Privacy policy

Who is responsible

The controller is ESTILO NODOS SL, trading as NODOS by G, tax ID B75931782, at C/Luis Vives 14, 28002 Madrid, Spain. For privacy questions and rights requests, contact info@nodosbyg.com.

This notice concerns the fashion/accessories shop, Academy and website.

What we use personal data for

Orders, customer accounts and delivery

We use the identity and contact details you supply, billing and delivery information, selected items, order and payment references, and relevant correspondence to take and fulfil orders, manage an account you request, arrange delivery and provide customer support. Processing necessary for your purchase or requested account is based on the contract or steps you ask us to take before it. Accounting and tax records are processed to meet legal obligations.

We share the information needed for delivery with the relevant carrier and use hosting, shop and communications suppliers for the services they provide. We do not need optional marketing consent to fulfil your order.

Payments and transaction checks

The payment provider handles the payment information required for the method you choose. We use transaction references and payment status to reconcile your purchase, handle refunds and investigate payment problems. We use Stripe for card-payment processing. The payment methods available for your order are shown at checkout.

Enquiries, complaints and rights requests

We use your contact details, the contents of your message and relevant purchase information to answer enquiries and handle complaints or privacy requests. The basis is precontractual steps or the contract where relevant, and legal obligations where applicable.

For general messages outside those purposes, our legitimate interest is to answer enquiries addressed to us. Where necessary, we also process relevant records for our legitimate interests in establishing, exercising or defending legal claims and protecting the website against fraud, abuse and security incidents. This is limited to information needed for the particular purpose; it is not permission to use enquiries or security records for marketing. You may object as explained below.

Academy learners

We use booking and contact details, the chosen course/location, learner information needed to provide the class, attendance and completed teaching hours to arrange teaching and issue the relevant completed-hours certificate. The purchasing adult and learner may be different people.

Where the learner is a party to the teaching contract, the basis is that contract. Otherwise, our legitimate interest is to provide the teaching booked for the learner and document the hours completed. We receive the necessary learner details from the person making the booking or from the learner. For a child, communication is arranged through the responsible adult and only information needed for the teaching is used. This does not authorise marketing to the learner.

When learner information comes from another person, we provide this notice to the learner or, where appropriate, their parent or guardian by our first direct contact, before an earlier disclosure to another recipient and in any event within one month. The notice explains the information received, its source and the learner's rights. This may be done through the existing booking or joining correspondence.

We do not record classes. Online teaching uses Google Meet. Any permission to publish a learner's photograph is requested separately; booking a class or accepting these terms does not give that permission.

Optional newsletters and commercial messages

If you subscribe to our marketing emails, we use your email address and subscription preferences to send the messages you requested, based on your consent. You can withdraw that consent at any time. Buying, creating an account or accepting cookies does not, by itself, subscribe you to marketing emails.

You can unsubscribe free of charge using the unsubscribe option in the message or by contacting info@nodosbyg.com. We do not routinely require an identity-document copy to unsubscribe. Objection to direct marketing ends that marketing use.

Website statistics, advertising and embedded media

With the relevant consent, optional services measure website use and advertising interactions or display embedded media. The optional services described in Cookie settings include Google Analytics 4 via Google Tag Manager, Microsoft Clarity session replays, WooCommerce visit attribution, Meta Pixel and Conversions API, Google Ads, Pinterest Tag, Omnisend marketing forms/visit and basket-recovery features, and YouTube embeds.

These services can process identifiers, device/browser and usage information, referral or campaign information and relevant shop-event data. Advertising services can connect activity with provider accounts or advertising audiences. The precise data, providers, storage durations and controls are described in the cookie information.

Essential basket, requested shopping-session and language functions are separate from optional marketing. Cookie consent and permission to send commercial messages are separate choices. You can change or withdraw optional cookie choices through Cookie settings in the footer; withdrawal does not affect the lawfulness of earlier consent-based processing.

Required and optional information

We need sufficient contact, order, delivery and payment information to fulfil a physical purchase, and sufficient booking/learner information to supply the requested class. If necessary information is missing, we may be unable to provide that service. Optional marketing choices do not determine whether you can buy. Required fields are identified on the relevant form.

Who receives information and international transfers

Recipients include the carriers needed for your delivery, payment providers, suppliers of hosting, shop administration, communications and Academy delivery, and the optional measurement/advertising providers selected through the relevant choices. Professional advisers and public authorities receive information where necessary for their role or a legal requirement. The data supplied must be limited to the purpose.

We use Hostinger for website hosting and Omnisend for marketing communications. Advertising and product-visibility channels include Google Ads, Google Merchant Center and Meta. Deliveries use the carrier needed for the order, usually Correos or DHL and sometimes ELTA for dispatches from Athens. The information shared depends on the service and the relevant choices or other applicable lawful basis.

Live online lessons use the free Google Meet service. Meeting information can include your display name or account details, audio/video and connection data. Google's own processing is explained in its Terms of Service and Privacy Policy. For users in the European Economic Area, Google Ireland Limited is the controller under that policy unless a service-specific notice states otherwise. NODOS remains responsible for its own booking and teaching records.

Stripe processes payment data on our behalf and also acts as an independent controller for purposes such as fraud prevention and meeting its own legal obligations. Its services can involve international processing. For transfers to Stripe, LLC in the United States covered by the EU-US Data Privacy Framework, Stripe's transfer terms use that framework; otherwise the applicable EU Standard Contractual Clauses apply. The terms and safeguards are available in Stripe's Data Transfers Addendum, and its own uses and retention are explained in Stripe's Privacy Policy. You can also contact info@nodosbyg.com to request information or a copy of the applicable safeguards.

Omnisend's processing terms and Wordfence/Defiant's processing addendum incorporate EU Standard Contractual Clauses for covered transfers outside the EEA. The published notices of Google, Meta and Pinterest describe reliance on the EU-US Data Privacy Framework for covered US transfers, with Standard Contractual Clauses or other applicable grounds where required. Microsoft Clarity describes its EU service through Microsoft Ireland and clauses covering transfers to Microsoft Corporation in the US. Optional services depend on your relevant choices; accepting these terms is not consent to optional tracking.

How long information is kept

• Order, invoice and payment records: for fulfilment, support and applicable accounting, tax and legal-claim requirements. We retain the purchase-time conditions, relevant consent and acceptance record with the order to document the purchase and administer the applicable rights and guarantee. Only the information still needed for those purposes is retained.
• Account information: while the requested account is in use, then only as needed for applicable legal obligations or claims. Account closure does not automatically erase records that must legally be retained.
• Enquiries and complaints: for answering and following up the matter and for any applicable legal obligations or claim period.
• Academy records: for administering the purchased teaching and completed-hours certificate, then for any applicable legal obligations or claims.
• Marketing emails: until you withdraw consent or unsubscribe. We retain only the consent evidence and limited suppression information needed to demonstrate and respect your choice, subject to applicable legal requirements; these records are not used to continue marketing.
• Consent records: for recording and demonstrating the relevant choices for the applicable period.
• Cookie and device storage: as stated for the particular service in the cookie information. This does not state how long a supplier keeps data already received.
• Technical and security records: WooCommerce diagnostic log files use its normal cleanup period, currently 30 days. Security traffic records use the security tool's age and record-count limits; login histories and records needed to investigate a specific incident are separate. Relevant incident evidence is kept only while needed for that investigation, follow-up protection or an applicable legal obligation or claim, rather than reused for marketing.
• Recovery copies: these are separate from routine log cleanup. We restrict access and keep them only while needed for recovery or evidence preservation, then delete them when that purpose and any applicable legal retention requirement end. Applicable deletion and suppression choices must be reapplied before restored data returns to ordinary use or marketing.

Where a supplier processes information as an independent controller, its own legal duties and retention criteria also apply. In particular, Stripe may retain payment and fraud-prevention information after our customer relationship ends, as explained in its Privacy Policy. Closing an account or withdrawing marketing consent does not erase every necessary payment or legal record immediately.

Your rights

Contact info@nodosbyg.com to request access, rectification, erasure, restriction or portability of your personal data, or to object to processing, where the relevant right applies. You may object to direct marketing at any time. Where processing relies on legitimate interests, you may object on grounds relating to your situation under the applicable rules.

If processing is based on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal. Erasure and other rights have legal conditions; for example, a valid retention obligation may mean an invoice cannot yet be deleted.

We may request additional information if we have reasonable doubts about your identity, limited to what is necessary to confirm it. We will respond without undue delay and normally within one month. If the legal conditions for an extension apply, we will inform you within that month and explain why. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

Automated decisions and policy revisions

Stripe automatically assesses fraud risk using transaction and payment information, device/browser signals, IP address and address information. Risk scores and blocking rules can stop a payment, preventing that purchase attempt. A risk flag is not proof of wrongdoing.

If you think a payment was wrongly blocked, contact info@nodosbyg.com to explain the circumstances and request human review or challenge the result. We can investigate the shop-side information and contact the provider where needed, but cannot guarantee payment approval or override the provider's or card issuer's controls. Stripe's Privacy Policy explains rights concerning its own processing; its Privacy Center provides the route for privacy requests to Stripe. These checks and the automatic order receipt are separate from NODOS's manual order acceptance.

We date revisions so you can identify the notice version. A revised privacy notice does not itself supply consent for a new purpose. Any further information or permission required for a new use must be provided separately.