Privacy policy

Last updated: 27 September 2026

In this policy we explain what personal data we process when you visit or buy from hexorasleep.com, what we use it for and what rights you have, in accordance with the General Data Protection Regulation (RGPD / GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

  • Controller: [NOMBRE Y APELLIDOS DEL TITULAR], trading under the name HEXORA
  • Tax ID (NIF): [NIF]
  • Address: [DOMICILIO DEL TITULAR]
  • Contact and privacy email: hola@hexorasleep.com

2. What data we process

  • Contact and delivery data: name, address, email and phone number (if you give it to us).
  • Order data: products, amounts, purchase history, returns and issues.
  • Payment data: the method used and the payment confirmation. Full card details are processed directly by the payment provider; we never see or store them.
  • Communications: what you tell us when you write to us.
  • Browsing data: IP address, device, browser, language and how you use the website, through cookies and similar technologies (see the Cookie policy).

3. What we use it for and on what legal basis

  • Managing your order (payment, delivery, order emails, returns and warranty). Basis: performance of the contract.
  • Helping you when you write to us. Basis: performance of the contract or, if there is no order, our legitimate interest in replying to you.
  • Complying with legal obligations (invoicing, accounting, tax, consumer law). Basis: legal obligation.
  • Preventing fraud and protecting the store. Basis: legitimate interest.
  • Sending you news and offers by email, including the abandoned cart reminder with its discount code, only if you have subscribed. Basis: your consent, which you can withdraw at any time using the unsubscribe link in every email.
  • Analysing how the website is used and showing you personalised advertising through cookies, only if you accept this in the cookie banner. Basis: your consent.

We do not make decisions based solely on automated processing that have legal effects on you.

4. How long we keep it

  • Order and invoice data: for the duration of our commercial relationship and, afterwards, for as long as the law requires (up to 6 years for accounting and tax obligations, and for the duration of the legal guarantee).
  • Enquiries without an order: until they are resolved and for a maximum of 1 year afterwards.
  • Email marketing: until you unsubscribe.
  • Cookies: for the period stated in the Cookie policy.

5. Who we share your data with

We do not sell your data. We only share it with the providers we need in order to operate, who process it on our behalf or as independent controllers:

  • Shopify (store platform, emails and payments).
  • Payment providers, such as Shopify Payments, PayPal or Klarna, depending on the method you choose.
  • Our product supplier and the carriers, who receive your name, address and phone number to prepare and deliver your order.
  • Tax and accounting advisers, so that we can meet our legal obligations.
  • Analytics and advertising platforms (for example Google, Meta or TikTok), only if you accept those cookies.
  • Authorities, when the law requires us to.

6. International transfers

Some providers are located outside the European Economic Area, for example in Canada, the United States or China. In those cases the transfer is covered by an adequacy decision of the European Commission (such as the one for Canada or the EU-US Data Privacy Framework), by standard contractual clauses or, for preparing and shipping your order, by the fact that it is necessary to perform the contract you have entered into with us.

7. Your rights

You can ask us at any time for access to, rectification or erasure of your data, restriction of processing and data portability, and you can object to the processing. If the processing is based on your consent, you can withdraw it whenever you like without affecting any processing carried out before.

Write to us at hola@hexorasleep.com stating which right you wish to exercise. We will reply within one month at most. If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the data protection authority in your country.

You can also manage the sharing of data for advertising purposes in Your privacy choices.

8. Shopify

Our store runs on Shopify. For certain features of its platform, Shopify acts as an independent controller of some data. You can see how it processes that data in its Consumer Privacy Policy.

9. Minors

The store is intended for adults. We do not knowingly collect data from children under 14.

10. Security

We apply technical and organisational measures to protect your data, such as encrypted connections (HTTPS) and restricted access to information.

11. Changes

We may update this policy. We will always publish the current version on this page, together with the date it was last updated.