Privacy Policy
Privacy Policy
Last updated: 11/08/2026
At Why27?, your privacy matters. We're a small creative studio, and we treat your personal information the way we'd want ours treated. This policy explains what we collect, why, and what you can do about it.
Who we are
The data controller for this website is:
- Alejandra Lloret Falciatore
- Tax ID: ESY5494148Z
- Address: C/ Sugranyes 2. 5-1 08028 Barcelona
- Email: hello@why27lab.com
- Website: www.why27studio.com
What we collect
When you browse
- IP address
- Device and browser type
- Pages viewed and time spent
- The site or link that brought you here
- Approximate location, based on IP
When you order
- Name and email address
- Billing and shipping address
- Phone number, where the carrier requires it
- Payment details, processed directly by our payment providers — we never see or store your full card number
When you subscribe
- Email address, and your consent to receive marketing
Why we collect it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Process and ship your order | To deliver what you bought | Performance of a contract |
| Send order confirmations and shipping updates | To keep you informed | Performance of a contract |
| Keep invoices and accounting records | Tax and commercial law | Legal obligation |
| Prevent fraud and secure our store | To protect you and us | Legitimate interest |
| Answer your emails and support requests | To help you | Legitimate interest |
| Analyse how the site is used | To improve it | Consent, via our cookie banner |
| Send marketing emails | To share new work and offers | Consent, which you can withdraw anytime |
Who we share it with
We work with a small number of trusted providers who process data on our behalf:
- Shopify — hosts our store and processes orders
- Payment providers — Shopify Payments
- Gelato — prints and ships your posters
Some of these providers are based outside the European Economic Area. Where that happens, transfers are protected by the safeguards required under EU law, such as Standard Contractual Clauses or an adequacy decision.
We never sell or rent your personal data.
How long we keep it
- Order and invoice records: for as long as tax and commercial law requires
- Customer account data: until you ask us to delete it
- Newsletter data: until you unsubscribe
- Analytics data: as set by the retention period of the tools we use
Your rights
You have the right to:
- Access the personal data we hold about you
- Correct anything that's wrong
- Ask us to delete it, where no legal obligation requires us to keep it
- Object to or restrict certain processing
- Receive your data in a portable format
- Withdraw consent at any time, without affecting anything done before
- Unsubscribe from our emails using the link in any of them
To exercise any of these, email hello@why7lab.com We'll reply within one month.
If you're not happy with how we've handled your request, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the supervisory authority in your own country.
Cookies
We use cookies to run the store, remember your cart, and — with your permission — to understand how the site is used. When you first visit, our cookie banner lets you accept, decline or choose which categories to allow. You can change your mind at any time through the banner or your browser settings.
Children
Our posters are made for children, but our store is meant for adults. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us their data, email us and we'll delete it.
Changes to this policy
We may update this policy from time to time. The date at the top always shows the current version, and we'll flag anything significant.
Questions
If anything here is unclear, or you want to know exactly what we hold about you, just ask. We're a small team and a real person will answer.