Last updated: October 2026
This policy explains how we process your personal data when you visit cobacomplements.com, shop in our store or contact us, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
Data controller
- Owner: Andrea Coderch Valor (Coba Complements)
- Tax ID (NIF): 21687223V
- Address: Carrer el Camí, 76B, bajo, 03801 Alcoi (Alicante), Spain
- Email: info@cobacomplements.com
- Website: cobacomplements.com
What data we process and why
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
Orders and customer account | Name, address, email, phone and order details. Payment data is processed directly by the payment gateway. | Performance of a contract (art. 6.1.b GDPR) | While the account or business relationship exists and, afterwards, for the legal periods (6 years, Commercial Code; 4 years, tax law). |
Contact form and email | Name, email and the content of your message. | Your consent and our legitimate interest in replying (art. 6.1.a and f) | As long as needed to deal with your enquiry. |
Newsletter | Email address. | Your consent (art. 6.1.a) | Until you unsubscribe. |
Website security and fraud prevention | IP address and technical browser data. | Legitimate interest (art. 6.1.f) | Only as long as strictly necessary for that purpose. |
We do not make automated decisions or create profiles with your data. We do not send commercial communications you have not requested or authorised.
Who we share your data with
We only share your data when it is necessary to provide the service or when required by law. To do so we work with the following providers, who act as data processors:
- Nicalia: website hosting (Spain).
- Redsys, PayPal and Bizum: payment processing. Coba Complements has no access to your card details.
- Carriers: delivery of orders, with only the data needed for shipping.
- Google Workspace (Google Ireland Ltd.): email.
- Cloudflare: protecting forms against automated submissions (spam).
- Vimeo: playing the videos embedded on the website.
Some of these providers (Google, Cloudflare, Vimeo and PayPal) may process data outside the European Economic Area. In those cases, transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting the lawfulness of prior processing. Write to info@cobacomplements.com or to the postal address above, stating which right you wish to exercise.
If you believe we have not processed your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).
Security
We apply appropriate technical and organisational measures to protect your data, including an encrypted (HTTPS) connection across the whole website. If a security breach affected your data, we would notify you within the time limits set by law.
Cookies
Information about the cookies used on this website is available in our cookie policy.