Privacy policy

Last updated: 10 October 2026

This is a translation of the Spanish original. If the two versions differ, the Spanish version prevails.

This page explains who processes the personal data that comes in through juliettedecor.com, what it is used for, how long it is kept and how you can exercise your rights. We process data in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Who processes your data

The data controller is Neus Ledesma Nieto, the owner of this website. You can write to her at juliette@juliettedecor.com. Her tax ID and address are in the legal notice.

Juliette Decor is the name of this website. Where the forms or this page say ‘Juliette Decor’, ‘we’ or ‘us’, they mean the controller.

2. What data we process and why

Contact messages

When you write to us using the contact form, we receive your name, your email address, your message and, if you write from a piece’s page, which piece it is about. If you email us directly at juliette@juliettedecor.com, we process the data contained in your email.

• Purpose: to reply to your message.
• Legal basis: dealing with your request before a possible purchase (pre-contractual measures, Article 6(1)(b) GDPR) and our legitimate interest in replying to people who write to us (Article 6(1)(f)).
• How long: until your enquiry is resolved and for one year after that.

Orders

When you send us an order from your basket, we receive your full name, your email address, the pieces you have chosen and the delivery address: the postcode, town, country and, if you give it, the street. We also receive your phone number and your comments, if you add them.

• Purpose: to prepare your order and write to you with the total, including delivery, and how to pay. If you go ahead, also to send you the pieces.
• Legal basis: dealing with the order you place with us and, if you go ahead, carrying out the sale (pre-contractual measures and performance of a contract, Article 6(1)(b) GDPR). If the purchase is completed, also meeting our legal invoicing obligations (Article 6(1)(c)).
• How long: while we prepare and send the order. If the purchase is completed, we keep the invoice data for the period set by law: four years under the Spanish General Taxation Act and six under the Spanish Commercial Code. If the order doesn’t go ahead, one year from our last communication.

Form protection

The contact and order pages use Cloudflare Turnstile to check that the person sending the form is human. To do this, Cloudflare receives technical data about your browser and your connection, such as your IP address. When you send the form, the website also uses your IP address to limit how many submissions can be sent in a row from the same connection.

• Purpose: to protect the website and the mailbox from automated submissions.
• Legal basis: our legitimate interest in the security of the website (Article 6(1)(f) GDPR).
• How long: we keep your IP address for one minute after you send the form. Cloudflare explains how it handles Turnstile data in its privacy addendum (cloudflare.com/turnstile-privacy-policy).

Visitor statistics

If you press ‘Accept’ in the cookie notice, the website loads Google Analytics 4. It tells us how many visits the website receives and which pages people find most interesting. Google receives information about the pages you visit, the website or search engine you came from, technical data about your browser and your device, and a random identifier stored in a cookie. We use Google Analytics for statistics only, with Google Signals and ad personalisation turned off.

• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it whenever you like from ‘Cookie preferences’, at the bottom of every page.
• How long: the cookies last twelve months from your last visit, and Google keeps the details of each visit for two months. There’s more about this in the cookie policy.

The website also uses Cloudflare Web Analytics to count visits and measure how long each page takes to load. It works without cookies and without identifying visitors. The legal basis is our legitimate interest in knowing how the website is performing (Article 6(1)(f) GDPR).

Your basket and your cookie choice

Your browser stores your basket and the choice you make in the cookie notice. We only receive the contents of your basket when you send us the order.

3. Who else receives the data

We work with these providers:

• Cloudflare: hosts the website, protects the forms with Turnstile and counts visits with Cloudflare Web Analytics. It also hosts the shop’s database, on servers in the European Union, where we keep contact messages and orders.
• Resend: delivers contact messages and orders to the juliette@juliettedecor.com mailbox.
• Microsoft: hosts that mailbox in Microsoft 365, where messages and orders are stored.
• Google: if you accept analytics, provides us with the Google Analytics service.

If an order goes ahead, the carrier delivering it receives your name, your address and, if you have given it to us, your phone number. Where the law requires it, we disclose data to public authorities, such as the Spanish Tax Agency.

Transfers outside the European Economic Area

Cloudflare, Google, Microsoft and Resend are US companies or belong to groups based there, and they may process data outside the European Economic Area. These transfers are made with the safeguards required by the GDPR: the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

4. Your rights

At any time you can ask us to:

• Access: tell you whether we process your data and give you a copy.
• Rectification: correct any data that is wrong, or complete it.
• Erasure: delete your data, for example when it is no longer needed for the purpose it was collected for.
• Objection: stop processing your data in certain circumstances.
• Restriction: keep your data without using it, in the cases provided for by law, for example while we check whether it is accurate.
• Portability: give you your data in a structured, commonly used format, so that you can take it to another controller.
• Withdrawal of consent: stop using the data we process with your permission. What we did with it before you withdrew your consent remains lawful.

To exercise these rights, write to us at juliette@juliettedecor.com or send us a letter to the address given in the legal notice, and tell us what you are asking for. If we need to verify your identity, we’ll tell you. We’ll reply within a month at the latest. If your request is complex or we receive a large number at once, the law allows us up to two further months, and in that case we’ll let you know within the first month.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

5. Security

The website always runs over an encrypted connection (HTTPS). Whatever you send through a form is stored in the juliette@juliettedecor.com mailbox and in the shop’s database. Only the people who handle messages and orders have access to them.

6. Changes to this policy

If what the website does with your data changes, we’ll update this text and its date.