Privacy Policy

Last updated: 07.08.2026

At Moda Lucia, we take the protection of your personal data very seriously. This Privacy Policy explains what data we collect, for what purposes, on what legal basis, and what rights you have. We process your data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

The controller responsible for processing your personal data is:

Moda Lucia, a trade name operated by BUsinessMAestro
Commercial Registry number (KvK): 93826141
VAT number (BTW): NL005046367B13
Address: Los Omeyas 5 Local, Unit #1098, 14005 Córdoba, Spain
Email: info@modalucia.com
Telephone: +31 6 58 01 26 74

For any matter related to data protection, you may contact info@modalucia.com.

2. What data we collect

Depending on how you use our website, we process the following categories of data:

a) Data you provide to us directly:

• Identification and contact data: first name, last name, delivery and billing address, email address, telephone number.
• Order data: products purchased, amount, order history.
• Payment data: payment method used. Important: your complete card details are processed exclusively by our certified payment providers; Moda Lucia does not store them at any time.
• Communications: the content of messages you send us by email or through the contact form.
• Subscription data: your email address, if you subscribe to our newsletter.

b) Data we collect automatically:

• Technical data: IP address, browser and device type, operating system, language, approximate country.
• Usage data: pages visited, products viewed, duration of the visit, source of the visit.
• Cookies and similar technologies, in accordance with our Cookie Policy.

We do not process special categories of data (such as health data or beliefs), nor do we intend to collect them.

3. Purposes and legal bases for processing

When processing is based on your consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out previously.

4. Data recipients

We only share your data with third parties when necessary for the purposes described, and always with appropriate safeguards:

• Shopify Inc. — e-commerce platform that hosts our store and processes order data.
• Payment providers — to process your payment securely (depending on the method chosen: Shop Pay, Visa, Mastercard, American Express, Maestro, Apple Pay, Google Pay, Bancontact, BLIK, MobilePay, TWINT).
• Logistics and transport partners — to prepare, ship, and deliver your order, including tracking information.
• Email marketing service providers — to send the newsletter, only if you have subscribed.
• Order tracking providers — so that you can check the status of your shipment.
• Analytics and advertising providers (for example, Google, Meta) — only with your consent through the cookie banner.
• Advisers and authorities — where there is a legal obligation (for example, tax authorities).

We have concluded the corresponding data processing agreements with all providers that process data on our behalf (Art. 28 GDPR). We do not sell your personal data to third parties.

5. International transfers

Some of our providers are established outside the European Economic Area (for example, in the United States or in countries from which logistics are managed). In such cases, we ensure an adequate level of protection through:

• European Commission adequacy decisions (Art. 45 GDPR), including the EU–U.S. Data Privacy Framework for certified providers; or
• standard contractual clauses approved by the European Commission (Article 46 GDPR), supplemented by additional measures when necessary.

You can request more information about the safeguards applied by writing to info@modalucia.com.

6. Retention periods

We retain your data only for as long as necessary for each purpose:

• Order and billing data: for the duration of the contractual relationship and, subsequently, for the legally applicable tax and commercial retention periods, as well as for the duration of the statutory warranty period.
• Customer service communications: until your inquiry has been fully resolved and, subsequently, for the limitation periods applicable to potential claims.
• Newsletter: until you withdraw your consent or unsubscribe.
• Cookies: according to the periods specified in our Cookie Policy.

Once these periods have elapsed, the data is securely deleted or anonymized.

7. Your rights

As a data subject, you have the following rights:

• Access (Article 15 GDPR): find out what data we process about you.
• Rectification (Article 16 GDPR): correct inaccurate or incomplete data.
• Erasure (Article 17 GDPR): request the deletion of your data ("right to be forgotten").
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR): receive your data in a structured, commonly used format.
• Objection (Article 21 GDPR): object to processing based on legitimate interest and, in any event, to processing for direct marketing purposes.
• Withdrawal of consent at any time, with effect for the future.

You may exercise these rights free of charge by writing to info@modalucia.com, specifying the right you wish to exercise and attaching information that allows us to verify your identity. We will respond within a maximum period of one month.

Additionally, you have the right to lodge a complaint with a supervisory authority. In Spain, the competent authority is the Spanish Data Protection Agency (AEPD), www.aepd.es. If you reside in another EU country, you can contact the authority in your country; you will find the full list on the website of the European Data Protection Board.

8. Cookies

We use cookies and similar technologies. Strictly necessary cookies are always installed; analytics and marketing cookies are used only with your consent through the cookie banner, which you can change at any time. You will find all the information in our Cookie Policy. You can also manage your privacy preferences on the Your privacy choices page.

9. Security

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or destruction: SSL/TLS encryption throughout the website, payment processing through PCI-DSS-certified providers, restricted access to data, and regular review of our security measures.

10. Minors

Our website is not intended for individuals under 18, and we do not knowingly collect data from minors. If you believe that a minor has provided us with personal data, please contact us and we will delete it.

11. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Our payment providers may carry out automated fraud checks; if a payment is declined, you can contact us for a manual review.

12. Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. The current version is always available on this page, with the date of the last update indicated. In the event of substantial changes, we will notify you appropriately.

---

Do you have a question, need help with your order, or simply want to get in touch with us? We are here to help.
Our team usually responds within 24 hours on business days.
Tell us how we can help.

✉️ Send us an email:
info@modalucia.com
Monday to Friday, 9:00 – 17:00 (CET)

📍 Address:
Wilhelminastraat 15, 6812 CW Arnhem, Netherlands

💬 Would you prefer to do it online?
Use our contact form — we usually respond within 24 hours.

Company number: 60689584419