Privacy policy

Last updated: 17 September 2026.

1. DATA CONTROLLER

The controller of personal data collected through https://christmasjumper.shop/ (the “Website”) is:

Company name: COOL CHRISTMAS CLOTHING, S.L.
Trading name: Christmas Jumpers.
Spanish tax identification number (NIF): B42975615.
Registered office: Plaza Castilla 3, 14 E1, 2, 28046 Madrid, Spain.
Postal address: Las Fábricas 14, 28923 Alcorcón, Madrid, Spain.
Contact email: info@christmasjumper.shop.

If you have any questions about the protection of your personal data, you can email us at info@christmasjumper.shop.

2. PERSONAL DATA WE PROCESS

We process the personal data you provide directly, together with data generated when you use the Website, make a purchase or interact with our services.

2.1. Data provided by you

Depending on the service you use, we may process:

  • Identification and contact details, such as your first name, surname, email address, telephone number and postal address.

  • Information needed to manage purchases, deliveries, returns, exchanges, refunds and invoicing.

  • Customer account details, where this feature is available and you choose to create an account.

  • Information included in enquiries, requests, reported issues, complaints or communications with our customer service team.

  • Information provided when you subscribe to our newsletter, complete a form or request information.

  • Information included in product reviews, such as the review text, rating, name or username used and, where applicable, any attached images.

2.2. Data generated when browsing

When you browse the Website, we may process technical and usage data, such as your IP address, device or browser identifiers, pages visited, products viewed, interactions with the Website, referral source, browsing dates and times, and information obtained through cookies and similar technologies.

You can find detailed information about these technologies in our Cookies Policy.

3. PURPOSES, LAWFUL BASES AND RETENTION PERIODS

3.1. Managing purchases and the contractual relationship

We process the data needed to manage your order, confirm the purchase, collect payment, prepare and dispatch products, provide order updates, handle exchanges, returns, cancellations and refunds, and deal with any subsequent issues.

The lawful bases are performance of the sales contract and compliance with applicable legal obligations.

We retain this data for as long as necessary to manage the contractual relationship and, afterwards, for the retention or limitation periods required by applicable legislation.

3.2. Customer service, enquiries and complaints

We process your data to answer enquiries, handle requests, resolve issues and deal with complaints relating to the Website, products or orders.

The lawful basis is performance of the contract, taking steps at your request before entering into a contract, or our legitimate interest in responding appropriately to the communications we receive.

We retain this data for as long as necessary to deal with your request and, afterwards, for any legally required periods during which potential liabilities may arise.

3.3. Creating and managing customer accounts

Where this feature is available and you choose to create an account, we process your data to give you access to your profile, allow you to view orders and manage your details, and enable you to use the features associated with your account.

The lawful basis is performance of the contractual relationship or taking steps at your request before entering into a contract.

We retain this data while your account remains active. Once the account has been deleted, the data may be retained with access and use restricted for the periods required by law.

3.4. Newsletters and marketing communications

We may send marketing communications about Christmas Jumpers, our products, new arrivals, promotions and campaigns if you have consented to receive them or where another lawful basis permits this under applicable legislation.

The lawful basis is your consent or, where applicable, our legitimate interest in informing existing customers about products similar to those they have already purchased, always with a simple and free way to object or unsubscribe.

We use Klaviyo to send and automate marketing communications.

We retain this data for as long as your consent remains in place or until you unsubscribe. You can unsubscribe at any time using the link included in each communication or by emailing info@christmasjumper.shop.

3.5. Product reviews

If you submit a review, we process the information you include to display it on the Website, manage its publication and improve our products and services. We use Judge.me for this service.

Publication of a review is based on your request or the consent you give when submitting it. Alongside the review, we may display the name, username or other details you have chosen to make public.

The review will remain published for as long as you have not requested its removal, the product remains available or retention is necessary for legal reasons or to defend against potential claims.

3.6. Managing returns and exchanges

We process the data needed to handle requests for returns, cancellation, exchanges and refunds. We use Reveni to facilitate this process.

The lawful bases are performance of the contract, compliance with consumer protection obligations and, where applicable, our legitimate interest in organising and improving our after-sales services.

We retain this data for as long as necessary to process the request and for the applicable statutory retention periods.

3.7. Fraud prevention and security

We may process purchase, payment, browsing and behavioural data to prevent fraud, misuse, attacks on the Website and other activities that threaten the security of our services.

The lawful basis is our legitimate interest in protecting the Website, our customers and our business, together with compliance with legal obligations where applicable.

We retain this data for as long as necessary for these purposes and to address potential liabilities.

3.8. Analytics, measurement and personalised advertising

With your consent, we may use cookies and similar technologies to analyse how the Website is used, measure advertising campaigns and display more relevant advertising.

Depending on the active configuration, we may use services provided by Google Analytics 4, Google Ads, Meta, TikTok, Elevar, Klaviyo and other measurement or marketing tools.

The lawful basis is your consent, which you can withdraw or change at any time through the cookie settings panel.

Data obtained through these technologies is retained for the periods specified in the Cookies Policy.

3.9. Affiliate marketing

With your consent, we may use the Propelbon affiliate network to attribute purchases made through our affiliates’ links, content or promotional activities and measure the performance of those campaigns.

For this purpose, Propelbon may process cookie identifiers, technical browsing data, referral sources, transaction identifiers and order information, such as the amount, currency or products, where needed to attribute the sale. We do not provide additional personal data that is unnecessary for this purpose.

The lawful basis is your consent to the use of marketing cookies and technologies. You can withdraw or change your consent at any time through the cookie preferences panel.

Data obtained through these technologies is retained for the periods specified in the Cookies Policy.

4. RECIPIENTS OF PERSONAL DATA

We do not sell or rent your personal data.

We may share your data with, or give access to, providers whose services are needed to operate the store, manage orders and provide customer support. These include:

  • Shopify, as our e-commerce platform.

  • Shopify Payments and the payment providers available at checkout, for payment processing.

  • Klaviyo, for newsletters and marketing automation.

  • Propelbon, as an affiliate marketing network, to attribute and measure purchases arising from affiliates’ promotional activities.

  • Reamaze, for customer service management.

  • Judge.me, for managing and publishing product reviews.

  • Reveni, for managing returns and exchanges.

  • GLS, FedEx and DHL Express, for order delivery.

  • Elevar, Multifeeds and Forms, where applicable according to the service configuration.

  • Google, Meta and TikTok, where you have accepted the relevant analytics or advertising cookies.

These providers may act as data processors or as independent recipients, depending on the nature of the service and the configuration used.

We may also disclose data to public bodies, authorities, financial institutions, insurers, professional advisers or law enforcement agencies where legally required or necessary to defend our rights.

5. INTERNATIONAL DATA TRANSFERS

Some of the providers listed above may be located outside the European Economic Area or allow data to be accessed from outside that area.

Where international data transfers take place, we apply the safeguards required by applicable legislation, such as European Commission adequacy decisions, standard contractual clauses or other valid mechanisms appropriate to the circumstances.

You can request further information about applicable international transfers by emailing info@christmasjumper.shop.

6. AUTOMATED DECISION-MAKING AND PROFILING

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

However, where you have consented to analytics or advertising cookies, we may create basic marketing segments or profiles based on browsing activity, interactions with campaigns or purchase history, in order to measure results and personalise communications or advertising.

You can withdraw your consent for these purposes at any time through the cookie settings panel or by using the unsubscribe options included in our marketing communications.

7. YOUR RIGHTS

You may exercise the following rights in relation to your personal data:

  • Access: to find out what personal data we process about you.

  • Rectification: to request the correction of inaccurate or incomplete data.

  • Erasure: to request the deletion of your data where applicable.

  • Objection: to object to certain processing based on legitimate interests.

  • Restriction: to request that we restrict the processing of your data in certain circumstances.

  • Data portability: to receive your data in a structured format and transfer it to another controller where applicable.

  • Withdrawal of consent: to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, email info@christmasjumper.shop, stating which right you wish to exercise. We may request additional information to verify your identity where necessary.

We will respond within one month, unless applicable legislation allows this period to be extended due to the complexity or number of requests.

If you believe that the processing of your data does not comply with applicable legislation, you may lodge a complaint with the Spanish Data Protection Agency through https://www.aepd.es.

8. CHILDREN

The Website and the purchase of products are intended for people with the legal capacity to enter into a contract.

We do not knowingly collect personal data from children under 14 without the authorisation of their parents or legal guardians.

If you believe that a child has provided us with personal data without such authorisation, please contact info@christmasjumper.shop so that we can take appropriate action.

9. DATA SECURITY

We apply reasonable technical and organisational measures to protect personal data against loss, alteration, unauthorised access, disclosure or destruction.

However, no system for transmitting or storing information is completely secure. Although we apply appropriate measures, we cannot guarantee the absolute security of information.

10. LINKS TO THIRD-PARTY WEBSITES

The Website may contain links to third-party websites. We are not responsible for their privacy practices or content.

We recommend reviewing their privacy policies before providing any personal data.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy where necessary due to changes in legislation, technology, operations or the personal data processing we carry out.

The current version will always be the version published on this page. Where changes are significant, we will take reasonable steps to bring them to your attention.