Privacy policy
Last updated: September 30, 2026
This Privacy Policy describes how ISLA, operated by PAULA STÖLT (“ISLA”, “we”, “us” or “our”), collects, uses, stores and discloses your personal information when you visit, use or make a purchase from islaisla.com (the “Site”), communicate with us, or otherwise use our products and services (collectively, the “Services”).
Our online store is powered by Shopify, which provides the ecommerce platform that enables us to offer our products and Services to you.
Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood how we collect and process your personal information as described below.
1. Who We Are
For the purposes of applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (“LOPDGDD”), the data controller is:
PAULA STÖLT
Trading as: ISLA
NIF/NIE: [ADD NIF/NIE]
Business address: Calle Río Guadiana 52, 07817 Sant Jordi de ses Salines, Balearic Islands, Spain
Email: hola@islaisla.com2. Personal Information We Collect
The personal information we collect depends on how you interact with the Site and the Services.
We may collect the following categories of personal information:
Contact information, such as your name, email address, telephone number, billing address and shipping address.
Order and transaction information, including products purchased, order history, returns, exchanges, refunds, payment status and shipping information.
Payment information, such as payment method, transaction details and payment confirmation. Full payment card information is generally processed directly by Shopify and/or the relevant payment provider and is not stored directly by ISLA.
Account information, if you choose to create a customer account, including your login details, preferences and account settings.
Communications, including information you provide when contacting us by email, contact form, social media or customer support channels.
Device and technical information, such as IP address, browser type, device type, network information and other technical identifiers.
Usage information, including information about how you browse and interact with our Site, products and Services.
Marketing preferences, including whether you have chosen to receive marketing communications from us.
Cookie and tracking information, where permitted by applicable law and according to the choices you make through our cookie consent tools.
We do not intentionally collect more personal information than is reasonably necessary for the purposes described in this Privacy Policy.
3. How We Collect Your Personal Information
We may collect personal information:
Directly from you, for example when you place an order, create an account, subscribe to our newsletter, contact us or otherwise provide information to us.
Automatically, when you visit or interact with the Site, including through cookies and similar technologies, subject to your consent where required.
From service providers, such as Shopify, payment providers, shipping and fulfilment providers, analytics providers and other companies that help us operate the Services.
From advertising, marketing or technology partners, where permitted by applicable law and subject to applicable consent requirements.
4. How We Use Your Personal Information and Our Legal Bases
We only process your personal information where we have a valid legal basis to do so.
Providing and fulfilling your order
We use your information to:
process and confirm orders;
process payments;
arrange shipping and delivery;
manage returns, exchanges and refunds;
communicate with you about your order; and
provide customer service.
Legal basis: processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.
Managing customer accounts and preferences
If you create an account, we may use your personal information to create and maintain it, remember your preferences and provide account-related functionality.
Legal basis: performance of our contract with you and, where applicable, our legitimate interest in providing and improving the Services.
Customer service and communications
We may process your information when responding to questions, enquiries, complaints or other communications.
Legal basis: performance of our contract with you where the communication relates to an order or purchase, and our legitimate interest in providing customer service and maintaining our relationship with customers.
Security and fraud prevention
We may process personal information to detect, investigate and prevent fraud, misuse, security incidents, illegal activity or other harmful activity and to protect our Site, customers and business.
Legal basis: our legitimate interests in protecting our business, our customers and the security of the Services, and compliance with legal obligations where applicable.
Legal and regulatory obligations
We may use and retain personal information where necessary to comply with accounting, tax, consumer protection, regulatory, judicial or other legal requirements.
Legal basis: compliance with a legal obligation.
Marketing communications
If you subscribe to our newsletter or otherwise choose to receive marketing communications from ISLA, we may use your email address and related information to send you news, launches, product information, events and promotional communications.
Legal basis: your consent, or another legal basis permitted under applicable law.
You can unsubscribe at any time by using the unsubscribe link included in our marketing emails or by contacting us at hola@islaisla.com.
Withdrawing your consent will not affect the lawfulness of processing carried out before the withdrawal.
Analytics, personalisation and advertising
We may use information about how visitors interact with our Site to understand how the Services are used, improve our website and products, measure performance and, where applicable, personalise marketing or advertising.
Where these activities involve non-essential cookies, advertising technologies or similar tracking technologies, we will request your consent where required by law.
Legal basis: your consent where legally required and, for certain limited analytics or business improvement activities, our legitimate interests where applicable.
5. Cookies and Similar Technologies
Our Site uses cookies and similar technologies to operate the website, remember preferences, understand how visitors use the Site and, where you consent, provide analytics, personalisation and advertising.
Some cookies are strictly necessary for the Site to function and do not require consent. Other cookies, including certain analytics, advertising and personalisation cookies, will only be used where you have provided consent when required by applicable law.
You can manage or withdraw your cookie preferences at any time through the privacy or cookie settings available on our Site.
Disabling certain cookies may affect how some parts of the Site function.
6. How We Share Personal Information
We may share personal information where reasonably necessary to operate our business and provide the Services.
This may include sharing information with:
Shopify, which hosts and powers our ecommerce store.
Payment providers, for the secure processing of payments and refunds.
Shipping, fulfilment and logistics providers, in order to deliver your purchases.
Technology and IT service providers, including hosting, security and infrastructure providers.
Analytics providers, where permitted by law and subject to applicable consent requirements.
Marketing and advertising providers, where you have provided consent or another valid legal basis applies.
Professional advisers, such as accountants, lawyers, insurers or consultants where reasonably necessary.
Public authorities, courts or regulators, where disclosure is required by law.
Potential purchasers, investors or advisers, in connection with a merger, acquisition, restructuring, sale of assets or similar business transaction.
We do not disclose personal information to third parties for purposes unrelated to those described in this Privacy Policy unless you request or consent to such disclosure or we are legally required to do so.
7. Shopify
Our online store is hosted by Shopify.
Shopify collects and processes certain personal information in order to provide its ecommerce technology and related services to us and to you.
Information you provide through the Site may therefore be transmitted to and processed by Shopify and its authorised service providers, including in countries outside your country of residence.
Depending on the Shopify services and features enabled on our store, Shopify may also process information for its own purposes as described in Shopify's Consumer Privacy Policy.
Where Shopify features involving personalised advertising, cross-site data or similar non-essential processing require consent under applicable law, such processing will be subject to your privacy and cookie choices.
Depending on your jurisdiction, you may also have privacy choices directly through Shopify's Privacy Portal.
8. International Transfers
Some of our service providers, including Shopify and other technology providers, may process personal information outside Spain or the European Economic Area (“EEA”).
Where personal information is transferred outside the EEA to a country that has not been recognised as providing an adequate level of protection, we will rely on appropriate safeguards as required by applicable law.
These safeguards may include European Commission Standard Contractual Clauses or other legally recognised transfer mechanisms.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to fulfil contractual, accounting, tax, legal and regulatory obligations.
Retention periods may vary depending on the type of information and the reason it is processed.
In general:
information relating to purchases and invoices may be retained for the periods required under applicable tax, accounting and commercial laws;
customer account information may be retained while the account remains active and for an appropriate period afterwards;
customer service communications may be retained for as long as reasonably necessary to resolve the enquiry and protect our legal interests;
marketing information may be retained until you unsubscribe, withdraw your consent or otherwise object to the processing, unless retention is required for another lawful reason; and
information required to establish, exercise or defend legal claims may be retained for the applicable limitation period.
Once personal information is no longer required, we will delete, anonymise or otherwise securely dispose of it where appropriate.
10. Security
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
You should avoid sending sensitive or confidential information through insecure communication channels.
11. Your Privacy Rights
If you are located in the European Economic Area, you may have the following rights under applicable data protection law:
Right of access: to request information about the personal data we process about you and receive a copy of it.
Right to rectification: to request correction of inaccurate or incomplete information.
Right to erasure: to request deletion of your personal information in certain circumstances.
Right to restriction: to request that we restrict the processing of your personal information in certain circumstances.
Right to object: to object to certain processing based on legitimate interests and to object at any time to direct marketing.
Right to data portability: to receive certain personal information in a structured, commonly used and machine-readable format and, where technically feasible, request its transmission to another controller.
Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint: you have the right to lodge a complaint with the competent data protection authority.
If you are located in Spain, the competent supervisory authority is the Agencia Española de Protección de Datos (AEPD).
To exercise any of your rights, please contact us at:
We may need to request information reasonably necessary to verify your identity before responding to your request.
We will respond within the time periods required by applicable law.
Depending on where you live, you may also have additional privacy rights under local laws.
12. Targeted Advertising and Data Sharing Choices
Depending on your location and the technologies enabled on our Site, you may have the right to opt out of certain uses of personal information for targeted advertising or certain forms of data sharing.
Where available, you can exercise these choices through our cookie and privacy settings or through our Data Sharing Opt-Out page.
If your browser sends a legally recognised privacy preference signal, such as Global Privacy Control (“GPC”), we will process that signal where required by applicable law and where supported by the technology used on our Site.
13. Third-Party Websites and Services
Our Site may contain links to websites, social media platforms or other services operated by third parties.
We are not responsible for the privacy, security or content of third-party websites or services.
If you access a third-party website through a link on our Site, we recommend reviewing that third party's privacy policy before providing personal information.
14. Children's Privacy
Our Services are not directed to children, and we do not knowingly collect personal information from children who are not legally able to provide valid consent under applicable law.
If you are a parent or legal guardian and believe that a child has provided us with personal information improperly, please contact us at hola@islaisla.com so that we can take appropriate action.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, the Services, technology or applicable legal and regulatory requirements.
When we make changes, we will update the “Last updated” date at the top of this Privacy Policy and provide any additional notice required by applicable law.
16. Contact
If you have any questions about this Privacy Policy, how we process your personal information, or if you wish to exercise your privacy rights, please contact:
PAULA STÖLT
Trading as ISLA
Calle Río Guadiana 52
07817 Sant Jordi de ses Salines
Balearic Islands, SpainEmail: hola@islaisla.com