent authority, which in Spain is the Spanish Data Protection Agency (www.aepd.es).

Confidentiality

ECOALF guarantees the strictest controls to ensure the confidential computerised processing of the personal data of all its customers and suppliers in accordance with the legislation in force in Spain.

Security

ECOALF has implemented the technical and organisational security measures necessary to ensure the security of your personal data and prevent their alteration, loss and unauthorised processing and/or access, taking account of the state of technology, the nature of the stored data and the risks to which they are exposed, whether arising from human action or the physical or natural environment, in accordance with applicable regulations. ECOALF is not responsible for loss, misplacement or unauthorised manipulation of data beyond its control that could not have been foreseen or that results from malicious third-party attacks.

Links to other websites

Our Website may contain links to other websites not operated by us. If you click a third-party link, you will be redirected to that third party's website. We have no control over, and assume no responsibility for, the privacy policies or practices of third-party websites or services.

We recommend reviewing the Privacy Policy of every website you visit.

Children's privacy

We do not intend to collect personal information from persons under 18 years of age. If you are a parent or guardian and become aware that your child or a minor under your guardianship has provided us with personal data, please contact us at gpdr@ecoalf.com.

If you are a minor, you must obtain prior consent from your parents or guardians before entering your personal data in the forms on the Website.

If we become aware that we have collected personal data from children under 18 without verifying that consent was given or authorised by the person exercising parental authority or guardianship, we will take steps to delete the information from our servers and reserve the right to provide the service.

Changes to this Privacy Policy

ECOALF may update this Privacy Policy at any time. The privacy policy published at the relevant time will apply, so we recommend reviewing it periodically. If substantial changes are made, users will be informed so that they may learn about them and exercise their rights if they do not agree.

Last version: November 2026