Privacy policy
IM Beauty — last updated: 19 June 2026
0. Quick glossary
- Website / Site: itziarymariangeles.com and its subdomains.
- User: an individual who browses, buys or contacts us.
- Data Controller: PIP AVANT, S.L. (IM Beauty).
- Services: online sale of niche cosmetics and after-sales support.
1. Identity of the Data Controller
| Detail | Information |
|---|---|
| Company name | PIP AVANT, S.L. |
| Tax ID (CIF) | B19789833 |
| Registered address | Av. Tres 14, 08130 Santa Perpètua de Mogoda (Barcelona) |
| info@itziarymariangeles.com | |
| Phone | +34 650 156 331 |
| Companies Register | Barcelona Companies Register, Sheet B-617629, 1st Entry (20 June 2024) |
| Sole Director | Icíar Castillo Cuesta – Tax ID 52179531Y |
| Data Protection Officer (DPO) | Not applicable (art. 37 GDPR). Enquiries at info@itziarymariangeles.com |
2. Scope of application
This policy applies to the use of the Website, purchases made and any interaction (forms, chat, WhatsApp, official social media). Processing carried out by linked third-party sites is excluded.
3. Source and categories of data we process
| Source | Data (examples) | GDPR category |
|---|---|---|
| Purchase form | First name, surname, address, email, phone, order details, payment method | Identification, transactional |
| Billing data | ID number and tax details, only when you request an invoice with tax details | Identification |
| Customer account | Credentials, preferences, wish list | Identification, personal characteristics |
| Newsletter / SMS | Email, mobile number, preferences | Contact |
| Cookies and logs | IP, device, browser, pages visited | Browsing data |
| Customer service | Conversations, attachments, incident history | Communications |
| Assessment of prescription-only products | Information about your skin or health that you voluntarily provide to us to assess the suitability of a product | Special category (art. 9 GDPR) |
| Social media | Username, photo, public likes/comments | Publicly disclosed data |
Except in the case described in section 4 bis, we do not request special categories of data.
4. Purposes and legal bases
| Purpose | Description | Basis (art. 6 GDPR) |
|---|---|---|
| A. Online purchases | Process orders, manage payments and delivery | b) Performance of contract |
| B. Customer service | Resolve queries, returns, warranties | b) Contract / f) Legitimate interest |
| C. Accounting and taxation | Invoicing and tax obligations | c) Legal obligation |
| D. Fraud prevention | Detection of irregular transactions | f) Legitimate interest |
| E. Direct marketing | Newsletter, personalised offers, remarketing | a) Consent |
| F. Web analytics | Browsing and performance metrics | a) Consent |
| G. Prize draw management | Verify participants and deliver prizes | a) Consent |
| H. Regulatory compliance | Handle rights requests and legal requirements | c) Legal obligation |
4 bis. Health data in the assessment of prescription-only products
Some products in our catalogue are sold only after a prior assessment (see Terms of Service). If, as part of that assessment — usually via WhatsApp or email — you provide us with information about your skin or health, we will process that data with the following safeguards:
- Legal basis: your explicit consent (art. 9.2.a GDPR). We only process this information if you decide to share it.
- Single purpose: to assess whether the product is suitable for you and to advise you. We do not use this data for marketing, profiling or any other purpose.
- Minimisation: we only ask for what is strictly necessary for the assessment.
- Retention: we keep this information only for as long as necessary to attend to your query and, where applicable, manage your order; it is then deleted.
- Withdrawal: you can withdraw your consent and request its deletion at any time by writing to info@itziarymariangeles.com.
5. Retention periods
| Data | Retention | Justification |
|---|---|---|
| Orders and invoices | 6 years | Art. 30 Commercial Code |
| Contact forms | 12 months | AEPD Guidance |
| Newsletter | Until voluntary unsubscription | Withdrawal of consent |
| Access logs | 12 months | Network security |
| Cookies | As per cookie table | LSSI-CE / AEPD Guidance |
| Claims and warranties | 5 years after closure | Statute of limitations |
| Health data (assessment) | For the duration of the query/order | Minimisation (art. 9 GDPR) |
Once the periods have expired, the data is blocked and can only be unblocked for administrative or judicial claims or audits.
6. Data processors and recipients
We only share data with the providers essential to deliver the service, all bound by a data processing agreement:
| Function | Provider | Location / safeguard |
|---|---|---|
| E-commerce platform | Shopify | Canada (adequacy decision) and USA (DPF / SCC) |
| Payment gateway | Shopify Payments (Stripe) | EU / USA (DPF / SCC) |
| Deferred payment | Klarna | Sweden (EU) |
| Payment | Bizum (Redsys) | Spain (EU) |
| Payment | PayPal | Luxembourg (EU) / USA (DPF / SCC) |
| Payment / checkout accelerator | Shop Pay (Shopify) | USA (DPF / SCC) |
| Logistics | CTT Express | Spain (EU) |
| International logistics | DHL | EU |
| Email marketing | Klaviyo | USA (DPF / SCC) |
| Advertising and remarketing | Meta Platforms Ireland | Ireland (EU) / USA (DPF / SCC) |
| Web analytics | Google (Google Analytics) | USA (DPF / SCC) |
| Profitability analysis | TrueProfit | USA / Canada (SCC / adequacy) |
| Cookie consent management | CookieYes | United Kingdom (adequacy decision) |
| Product reviews | Judge.me | United Kingdom (adequacy decision) |
We do not sell or transfer your data to third parties for their own commercial purposes.
7. International transfers
Some of our providers process data outside the European Economic Area. In these cases, we guarantee an adequate level of protection through:
- Adequacy decisions of the European Commission (for example, Canada and the United Kingdom).
- The EU-US Data Privacy Framework, when the provider is enrolled.
- Standard Contractual Clauses (SCC) approved by the European Commission, together with supplementary measures such as encryption in transit and at rest, data minimisation and pseudonymisation.
8. Rights of data subjects
You have the right to access, rectification, erasure, objection, restriction, portability and to not be subject to automated individual decisions.
- How to exercise them: write to us at info@itziarymariangeles.com or by post (Ref. GDPR) to our registered address. We will verify your identity by reasonable means; we will only ask for an ID document if there are well-founded doubts as to who is making the request.
- Response time: one month, extendable by a further month in complex cases.
- Complaint: if you believe we have not properly handled your rights, you can file a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.
9. Information security
We apply TLS encryption, restricted access control to the administration panel, regular backups, antimalware monitoring and risk assessment. Staff with access to data are subject to a duty of confidentiality and to incident management and breach notification protocols within 72 hours. Please note that no security measure on the Internet is absolutely impregnable.
10. Profiles and automated decisions
Our email marketing and advertising tools (Klaviyo, Meta) may segment users based on their purchases and browsing in order to show more relevant content and offers.
- Effects: these are limited to recommendations and discounts. No orders are rejected nor are decisions with legal effects taken in an automated manner.
- Objection: you can object by writing to info@itziarymariangeles.com or via the "Unsubscribe" link in our emails.
11. Data of minors
Purchases on the Website are reserved for those over 18 years of age (see Terms of Service). Regarding data processing, we do not knowingly collect data from minors under 14 years of age without the consent of those holding parental authority or guardianship. If we detect a registration by a minor without such consent, we will delete the account.
12. Social media
The use of our profiles on Instagram, TikTok, Facebook or Pinterest is governed by the terms of each platform. We process your data only to manage prize draws, respond to messages or moderate comments, on the basis of your consent and our legitimate interest in maintaining a corporate presence.
13. Cookies
We use technical cookies and, subject to acceptance, analytics and advertising cookies. The banner and consent record are managed by the CookieYes tool on behalf of PIP AVANT, S.L. You will find full details in our Cookie Policy.
14. Changes to this policy
We may update this policy to reflect regulatory or operational changes. If the changes affect your rights, we will inform you by email or via a notice on the Website.
15. Questions?
Write to us at info@itziarymariangeles.com or call us at +34 650 156 331.