Legal

Privacy policy

Last updated: August 2026

At MILAGRITOS we take the protection of your data very seriously. This policy explains what information we collect, what we use it for and what your rights are.

1. Data controller

Trade name: MILAGRITOS
Activity: Sale of handmade candles
Address: Barcelona, Spain
Contact email: [email protected]

2. Data we collect

When you place an order through the form on this website, we collect the following data:

• First name and surname
• Email address
• Phone number
• Delivery address
• Personal message or dedication (if you provide one)
• Order details (products and quantities)

For personalised photo candles, we also receive the image you send us, which is used solely to make your candle. If you would like us to delete it, write to us.

3. Purpose and legal basis

We use your data only to:

• Process and ship your order — legal basis: performance of a contract (art. 6.1.b GDPR)
• Answer your questions or deal with any issues — legal basis: legitimate interest (art. 6.1.f GDPR)

We do not use your data for advertising, we do not share it with third parties for commercial purposes and we do not build profiles.

4. Who receives your data

For your order to work, your data passes through contracted services that work on behalf of MILAGRITOS, under a data processing agreement:

• Payment gateway — processes the card payment. Your card details are entered directly on its secure page and never pass through this website, nor do we keep them.
• Email delivery service — sends the confirmation email for your order. It receives your name, your email and the delivery address.
• Image storage — temporarily stores the photo you upload for a personalised candle.
• Web hosting — where this website and the list of orders live.
• Form handling — collects the order form and passes it on to us.
• Visitor analytics — statistics on which pages are viewed most. Only active if you accept the cookie notice.

If you would like to know exactly which company provides each of these services, write to us at [email protected] and we will tell you.

We do not pass your data on to any other company, body or person outside the handling of your order.

5. How long we keep your data

We keep your data for as long as needed to handle the order and for the legal period for keeping business records (5 years). Photos for personalised candles are deleted when you ask us to.

6. Your rights

You can exercise the following rights at any time by emailing [email protected]:

• Access — find out what data we hold about you
• Rectification — correct inaccurate data
• Erasure — ask for your data to be deleted
• Objection — object to a specific use of your data
• Restriction — ask us to restrict the use of your data
• Portability — receive your data in a structured format

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es

7. Cookies

This website does not use advertising cookies and does not sell your data to anyone. We use two things:

• Local browser storage (localStorage) — to remember whether you have accepted this notice and so you don't lose what you were typing in the form if you leave and come back. It does not identify you and is not sent to any server. It is essential for the website to work.
• Google Analytics — anonymous visitor statistics (which pages are viewed, from what type of device). Only active if you click «Accept» on the cookie notice. If you click «Decline», it is not loaded and no data is collected.

You can change your mind at any time by clearing this site's data in your browser: next time you visit, we will ask you again.

8. Security

Communications between your browser and this website use HTTPS. All the services we use comply with the security measures set out in the GDPR.

9. Changes

We may update this policy from time to time. The date of the last update appears at the top of this document. We recommend checking it regularly.