Privacy policy
Last updated: 10 October 2026
Who handles your data
The data controller is Bagalux Marbella S.L. (trading as BAG À LUX), tax ID B56952047, registered at Avenida de la Marina, Local 7A, 11310 Puerto de Sotogrande, Cádiz (Spain). Email: info@bagaluxboutique.com. Phone: +34 659 565 011.
What we collect, and when
Apart from the security log described below, we only handle personal data in three situations, and in all three you make the first move:
- If you fill in the sell or consign form: your name, your phone number, your email address and whatever you tell us about the piece in your message.
- If you tap a WhatsApp button: we keep a record of the page you wrote from, the piece you were looking at and, if you arrived from an advert, which campaign brought you. That record carries neither your name nor your number: it tells us which pieces draw interest.
- If you write to us by WhatsApp or email, or call: whatever you choose to tell us in that conversation.
What we do not do
If you agree, we use Google Analytics (Google Ireland Ltd.) to learn which pages and which pieces draw interest, which countries you visit from and how you reach us, and Google Ads to measure and personalise advertising. If you do not, Google only receives cookieless signals that do not identify you. We neither sell nor share your data with anyone for commercial purposes, and we make no automated decisions about you.
Google cookies (_ga and _ga_* for analytics, for up to two years; _gcl_* for advertising, for up to 90 days) are only set if you accept them in the cookie notice, and are deleted if you withdraw your consent. You can change your choice at any time with «Cookie preferences» at the foot of every page, or . Beyond that, the site stores in your browser your cookie choice, whether you have already seen the opening animation and, only if you accepted advertising, which campaign you arrived from, held in session storage (it clears when you close the tab).
Security log
For security, every time a page of this site is opened our server records the date and time, the page, the IP address you connect from, the approximate location derived from it (country, region, city, postcode and time zone), the technical data your browser sends with every request (among them the browser, operating system and device model it reports, and its language), the page you came from and, if you accepted analytics cookies, the identifier of the Google Analytics cookie. It also records when you tap a WhatsApp, phone or email button, or send the consignment form. It does not include your name or your phone number.
If you accept analytics cookies, your browser also sends us some technical data about your device: its time zone and configured languages, the size and density of the screen, the number of processors, the approximate memory and the connection type. Never your exact location or any other fingerprint of your device.
We use it only to protect the boutique, its customers and this site against fraud, theft and other criminal use, and to hand it to the authorities if they require it. Never for advertising. It is deleted automatically after ninety days, except for whatever must be kept because of a specific incident or at the request of the authorities.
Why, and on what legal basis
- To answer your enquiry and value your piece: performance of a contract or of pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
- To protect the boutique, its customers and this site against fraud and crime, through the security log: our legitimate interest (Article 6(1)(f) GDPR).
- To learn which pieces draw interest and which campaigns work: our legitimate interest in understanding how the site is used (Article 6(1)(f)), using data that does not identify you.
- To meet our tax and accounting obligations when a purchase is involved: legal obligation (Article 6(1)(c)).
- Analytics and advertising cookies: your consent (Article 6(1)(a) GDPR and Article 22.2 of the Spanish LSSI), which you can withdraw at any time.
How long we keep it
Enquiries that do not lead to a transaction are kept for one year. Where there is a purchase, sale or consignment, the data attached to it is kept for as long as Spanish tax and commercial law requires. Records of site use are kept for twenty-four months, and the security log for ninety days.
Who else sees it
Nobody for their own purposes. We rely on two providers who act as data processors on our behalf:
- Supabase, which hosts the database where enquiries are stored. Its servers are in the European Union (Frankfurt).
- Netlif and , which hosts and serves this website.
If you write to us on WhatsApp, that conversation takes place on a Meta Platforms service, under its own terms and its own privacy policy. If you would rather not use it, email us or call instead.
The boutique page carries a map embedded from Google Maps so you can find the shop: when you open that page your browser contacts Google, which applies its own terms and its own privacy policy. No other page on the site carries it.
Your rights
You can ask us at any time to give you access to your data, correct it, delete it, restrict how we use it, object to our using it, or hand it over to someone else. Just write to info@bagaluxboutique.com saying what you want. We will reply within one month.
If you believe we have not dealt with your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es), which is the competent supervisory authority.
Children
This site is not aimed at children under fourteen and we do not knowingly collect their data.
Anything here you would like explained? Email us at info@bagaluxboutique.com or call +34 659 565 011. You are also welcome at the boutique, Avenida de la Marina, Local 7A, Puerto de Sotogrande.
