DIVINA FASHION 2021

Purchase Now

Privacy Policy

‌Effective Date: October 19, 2026‌

1. Introduction

DIVINA FASHION 2021 SEVILLA, S.L. (referred to as “we”, “us”, or “our”) operates the e-commerce website www.divinafashion2021.com, a minimalist fashion and lifestyle brand rooted in Sevilla, Spain, dedicated to offering timeless, high-quality canvas bags, hats, waist bags and other daily essentials that fit seamlessly into your everyday quiet moments. This Privacy Policy is designed to inform all users (referred to as “you” or “your”) about how we collect, use, store, share and protect your personal data when you access, browse, make purchases or interact with our website, in full compliance with the General Data Protection Regulation (GDPR), the European Accessibility Act (EAA), the EU AI Act and all applicable European data protection and consumer protection regulations in effect in 2026.

We are committed to upholding the highest standards of data privacy, ensuring that all your personal information is processed lawfully, fairly and transparently. This policy outlines your legal rights over your personal data, our data processing protocols, and the strict security measures we implement to safeguard your information against unauthorized access, disclosure, alteration or destruction. By accessing and using our website, you acknowledge that you have read, understood and agree to the terms outlined in this Privacy Policy. If you do not agree with any part of this policy, please refrain from using our platform and submitting any of your personal information to us.

2. Data Controller Identification

The data controller responsible for processing your personal data under this Privacy Policy is:

  • Full legal name: DIVINA FASHION 2021 SEVILLA, S.L.
  • Registered physical address: Calle Artesa 12, Polígono Industrial Aeropuerto, 41020 Sevilla, Spain
  • Official contact email: [email protected]
  • Contact telephone number: +34 913 687 857

If you have any questions, concerns or requests related to your personal data processing, you can reach out to our designated Data Protection Officer at any time via the contact channels listed above. Our team will respond to all valid inquiries within 3 business days, in full alignment with GDPR requirements for timely and transparent communication with data subjects.

3. Types of Personal Data We Collect

We only collect personal data that is directly relevant to delivering a seamless, secure and satisfying e-commerce experience to you, and never collect unnecessary or excessive information without your explicit consent. The categories of personal data we may process include:

  1. ‌Account and transaction data‌: When you create an account on our website, place an order, or complete a purchase, we collect your full name, billing address, shipping delivery address, email address, contact phone number, and order history including items purchased, order value, payment status and delivery notes. This data is mandatory for us to process your orders, arrange logistics delivery, and complete the transaction contract we enter into with you when you make a purchase on our platform.
  2. ‌Payment data‌: When you complete payment for your orders, we collect necessary payment-related information including payment card last four digits, payment transaction ID, and billing verification details. We do not store full credit card or debit card information on our own servers, all sensitive payment processing is handled by our PCI DSS-compliant trusted payment service providers to ensure maximum security of your financial data.
  3. ‌Website usage and technical data‌: When you browse our website, we automatically collect certain technical information including your IP address, browser type and version, device type and operating system, website access timestamps, pages you view, links you click, search queries you submit on our site, and your navigation paths across our product pages, blog content and checkout flow. This data helps us optimize our website performance, troubleshoot technical issues, and improve the usability of our platform for all visitors.
  4. ‌Cookie and preference data‌: We use first-party and strictly necessary cookies to remember your shopping cart contents, your saved product preferences, your selected currency (EUR, as our primary operating currency) and your cookie consent settings, to avoid repeated pop-ups and provide you with a more convenient browsing experience. Per 2026 updated EU data protection rules, all non-essential cookies will only be activated after you provide your explicit, freely given, specific and unambiguous consent via our cookie consent banner.
  5. ‌Voluntarily submitted user data‌: When you submit customer reviews, send us inquiries via our contact page, subscribe to our marketing newsletter, or reach out to our customer support team, we collect the information you voluntarily provide to us, including your review content, feedback on our products (such as our minimalist canvas tote bags, casual hats, and anti-theft waist bags), the content of your support inquiries, and any additional details you choose to share with us.

4. Legal Bases for Data Processing

All processing activities of your personal data strictly adhere to the legal requirements set out in GDPR, and we only process your information on one or more of the following lawful bases:

  1. ‌Performance of a contract‌: Most transaction-related data processing is carried out for the purpose of fulfilling the purchase contract you enter into with us when you place an order on www.divinafashion2021.com, including processing your payment, arranging shipment of your ordered canvas bags, hats, waist bags or other merchandise, handling order updates, and providing after-sales services such as refund and returns support as outlined in our public Refund and Returns Policy.
  2. ‌Legitimate interests‌: We may process your non-sensitive technical usage data and aggregated anonymous analytics data for our legitimate business interests, such as optimizing our website user experience, improving our product offering based on user browsing trends, preventing fraudulent transaction activities, and ensuring the security of our e-commerce platform. We always balance these business interests against your privacy rights, and will never override your fundamental data protection rights without your explicit consent.
  3. ‌Explicit consent‌: Any processing of your personal data for marketing purposes, non-essential cookie tracking, personalized product recommendation activities, or any other processing that does not fall under contract performance or legitimate interests will only be conducted after you provide your clear, opt-in explicit consent. You retain the full right to withdraw your consent at any time, with no negative consequences to your ability to browse our website or make future purchases from our store.
  4. ‌Compliance with legal obligations‌: We may process your personal data when it is necessary for us to comply with our legal obligations under applicable EU and Spanish regulations, including tax reporting requirements, consumer protection law obligations, customs declaration requirements for cross-border shipments, and responding to valid, lawful requests from authorized public regulatory authorities.

5. Purposes of Data Processing

We only use your collected personal data for the specific, clearly stated purposes that we have disclosed to you, and will not further process your information in a manner that is incompatible with these original purposes. The primary processing purposes include:

  • To process, confirm, fulfill and track your orders, including sending you order confirmation emails, shipping status updates, delivery notifications, and coordinating with our logistics partners to ensure your purchased items (such as our minimalist reusable shopping canvas bags, UPF 50+ wide brim sun hats, or water-resistant hiking waist bags) are delivered to your designated address accurately and on time.
  • To provide you with reliable after-sales customer support, respond to your product inquiries, process your refund, return and exchange requests in line with our public Refund and Returns Policy, and resolve any issues you may encounter with your purchased products or your experience on our website.
  • To send you service-related non-marketing notifications, including critical website maintenance alerts, security updates, and announcements regarding changes to our terms of service, shipping policy or this Privacy Policy that may impact your rights or usage of our platform.
  • To improve our website functionality, product selection and overall user experience, by analyzing aggregated anonymous usage data to identify popular product categories, optimize our website navigation structure, fix technical bugs, and ensure our platform meets the accessibility requirements set out in the European Accessibility Act, complying with WCAG 2.1 Level AA standards to make our website accessible to all users including those with disabilities.
  • When you have explicitly opted in to receive our marketing communications, to send you occasional newsletters, new product launch updates, information about our clearance sales (including our ongoing 15% off promotion on all waist bags, simple canvas bags and hats for 2026), exclusive discount offers, and brand related content that aligns with our minimalist fashion brand positioning. We will never send you unsolicited marketing messages, and every marketing email we send will include a clear, easy to use unsubscribe link that allows you to opt out of all future marketing communications at any time.
  • To protect the security, integrity and legal compliance of our website and business operations, by detecting, preventing and investigating fraudulent transactions, unauthorized access attempts, cyber security incidents, and other illegal or harmful activities that may threaten the safety of our users or our business systems.
  • To comply with all applicable legal, regulatory, tax, accounting and audit requirements that apply to our operations as a Spain-based e-commerce brand selling across the European Union and European Economic Area.

6. Data Sharing and Disclosure of Your Personal Data

We will never sell, rent or trade your personal data to unrelated third parties for their own marketing purposes without your explicit prior written consent. We may only share your personal data with carefully selected third party service providers under strictly controlled conditions, when it is necessary to fulfill the purposes outlined in this policy, and all such third parties will be required to enter into a data processing agreement with us that enforces the same strict data protection standards as required by GDPR. The categories of trusted third parties we may share your data with include:

  • Authorized logistics and delivery partners: We share your shipping name, delivery address and contact phone number with our selected courier service providers, solely for the purpose of delivering your ordered products to you successfully. These logistics providers are only permitted to process your data for this specific delivery purpose, and are not allowed to use your information for any other unrelated activities.
  • PCI DSS compliant payment service providers: We share necessary payment related data with our certified payment processors to complete your transaction securely, all of these partners follow the strictest global payment security standards to protect your financial information.
  • Cloud service and website hosting providers: Our website and associated business systems are hosted on secure, EU-based cloud servers that meet all EU data residency requirements, ensuring your personal data is stored within the European Economic Area unless otherwise approved by relevant data protection authorities with appropriate safeguards in place.
  • Authorized regulatory bodies and law enforcement agencies: We may disclose your personal data when we are legally required to do so by a valid, lawful court order, official government request or regulatory investigation, or when such disclosure is necessary to protect our legal rights, the safety of our users, and to comply with our legal obligations under applicable EU and national laws.

All third parties we work with are thoroughly vetted for their data protection compliance records before we entrust them with any of your personal information, and we regularly audit their processing activities to ensure ongoing adherence to our data protection agreements and GDPR requirements.

7. Data Retention Periods

We will never retain your personal data for longer than is strictly necessary to fulfill the specific purposes for which the data was originally collected. Different categories of personal data are retained for different appropriate periods based on legal requirements and business needs:

  • Transaction and order related data is retained for a period of 10 years after your order is completed, to comply with Spanish national tax law requirements, commercial accounting rules, and applicable product warranty obligations.
  • Marketing consent records and associated contact information are retained for as long as you remain subscribed to our newsletter, or until you exercise your right to unsubscribe and request erasure of your marketing related data.
  • Website technical usage data and cookie related data is retained for a maximum period of 12 months, after which all this data is fully anonymized and can no longer be linked back to any individual user.
  • If you choose to delete your user account on our website, we will permanently erase all your personal account data within 30 days of receiving your account deletion request, except for the data we are legally required to retain for tax, accounting or ongoing legal dispute resolution purposes.

After the applicable data retention period expires, your personal data will be securely and permanently deleted or anonymized in a manner that prevents it from being ever associated back to you as an identifiable individual.

8. Your Rights as a Data Subject

Under the General Data Protection Regulation, you hold a comprehensive set of legally enforceable rights over your personal data that we process. You can exercise all of these rights free of charge by submitting a request to our Data Protection Officer via the contact channels listed earlier in this policy:

  1. ‌Right of access‌: You have the right to request a full copy of all personal data we hold about you, along with a clear explanation of how and why we process your information. We will provide you with the complete data in a commonly used machine-readable format within one month of receiving your verified request.
  2. ‌Right to rectification‌: If you find that any of the personal data we hold about you is inaccurate, outdated or incomplete, you have the right to request that we correct and update that information immediately. For example, if you change your email address, shipping address or contact phone number, you can modify these details directly in your user account settings on our website, or submit a request to our support team to assist you with the updates.
  3. ‌Right to erasure (Right to be forgotten)‌: You have the right to request that we permanently erase all your personal data from our systems, under circumstances including when the data is no longer necessary for the original purposes we collected it for, when you withdraw your consent to the processing, or when the processing is no longer compliant with GDPR requirements. We will honor your request for erasure as soon as possible, subject only to the limited exceptions where we are legally obligated to retain certain data to comply with our legal obligations.
  4. ‌Right to restriction of processing‌: You have the right to request that we temporarily suspend the processing of your personal data, under scenarios such as when you contest the accuracy of your data, when you believe our processing activities are unlawful, or when we no longer need the data but you require it to establish, exercise or defend legal claims.
  5. ‌Right to data portability‌: You have the right to receive all the personal data that you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another data controller without any obstruction from our side.
  6. ‌Right to object to processing‌: You have the full right to object at any time to our processing of your personal data that is based on our legitimate interests, including direct marketing activities. After you submit an objection to marketing processing, we will immediately stop sending you any marketing related communications.
  7. ‌Right to withdraw consent‌: For any processing activity that you previously provided explicit consent for, you have the right to withdraw that consent at any time, which will not affect the lawfulness of any processing activities that we have already carried out before your withdrawal.
  8. ‌Right to lodge a complaint‌: If you believe that our processing of your personal data violates GDPR or other applicable data protection regulations, you have the right to submit a formal complaint to the relevant supervisory data protection authority in your country of residence, or in our registered location in Spain.

We will process all valid data subject requests without unnecessary delay, and no later than one month from the date we receive your request. If we require additional information to verify your identity before fulfilling your request, we will contact you promptly to request the necessary verification details. We will never charge you any fee for exercising your data subject rights, unless your request is clearly manifestly excessive, repetitive or unfounded, in which case we may charge a reasonable administrative fee to cover our processing costs.

9. Data Security Measures

We implement strict, industry leading technical and organizational security measures to protect your personal data from unauthorized access, accidental loss, destruction, alteration or misuse. These measures include:

  • End-to-end 256-bit SSL encryption for all data transmission between your browser and our website servers, ensuring that all sensitive information including your payment details and personal contact data is fully encrypted during transfer.
  • Role-based strict access control mechanisms for all our internal staff, so that only authorized employees who require access to your personal data to perform their job duties (such as our order fulfillment team and customer support representatives) are granted permission to access your information, and all access activities are logged and regularly audited.
  • Regular periodic security vulnerability assessments, penetration testing, and comprehensive data security training for all our employees, to ensure all team members follow the highest data protection protocols in their daily work.
  • Offsite encrypted backup systems for all our business data, with regular backup testing to prevent data loss in the event of unforeseen technical incidents or system failures.
  • Full compliance with 2026 GDPR updated data breach notification requirements: in the unlikely event that a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and notify all affected data subjects directly without undue delay if the risk to users is particularly high.

While we work tirelessly to protect your personal data, no data transmission or storage system can ever be guaranteed to be 100% secure. If you have any reason to believe that your interaction with our website is no longer secure, please contact our support team immediately so that we can take urgent action to resolve any potential security issues.

10. Use of Cookies and Similar Tracking Technologies

Our website uses cookies to improve your browsing experience, as outlined briefly earlier in this policy. Cookies are small text files that are stored on your device when you visit a website. We categorize the cookies we use into two distinct groups:

  1. ‌Strictly necessary cookies‌: These cookies are absolutely essential for our website to function properly. They allow us to remember the items in your shopping basket, maintain your logged in session as you navigate between different pages of our site, and ensure that the checkout process operates correctly. You cannot turn off these strictly necessary cookies via our cookie consent banner, as the website will not be able to work properly without them. You can adjust your browser settings to block these cookies, but doing so will break important functionality of our store, and you may not be able to place orders on our platform.
  2. ‌Non-essential cookies‌: These include analytics cookies that help us understand how visitors use our website, and personalization cookies that allow us to show you product recommendations that may be of interest to you. We will only activate these non-essential cookies after you give your explicit opt-in consent. Under the 2026 updated EU cookie rules, we have implemented the “one-click consent” mechanism as required, and you can modify or withdraw your cookie consent settings at any time by clicking on the cookie preference link available at the bottom of every page on our website.

11. Transparency Requirements for AI Systems

In full compliance with the EU AI Act that came into applicable force on August 2, 2026, if we deploy any AI-powered customer service chatbot, AI product recommendation tool, or other artificial intelligence system that directly interacts with human users on our website in the future, we will provide clear, prominent, unambiguous disclosure at the very first moment of user interaction, to clearly inform users that they are communicating with an AI system. We will never use AI systems to process user personal data in a hidden, non-transparent way without full user awareness, and all our AI deployments will fully adhere to the risk-based requirements set out in the EU AI Act, to ensure that our use of AI respects all users’ privacy rights.

12. Cross-Border Data Transfers

As a brand based in Spain serving customers across the European Economic Area, all your personal data is primarily hosted and processed on servers located within the European Union. If in the rare circumstance that we ever need to transfer your personal data to a country or territory outside of the European Economic Area, we will ensure that appropriate, legally valid safeguards are in place to protect your data, in full alignment with GDPR cross-border transfer requirements. These safeguards may include using the official EU Standard Contractual Clauses approved by the European Commission, ensuring the third country has received an adequacy decision from the European Commission, or implementing other legally approved transfer mechanisms that guarantee your data receives the same level of protection it is entitled to under EU data protection law. You can request a copy of these cross-border transfer safeguards by contacting our Data Protection Officer at any time.

13. Protection of Minors

Our e-commerce website and products are designed and intended for use by adults aged 18 years or older. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have inadvertently collected personal information from a minor under the applicable minimum age, we will take immediate steps to permanently erase that information from all our servers and systems as quickly as possible. If you are a parent or guardian and believe that we may have collected personal data from your child, please contact us immediately so we can resolve this issue promptly.

14. Links to Third Party Websites

Our website may occasionally contain hyperlinks to external third party websites, such as links to our social media profiles, or references to trusted partner platforms. Please note that once you click on an external link and leave our website, we do not have any control over the content, operations, or privacy policies of those third party sites. We are not responsible for the privacy practices or data processing activities of any external third party websites. We strongly recommend that you review the privacy policy of every website you visit after leaving www.divinafashion2021.com, to ensure that you understand how that platform will process your personal data.

15. Updates to this Privacy Policy

We may occasionally revise and update this Privacy Policy from time to time, to reflect changes to our business operations, new regulatory requirements, or updates to applicable EU data protection laws such as the 2026 revisions to GDPR and new e-commerce compliance regulations. When we make material changes to this policy, we will prominently display a notification on the homepage of our website, send you a direct email notification if we have your contact information, and update the “Effective Date” listed at the top of this document to reflect the date the new revised policy goes into force. Any updated version of this Privacy Policy will take effect 14 days after it is first published on our website. Your continued use of our website after the effective date of the revised policy will be considered as your acceptance of the updated terms. We encourage you to revisit this page periodically to stay informed about how we are protecting your personal information.

16. Contact Information

If you have any questions, comments, concerns, or formal requests regarding this Privacy Policy, our data processing practices, or to exercise any of your data subject rights under GDPR, you can contact us at any time using the following details:

  • Attention: Data Protection Officer, DIVINA FASHION 2021 SEVILLA, S.L.
  • Physical address: Calle Artesa 12, Polígono Industrial Aeropuerto, 41020 Sevilla, Spain
  • Email address: [email protected]
  • Telephone number: +34 913 687 857

We will make all reasonable efforts to respond to your inquiry and resolve any issues you may have within a maximum of 30 days from the date we receive your communication.