In accordance with Regulation (EU) 2016/679 (GDPR) and, for UK visitors, the UK GDPR, this Privacy Policy explains what personal data GENESIS LAB, S.L. (“Shell Diamonds”, “we”, “us” or “our”) collects through shelldiamonds.com, why we collect it, the legal basis on which we process it, how long we keep it, who we share it with — including the international transfer required to manufacture and ship your order from China — and the rights you have.
1. Data controller
The data controller responsible for your personal data is:
- Controller GENESIS LAB, S.L., N.I.F. B24953887
- Address C/ Pompeu Fabra 2, bajos, 07004 Palma de Mallorca (Illes Balears), Spain
- Email info@shelldiamonds.com
GENESIS LAB, S.L. is not required to appoint a Data Protection Officer under Article 37 GDPR and has not appointed one. Any data-protection enquiry can be sent to the email address above.
2. Purposes, data processed and legal bases
| Purpose | Data processed | Legal basis |
|---|---|---|
| Order management, dispatch, tracking and returns | Name and surname, delivery address, postcode, city, country, email address, telephone number, order reference and contents | Performance of the contract of sale |
| Invoicing and compliance with accounting, tax and customs obligations | Identification data and, where applicable, tax data of the business customer; description and value of the item | Compliance with legal obligations |
| Payment processing and fraud prevention | Identification data, transaction data and technical device data | Performance of the contract and legitimate interest in preventing fraudulent transactions |
| Creditworthiness assessment where a deferred payment method is selected | Identification data and creditworthiness data processed by the payment provider | Performance of the contract and consent of the data subject |
| Handling of enquiries and complaints | Identification, contact and communication data | Consent or legitimate interest in responding to the request |
| Registration and management of business (B2B) customers | Identification and tax data of the company and of the contact person | Performance of the contract or pre-contractual measures |
| Publication and verification of product reviews | Name or alias, content of the review and reference of the associated order | Consent of the data subject |
| Bringing, exercising and defending claims | Order, payment and correspondence data | Legitimate interest of the controller |
Where processing is based on legitimate interest, this has been weighed against your rights and freedoms, and you may object at any time through the channels indicated in section 7.
3. How long we keep your data
Data is retained for as long as the relationship with the customer is maintained and, thereafter, for the following periods:
- Order, invoicing and payment data — six years from the last entry, in accordance with Article 30 of the Spanish Commercial Code, and four years for tax limitation purposes, whichever is longer.
- Data necessary to handle the right of withdrawal and the legal guarantee of conformity — for the three-year guarantee period and until the action lapses, five years after the lack of conformity becomes apparent.
- Enquiries and complaints that do not result in an order — one year from the last communication.
- Cookie consent records — twenty-four months.
- Newsletter subscription data — until you withdraw consent or unsubscribe.
Data provided for dispatch and returns is limited to what is strictly necessary and is retained only for as long as the withdrawal and guarantee periods remain in force, after which it is deleted.
4. Who we share your data with
To provide the service, your data may be disclosed to the following categories of recipients:
- The manufacturer-shipper of the items, located in the People’s Republic of China, which acts as data processor and receives only the data strictly necessary to manufacture, dispatch and deliver your order (see section 5).
- Providers of purchasing coordination and operational shipment-tracking services, established in Spain, which act as data processors on our behalf.
- International carriers (FedEx, UPS or DHL), which act as independent controllers for their own purposes under their respective privacy policies.
- Payment service providers: Redsys and Banco Santander / Getnet for card payments, and PayPal and Klarna where you select these methods. They act as independent controllers for the processing inherent to their services.
- Our hosting provider, Hostinger International Ltd. (servers in the European Union, Paris, France), and our site development and maintenance provider, both acting as data processors.
- Digital analytics and advertising providers (Google), only with your prior consent.
- If you contact us via WhatsApp, WhatsApp/Meta will process your data under its own terms and privacy policy, which may involve international transfers based on legally provided mechanisms.
- Our advisers, auditors and lawyers, where necessary to comply with legal obligations or to defend claims.
We do not disclose data to other third parties except where required by law or by a competent authority.
5. International transfers
To manufacture, dispatch and, where applicable, process the return of your order, GENESIS LAB, S.L. discloses the data below to our manufacturer located in the People’s Republic of China, a country for which the European Commission has not issued an adequacy decision. This international transfer is based on Article 49(1)(b) GDPR, as it is necessary for the performance of the contract concluded with you at your request.
Operational tracking of shipments is carried out by a service provider established in Spain, acting as data processor on our behalf.
The data disclosed to the manufacturer is limited to what is strictly necessary for delivery: name and surname, full address including postcode, city and country, telephone number, email address, order reference, and the description and value of the item for customs documentation purposes. No payment data or purchase history is disclosed.
The use of Google tools may also involve transfers to the United States, based on legally provided mechanisms and subject to your prior consent.
6. Automated decisions
Where you select a deferred or financed payment method, the provider of that service may automatically assess your creditworthiness using information from credit reference agencies. If the result falls below the threshold set by the provider, that payment method will not be offered, without affecting your ability to complete the purchase by any other available means.
You have the right to obtain human intervention, to express your point of view and to contest the decision, by contacting the payment provider or, failing that, GENESIS LAB, S.L. at the address indicated in section 1.
7. Your rights
You may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent at any time without affecting the lawfulness of prior processing, by writing to info@shelldiamonds.com and proving your identity. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or, if you are in the UK, the Information Commissioner’s Office (ICO).
8. Security, session recording and minors
GENESIS LAB, S.L. applies appropriate technical and organisational measures to keep your data secure.
The Website may use session recording and replay tools to detect malfunctions and improve the shopping experience. These tools are only activated with your prior consent, which you can withdraw at any time from the cookie management panel, and they are configured so that information entered in forms — including your name, delivery address and card details — is masked and not recorded.
The Website is aimed exclusively at persons over 18 years of age; we do not knowingly collect data from minors.
Shell Diamonds is operated by GENESIS LAB, S.L., N.I.F. B24953887, C/ Pompeu Fabra 2, bajos, 07004 Palma de Mallorca (Illes Balears), Spain.