Last updated: 4 November 2026
This policy explains how AURORAZUX, S.L.U. uses your personal data when you visit Sheerwell (sheerwell.com), place an order or contact us. It is available in English and Spanish.
Basic information on data protection
| Topic | Basic information |
|---|---|
| Controller | AURORAZUX, S.L.U. (NIF B22541650), which runs Sheerwell. Contact: hello@sheerwell.com |
| Purposes | Handling your orders, deliveries, returns, withdrawals, guarantee claims, questions and complaints; meeting our accounting and tax duties; preventing fraud; optional cookies if you accept them |
| Legal bases | Performance of the contract, legal obligations, our legitimate interest in preventing fraud and defending legal claims, and your consent for optional cookies |
| Recipients | Our hosting provider (Tencent Cloud, with our server in Singapore), our payment provider SumUp, Packlink and the carriers, our email provider, our professional advisers, and authorities when the law requires it. We do not sell your data |
| International transfers | Our server is in Singapore, outside the European Economic Area (EEA). This transfer is protected by the standard contractual clauses adopted by the European Commission. SumUp and Packlink may transfer data outside the EEA under the safeguards described in their privacy notices. See section 6. Cloudflare, which forwards emails sent to our store address, may also process data outside the EEA. |
| Your rights | Access, rectification, erasure, restriction, objection, portability and withdrawal of consent (GDPR arts. 15 to 22). Write to hello@sheerwell.com |
| Complaints | You can complain to the Spanish Data Protection Agency (AEPD) through its e-office |
| More information | In the sections below |
1. Who is responsible for your data
The controller of your personal data is:
- Company: AURORAZUX, S.L.U.
- NIF: B22541650
- Registered office: Paseo Marqueses de Linares, 1, 10º D, 23700 Linares (Jaén), Spain
- Email: hello@sheerwell.com
More company details are in our legal notice.
We have not appointed a data protection officer.
2. What data we use
- Identity and contact data: name, email address and phone number.
- Address data: delivery address and billing address.
- Order data: products, prices, order number, delivery, return and refund details, and invoices.
- Payment data: the payment method, payment status and transaction references that SumUp sends us. You enter your card details on SumUp’s payment page, so they do not pass through our servers and we do not store your card number.
- Communications: your messages, complaints (with their reference numbers), withdrawal statements (with the date and time you sent them), guarantee claims and our replies.
- Technical data: IP address, browser and device information, and data collected through cookies. See our cookie policy.
We do not ask for sensitive data, such as health data. Please do not include it in your messages.
Where the data comes from. Most data comes directly from you. We also receive payment status from SumUp and delivery status from Packlink and the carrier.
Do you have to give us your data? The data marked as required at checkout is needed to conclude and carry out the contract. Without it, we cannot accept or ship your order. Other data is optional.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|
| Orders: taking, confirming, preparing and delivering your order, sending order and delivery emails, and handling payments and refunds | Performance of the contract (art. 6(1)(b)) |
| Customer service: answering your questions before and after you buy | Steps you ask us to take before a contract, and performance of the contract (art. 6(1)(b)) |
| Complaints: recording your complaint, giving you a reference number and a written acknowledgement, and answering within 15 calendar days at the latest | Legal obligation under Spanish consumer law, TRLGDCU art. 21 (art. 6(1)(c)) |
| Withdrawal and legal guarantee: handling withdrawals, returns, refunds, repairs and replacements | Legal obligations under consumer law (art. 6(1)(c)) and performance of the contract (art. 6(1)(b)) |
| Accounting and tax: invoices, accounting records and tax returns | Legal obligations under the Spanish Commercial Code (Código de Comercio), the General Tax Law (Ley 58/2003) and Royal Decree 1619/2012 on invoicing (art. 6(1)(c)) |
| Fraud prevention and payment security: checking orders and payments for signs of fraud and keeping the store secure | Our legitimate interest in protecting our customers and our business against fraudulent orders and unauthorised payments (art. 6(1)(f)) |
| Legal claims: keeping the records we need to make or defend legal claims | Our legitimate interest in defending our rights (art. 6(1)(f)) |
| Optional cookies: analytics and marketing cookies | Your consent (art. 6(1)(a); Spanish e-commerce law LSSI, Ley 34/2002, art. 22.2). Necessary cookies do not need consent |
| Marketing emails | See section 4 |
We do not use customer-service contacts to promote our products. You can object at any time to processing based on our legitimate interest (see section 8).
4. Marketing emails
We do not send marketing emails or newsletters. We only email you about your orders and your requests.
5. Who receives your data
We share your data only as far as each purpose needs.
Hosting provider. Our store runs on WordPress and WooCommerce, which we install on a cloud server that we rent from Tencent Cloud (Tencent Cloud Lighthouse). Our server is in Tencent Cloud’s Singapore region. Under Tencent Cloud’s terms of service, the Tencent company we contract with is Tencent Cloud Europe B.V. (Buitenveldertselaan 1-5, 1082 VA Amsterdam, the Netherlands). Tencent Cloud stores and processes your data when you visit and buy from our store, and acts as our processor under its Data Processing and Security Agreement.
SumUp (payments). Card payments are processed by SumUp Limited, a company with limited liability incorporated in Ireland (registered number 505893, registered office Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland D02 K580). SumUp Limited is an authorised electronic money institution (licence no. C195030) regulated by the Central Bank of Ireland.
When you press “Order with obligation to pay”, we send SumUp the data it needs to start the payment, such as the order number and the amount, and you are taken to SumUp’s payment page. There you enter your card details directly with SumUp. SumUp tells us whether the payment was completed and gives us a transaction reference.
SumUp states in its privacy notice that it is the data controller for the payment-related personal data it processes when a customer pays a merchant that uses SumUp, such as us. SumUp’s own privacy notice applies to that processing.
Packlink and carriers. We book deliveries, and any return collections we arrange, through Packlink, a shipping platform run by Auctane, S.L.U. (Paseo Imperial 14, 28005 Madrid, Spain), which passes your parcel details to the carrier that delivers it: SEUR or Correos. They receive the data needed for delivery: your name, delivery address, phone number and email address. Packlink’s privacy policy explains how it uses this data.
Email and plugins. Our email providers (for the store mailbox and for sending order emails) and the provider of any plugin we add that sends data to an outside service process data on our behalf. Apart from the SumUp and Packlink plugins described above, no plugin installed on our store sends your data to an outside service. Emails you send to our store address are forwarded to our mailbox by Cloudflare, Inc. (Cloudflare Email Routing), and our order emails are sent through Tencent Cloud’s email service.
Professional advisers. Our accountants, tax advisers and lawyers, who must keep the data confidential.
Authorities and courts. For example the Spanish Tax Agency, courts and consumer authorities, when the law requires it.
Dispute resolution bodies. A consumer arbitration or dispute resolution body, if a dispute is taken to one.
We do not sell your personal data.
6. International transfers
Our hosting provider, Tencent Cloud, stores your data on our server in its Singapore region, outside the European Economic Area (EEA). The European Commission has not adopted an adequacy decision for Singapore, so this transfer is protected by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), which form part of Tencent Cloud’s Data Processing and Security Agreement.
SumUp’s privacy notice says that:
- for its European business, SumUp stores personal data within the European Economic Area (EEA);
- it may transfer information to members of its group of companies, to parties who are part of the payment transactions process and to third parties acting on its behalf that may be in countries outside the EEA or the United Kingdom;
- these other countries may not offer the same level of protection, although SumUp continues to collect, store and use the information in accordance with its privacy notice and the applicable data protection legislation;
- SumUp shares data only with organisations that satisfy an adequate level of data protection in line with applicable data protection legislation, and with which satisfactory contractual agreements are in place.
More information: SumUp privacy notice.
Packlink says in its privacy policy that it stores and processes information within the EU wherever possible and that, where this is not possible, it transfers it under the EU standard contractual clauses or under one of the exceptions in article 49 of the GDPR.
You can ask us for more information about these transfers, or for a copy of the safeguards that apply to transfers by our own providers, at hello@sheerwell.com.
Cloudflare, which forwards emails sent to our store address, may process them outside the EEA, including in the United States, under the standard contractual clauses in its data processing addendum. Our order emails are sent through Tencent Cloud’s email service under the same Tencent Cloud agreement as our server. We do not transfer your data outside the EEA in any other way.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| Orders, invoices, accounting records and business correspondence about your orders, including complaints, withdrawals and guarantee claims | 6 years from the last entry in our accounting books (Código de Comercio art. 30) |
| Data we need for tax purposes | At least 4 years, the limitation period of Spanish tax law (Ley 58/2003 arts. 66 and 70; Royal Decree 1619/2012 art. 19 for invoices), and up to 10 years where we must justify tax losses or deductions (Ley 58/2003 art. 66 bis) |
| Questions not linked to an order | 12 months after our last reply |
| Cookie data | As shown in our cookie policy. We keep your cookie choice for 365 days and never longer than 24 months |
| Marketing emails (only if we send them) | Until you unsubscribe or withdraw your consent |
When a period ends, we delete or anonymise the data. If a legal claim or an official investigation is pending, we keep the data it needs until it is closed.
8. Your rights
You have the right to:
- access your data and receive a copy;
- rectify data that is wrong or incomplete;
- erase your data, except data we must keep by law (section 7);
- restrict processing in certain cases;
- object to processing based on our legitimate interest;
- portability: receive the data you gave us in a structured, commonly used format, or have it sent to another company;
- withdraw your consent at any time. This does not affect processing carried out before you withdrew it.
How to exercise your rights. Email hello@sheerwell.com or write to our registered office (section 1), saying which right you want to exercise. If we cannot confirm your identity from your request, we may ask you for more information. We reply without undue delay and at the latest within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, we may extend this period by two further months; if so, we tell you within the first month and explain why. Exercising your rights is free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee based on our administrative costs or refuse to act on it (GDPR art. 12(3) and 12(5)).
Complaints. If you think we have not respected your rights, you can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es, online through its e-office. You can also complain to the data protection authority of the EU country where you live or work, or where you think the infringement took place. You can contact us first if you wish, but you do not have to.
9. Minors
We sell only to adults. You must be 18 or over to place an order.
Under Spanish data protection law (LOPDGDD art. 7), people aged 14 or over can give their own consent where processing is based on consent, such as optional cookies. For children under 14, the consent must be given by a parent or guardian.
10. Security
We protect your data with technical and organisational measures suited to the risk. Only people who need the data for their work can access it. Our processors must protect the data under their contracts with us. Our security policy explains how payments are protected and what we do if a personal data breach occurs.
11. Automated decisions and profiling
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects for you. We do not build marketing profiles. SumUp may carry out its own fraud checks under its own privacy notice (section 5).
12. Cookies
Necessary cookies make the store work. We use analytics and marketing cookies only if you accept them. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. Read more in our cookie policy.
13. Changes to this policy
We may update this policy, for example when we add a payment method, a delivery partner or a plugin. We publish each new version on this page with its date. If a change affects how we use data you have already given us, we will tell you before it applies, and we will ask for your consent where the law requires it. You can ask us for an earlier version.
Questions? Contact us or email hello@sheerwell.com.