10% OFF YOUR FIRST ORDER 🔥
Privacy Policy
At FETĒN we handle your personal data transparently. This policy explains who processes your data, what data we process, why, on what legal basis, for how long, who we share it with and what rights you have. It is written in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Who is the controller of your data?
| Controller | Somos Fetén, S.L. ("FETĒN") |
| Spanish tax number (NIF) | B02994994 |
| Address | Ronda de San Antonio, 30 — 19210 Yunquera de Henares (Guadalajara), Spain |
| Register details | Commercial Register of Guadalajara, volume 643, folio 79, sheet GU-11245, entry 6 |
| Privacy email | hola@somosfeten.com |
| Telephone | +34 623 255 436 |
FETĒN has not appointed a Data Protection Officer, because none of the situations listed in Article 37(1) GDPR applies. You can raise any privacy question at hola@somosfeten.com, which is our contact point for this purpose.
FETĒN is established in Spain and has no establishment in any other Member State. Its lead supervisory authority is therefore the Spanish Data Protection Agency (AEPD), without prejudice to your right to lodge a complaint with the supervisory authority of your own country, as explained in clause 9.
2. Who this policy applies to
This policy applies to natural persons who:
- buy products on somosfeten.com;
- browse the website without buying;
- subscribe to our marketing communications;
- contact us by email, telephone or WhatsApp;
- interact with us on social networks.
It does not apply to data about legal persons.
3. What data we process and where it comes from
Data you give us directly:
- Identification and contact data: name and surname, email address, telephone number.
- Delivery and billing data: postal address, town or city, postcode, region, country and, where you ask for an invoice, your tax identification number.
- Order data: products, amounts, date, delivery method chosen.
- Content of your communications: the text of the emails, WhatsApp messages and enquiries you send us, and any data you include in them.
- Preferences: whether you have subscribed to our marketing communications and what about.
Data generated by your interaction with the website:
- Browsing data: IP address, device and browser type, operating system, language, pages visited, time spent, source of the visit, products viewed and added to the basket.
- Interaction data recorded by Microsoft Clarity: cursor movements, scrolling, clicks and the recording of your browsing session, as well as aggregated heatmaps. See clause 4, purpose P-8, and clause 5.
- Cookie identifiers and equivalent technologies, as described in the Cookie Policy.
Data we do not obtain from you directly (Article 14 GDPR):
- From Klaviyo, our email marketing provider: opens and clicks on our emails, and the address of the page from which you submitted a form, which is stored as a property of your profile.
- From WhatsApp (Meta Platforms Ireland Ltd.): your telephone number and the content of the message when you write to us through that channel, which is processed in our own service hosted on Vercel and may be linked to your customer profile.
- From the payment providers: confirmation or rejection of the transaction and a transaction identifier. FETĒN never stores your full card number, which is processed directly by the payment provider.
- From the carriers: delivery status and delivery incidents.
Data we do not process. We do not deliberately process special categories of data under Article 9 GDPR, except in the cosmetovigilance case described in purpose P-11. Please do not include information about your health in forms, emails or WhatsApp messages unless it is precisely in order to report an undesirable effect of one of our products.
4. Purposes, legal bases and retention periods
| # | Purpose | Categories of data | Legal basis (Article 6 GDPR) | Retention |
|---|---|---|---|---|
| P-1 | Managing your order: processing it, taking payment, preparing and delivering it | Identification, contact, delivery address, order data, transaction identifier | Art. 6(1)(b) — performance of a contract to which you are party | For the duration of the relationship and, afterwards, restricted for the guarantee and limitation periods (see P-2 and P-4) |
| P-2 | Invoicing and compliance with tax, accounting and company law obligations | Identification, tax data, amounts, invoices | Art. 6(1)(c) — legal obligation under Spanish commercial and tax law and under the VAT rules of the country of delivery | 6 years from the last entry under the Spanish Commercial Code, and for tax purposes until the obligations become time-barred (4 years under Spanish tax law). The longer of the two applies |
| P-3 | Answering your enquiries and complaints by email, telephone and WhatsApp | Contact, content of the communication, order reference | Art. 6(1)(b) where it concerns an order or a purchase in progress; Art. 6(1)(f) — legitimate interest in answering pre-purchase enquiries — in other cases | While we handle your enquiry and, afterwards, for the limitation periods of any claims that may arise from it |
| P-4 | Handling withdrawal, returns and the legal guarantee of conformity | Identification, contact, order data, payment method for the refund | Art. 6(1)(b) and Art. 6(1)(c) (Directive 2011/83/EU and Directive (EU) 2019/771, as transposed) | For the guarantee period applicable to you — at least two years from delivery, or longer where your national law provides — plus the limitation period for bringing a claim |
| P-5 | Sending you marketing communications by email (news, tips, offers) where you have subscribed | Email address, name, preferences, history of opens and clicks | Art. 6(1)(a) — your consent, in conjunction with Article 13(1) of Directive 2002/58/EC as transposed | Until you withdraw your consent or unsubscribe |
| P-6 | Sending you communications about products similar to those you have already bought | Email address obtained in the course of the sale | Art. 6(1)(f) — legitimate interest in promoting our own similar products, in conjunction with Article 13(2) of Directive 2002/58/EC and where the law of your country allows it, with an opt-out offered in every message and at the time the address is collected | Until you object |
| P-7 | Segmenting and personalising our communications in Klaviyo (profiling for marketing purposes) | Browsing and purchase behaviour, source address of the form, opens and clicks | Art. 6(1)(a) — your consent | Until you withdraw your consent |
| P-8 | Analysing how the website is used in order to improve it, including the recording of your browsing session and the heatmaps produced by Microsoft Clarity, and Google Analytics 4 analytics | Cookie identifiers, browsing data, cursor movements, clicks, scrolling, session recording | Art. 6(1)(a) — your consent, in conjunction with Article 5(3) of Directive 2002/58/EC as transposed. See clause 5 | Until you withdraw your consent, and in line with the cookie lifetimes described in the Cookie Policy |
| P-9 | Measuring the effectiveness of our advertising and showing you relevant ads (Meta Pixel and Meta Ads audiences) | Cookie identifiers, browsing and purchase events | Art. 6(1)(a) — your consent, in conjunction with Article 5(3) of Directive 2002/58/EC | Until you withdraw your consent, and in line with the cookie lifetimes described in the Cookie Policy |
| P-10 | Preventing fraud in orders and payments and keeping the website secure | Order data, IP address, risk signals provided by the platform and the payment provider | Art. 6(1)(f) — legitimate interest in preventing fraudulent transactions, which is also in the interest of our customers as a whole | For the duration of the relationship and the limitation periods of claims arising from the order |
| P-11 | Cosmetovigilance: collecting, assessing and, where appropriate, notifying undesirable effects of our products to the competent authorities | Identification, contact and health-related data you report to us | Art. 6(1)(c) — legal obligation (Article 23 of Regulation (EC) No 1223/2009); for health data, Art. 9(2)(i) — public interest in the area of public health | For as long as necessary to comply with that legal obligation and, afterwards, for the limitation periods of any claims that may arise |
| P-12 | Establishing, exercising or defending legal claims | The data necessary in each case | Art. 6(1)(f) — legitimate interest in FETĒN's legal defence | Until the corresponding claims become time-barred |
Consequences of not providing your data. The fields marked as mandatory in each form are necessary for the stated purpose. If you do not give us the data for purposes P-1 and P-2 we cannot process your order or issue your invoice. The data for the purposes based on your consent (P-5, P-7, P-8 and P-9) are voluntary, and not providing them does not affect your purchase.
Subscribing to and unsubscribing from marketing communications. You can subscribe to our marketing communications from the subscription form on the website. You can unsubscribe at any time and free of charge using the unsubscribe link included in every marketing message we send, or by writing to hola@somosfeten.com.
5. Notice about analytics and session recording
We want you to know exactly how our website works today:
- We use Microsoft Clarity, a behaviour analytics service provided by Microsoft Ireland Operations Limited, which records your interaction with the website, including cursor movements, scrolling, clicks, the recording of your browsing session and the production of heatmaps.
- This service loads when the page opens, before you are able to express your choice in our cookie notice. We do not currently apply enhanced masking of form fields.
- If you do not want your browsing to be recorded, you can block the domain
clarity.msin your browser settings or with a blocking extension, which is the only way of effectively preventing the recording from taking place. And if you write to hola@somosfeten.com telling us the approximate date of your visit, we will request the deletion of the data associated with your browsing and confirm the outcome to you. - This processing involves an international transfer of data to the United States. See clause 7.
6. Who we share your data with
To provide the service we work with providers who process personal data on our behalf (processors, Article 28 GDPR) and with third parties acting as independent controllers. These are the recipients of your data:
| Recipient | What for |
|---|---|
| Shopify International Limited (Ireland) and the Shopify group | E-commerce platform, hosting of the shop and of the checkout process |
| Shopify Payments | Card, Shop Pay, Apple Pay and Google Pay payments |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) | PayPal payments |
| Klaviyo, Inc. (United States) | Email marketing, customer profile management and segmentation |
| Microsoft Ireland Operations Limited | Microsoft Clarity: usage analytics, session recording and heatmaps |
| Meta Platforms Ireland Limited | Meta Pixel, advertising audiences and the WhatsApp channel |
| Google Ireland Limited | Google Analytics 4 and Google Search Console |
| Vercel Inc. (United States) | Hosting of our own service that manages the WhatsApp channel |
| Auctane / Packlink PRO | Logistics intermediary: contracts and manages the shipment on FETĒN's behalf. Your delivery data is passed through it to the final carrier |
| The carriers involved in each shipment | Delivery of orders |
| Tax and accounting advisers | Accounting, taxes and company law obligations |
| Public authorities, tax administrations, law enforcement bodies and courts | Where there is a legal obligation or a valid request |
| Competent cosmetics authorities, including the Spanish Agency for Medicines and Medical Devices (AEMPS) | Notification of serious undesirable effects (cosmetovigilance) |
You can ask us for further information about the role of each recipient by writing to hola@somosfeten.com.
7. International transfers of data
Some of our providers are established in the United States or belong to groups whose parent company is there, so the processing of your data may involve an international transfer outside the European Economic Area.
| Provider | Destination country |
|---|---|
| Klaviyo, Inc. | United States |
| Microsoft (Clarity) | United States |
| Meta Platforms | United States |
| United States | |
| Vercel Inc. | United States |
| Shopify | Canada and United States |
These transfers are made under the mechanisms provided for in Chapter V GDPR. You can ask us which safeguard applies to each provider, and for a copy of it where appropriate, by writing to hola@somosfeten.com.
8. Your rights and how to exercise them
You may exercise the following rights at any time:
| Right | What it means | Article |
|---|---|---|
| Access | To know whether we process data about you and obtain a copy of it | Art. 15 GDPR |
| Rectification | To correct inaccurate data or complete incomplete data | Art. 16 GDPR |
| Erasure | To ask us to delete your data where it is no longer necessary or you have withdrawn consent | Art. 17 GDPR |
| Restriction of processing | To ask us to keep your data but stop using it, in the cases provided for | Art. 18 GDPR |
| Portability | To receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller | Art. 20 GDPR |
| Objection | To object to processing based on our legitimate interest and, in any event and without giving reasons, to processing for direct marketing purposes | Art. 21 GDPR |
| Not to be subject to automated decisions | Not to be subject to decisions based solely on automated processing which produce legal effects or similarly significantly affect you | Art. 22 GDPR |
| Withdrawal of consent | To withdraw at any time any consent you have given us, without affecting the lawfulness of processing carried out beforehand | Art. 7(3) GDPR |
| Complaint to a supervisory authority | To lodge a complaint with a data protection supervisory authority | Art. 77 GDPR |
How to exercise them. Write to hola@somosfeten.com, or by post to Somos Fetén, S.L., Ronda de San Antonio, 30, 19210 Yunquera de Henares (Guadalajara), Spain, telling us which right you wish to exercise.
We will not routinely ask you for a copy of your identity document. It is enough that you write from the same email address you used for your order or your subscription. Only if we have reasonable doubts about your identity — for example, if you write from a different address — may we ask for additional information strictly necessary to confirm it, in accordance with Article 12(6) GDPR; in that case we will explain why and offer you the least intrusive alternative.
Response time. We will reply within one month of receiving your request. If the request is particularly complex, or if we have received several, that period may be extended by a further two months, in which case we will tell you about the extension and the reasons for it within the first month.
Exercising these rights is free of charge.
9. Your right to lodge a complaint with a supervisory authority
If you believe that the processing of your data does not comply with data protection law, or if you are not satisfied with how we have handled your rights, you may lodge a complaint with a supervisory authority.
You may lodge your complaint with the supervisory authority of the Member State of your habitual residence, of your place of work, or of the place of the alleged infringement, in accordance with Article 77 GDPR. You do not have to complain in Spain.
FETĒN's lead supervisory authority is the Spanish Data Protection Agency (AEPD):
| Postal address | Paseo de la Castellana, 141, 28046 Madrid, Spain |
| Electronic office | https://sedeaepd.gob.es |
| Website | https://www.aepd.es |
| General information line | +34 900 293 183 |
Before doing so, and without any obligation, you can contact us at hola@somosfeten.com.
In addition, under Article 79(2) GDPR you may bring court proceedings before the courts of the Member State where you have your habitual residence.
10. Profiling and automated decisions
We use tools that build profiles for marketing purposes: Klaviyo segments our contact base according to your browsing and purchase behaviour, and Meta builds advertising audiences from website events. We also run an internal workflow that classifies incoming WhatsApp conversations by commercial interest.
This processing does not produce legal effects concerning you and does not similarly significantly affect you within the meaning of Article 22(1) GDPR: it does not determine whether you can buy, the price you pay, or any condition of the contract. Its only effect is that the communications you receive are better matched to your interests.
You can object at any time to processing for direct marketing purposes, including the profiling connected with it, by writing to hola@somosfeten.com or using the unsubscribe link in our marketing communications.
11. Children
To buy on somosfeten.com you must have legal capacity to enter into a contract.
As regards the processing of personal data, under Article 8 GDPR processing based on the child's own consent in relation to information society services is lawful from the age of 16, unless the Member State of the child's residence has set a lower age, which cannot be below 13. We do not knowingly collect data from children below the age applicable in their country of residence. Below that age, consent must be given or authorised by the holder of parental responsibility.
If we find that we have processed a child's data without that consent, we will delete it. If you believe this has happened, write to hola@somosfeten.com.
12. Security of your data
We apply appropriate technical and organisational measures to protect your data in accordance with Article 32 GDPR, including encryption of communications using HTTPS/TLS, access control to the tools we use, and the selection of providers offering sufficient guarantees under Article 28 GDPR.
13. Changes to this Privacy Policy
We may update this policy to reflect changes in the law, new processing activities or changes to our providers. The version in force is always the one published on this page, with its last updated date.
If the changes are substantial — for example a new purpose or a significant new recipient — we will tell you by email or by a prominent notice on the website before they take effect.