Privacy Policy

Last updated: 21 October 2026

This policy explains what personal data we process when you visit wamfit.com, buy from us or sign up to our emails, why we do it, who receives it and what rights you have under the GDPR and Spanish data protection law (LOPDGDD).

1. Data controller

Anna Falk, self-employed sole trader (autónomo), trading as WAM – We Are More, Carrer de Varsòvia 106, 08041 Barcelona, Spain. NIF: Y6361304R. Email: hello@wamfit.com. We have not appointed a data protection officer, as we are not required to.

2. What we process, why and on which legal basis

Purpose	Data	Legal basis (GDPR)	How long we keep it
Processing your order, payment, delivery, returns and withdrawals	Name, addresses, email, phone, order and payment details	Art. 6(1)(b) contract	6 years after the order (Spanish Commercial Code, tax law)
Invoices and accounting	Order and billing data	Art. 6(1)(c) legal obligation	6 years
Customer account	Email, name, addresses, order history	Art. 6(1)(b) contract	Until you delete the account
Customer service	Your messages and contact details	Art. 6(1)(b) contract or 6(1)(f) legitimate interest in answering you	2 years after the conversation ends, unless needed for a claim
Newsletter and marketing emails	Email, name (optional), opening and click data	Art. 6(1)(a) consent	Until you unsubscribe
Product emails to existing customers about similar products	Email	Art. 6(1)(f) legitimate interest, Spanish LSSI art. 21(2); you can object in every email	Until you object
Reviews	Name or initials, review text, photos, email (for verification)	Art. 6(1)(a) consent	Until you ask us to remove it
Website security and operation	IP address, device and browser data, server logs	Art. 6(1)(f) legitimate interest in a secure shop	Short-term, as set by Shopify
Analytics and advertising cookies	Cookie IDs, usage data	Art. 6(1)(a) consent via the cookie banner	See our Cookie Policy
Affiliate tracking (crediting a partner whose link you used)	Affiliate click ID, order number and value	Art. 6(1)(a) consent via the cookie banner (marketing)	Cookie: 30 days after the last affiliate click; commission records: 6 years (accounting)
Fraud prevention	Order, payment and device data	Art. 6(1)(f) legitimate interest	As long as needed for the check

You do not have to give us personal data, but without contact and delivery details we cannot process an order.

3. Who receives your data

We use the following service providers, who process data on our behalf under data processing agreements, or as independent controllers where stated:

• Shopify (Shopify International Ltd., Dublin, Ireland): shop platform, hosting, checkout, customer accounts, Shop Pay.
• Payment providers, depending on the method you choose: Shopify Payments, operated with Stripe Payments Europe Ltd. (Dublin, Ireland), for cards, Apple Pay, Google Pay, Bancontact, Bizum, iDEAL | Wero, MB WAY, MobilePay and Satispay; PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg); Klarna Bank AB (publ) (Stockholm, Sweden). For payment, fraud and credit checks, PayPal and Klarna act as independent controllers under their own privacy policies.
• Carriers: SEUR, Correos Express, UPS, DHL, depending on the country and the option you choose. They receive your name, delivery address and, for delivery notifications, your email or phone.
• MailerLite (UAB MailerLite, Vilnius, Lithuania): newsletter and signup forms.
• Judge.me (Judge.me Ltd, London, United Kingdom): product reviews. The UK has an EU adequacy decision.
• Google Ireland Ltd. (Dublin): Google Analytics, only with your consent, and reCAPTCHA to protect our forms against spam.
• Meta Platforms Ireland Ltd. (Dublin): Facebook/Instagram pixel to measure and target ads, only with your consent. For collecting the data via the pixel, we and Meta are joint controllers (Art. 26 GDPR).
• UpPromote (UpPromote Technology Joint Stock Company, Vietnam; data stored on servers in the United States): records whether you came via an affiliate partner's link so we can pay their commission, only with your consent.
• Appstle (bundles app): applies bundle and volume discounts in your cart.
• Revoq (BuschBytes, Germany, hosted in the EU): our online withdrawal function.
• Instafeed (nfcube) and CleanHub GmbH (Berlin): show our Instagram feed and our plastic-collection banner. When these load, your IP address is transmitted to their servers.
• Our tax advisor and, where legally required, tax authorities and courts.

4. Transfers outside the EU

Some providers or their sub-processors (for example Shopify, Google, PayPal, Meta, UpPromote) may process data in the United States or other countries outside the EU/EEA. Where they are certified under the EU–US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision; otherwise on the Commission's Standard Contractual Clauses (Art. 46 GDPR).

5. Cookies

We use technically necessary cookies to run the shop, and analytics and marketing cookies only if you consent in the cookie banner. You can change your choice at any time. Details are in our Cookie Policy.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21), including direct marketing at any time. Where we rely on consent, you can withdraw it at any time with effect for the future. Email hello@wamfit.com; we answer within one month.

You also have the right to complain to a supervisory authority, in Spain the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or the authority in your country of residence.

7. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Payment providers may run automated fraud and credit checks under their own privacy policies.

8. Children

Our shop is for adults. We do not knowingly collect data from children under 14 (the age of digital consent in Spain).

9. Changes

We update this policy when our services or the law change. The date at the top shows the current version.