Privacy Policy

Last updated: 30 July 2026

This English version is provided for convenience. In case of any discrepancy, the Spanish version prevails.

At Lila Lavanda we handle your personal data with care and transparency. This policy explains what data we collect through www.lilalavanda.co, for what purposes, on what legal basis, and what rights you have.

1. Data protection at a glance

Controller: Conciencia Limpia S.L. ("Lila Lavanda"). NIF B75592238.
Purposes: To manage your pickup and delivery orders and your place on the Lavanda Club waiting list, to answer your enquiries and to measure how the website is used.
Legal basis: Performance of a contract or your consent, depending on the purpose.
Recipients: Technology providers (hosting, analytics, advertising, address autocomplete and web fonts) and our internal order-management system. Data may be transferred internationally (to the United States) subject to appropriate safeguards.
Rights: Access, rectification, erasure, objection, restriction, portability and withdrawal of consent, by writing to soporte@lilalavanda.co.
Further information: See the sections below.

2. Data controller

Owner: Conciencia Limpia S.L. ("Lila Lavanda").
Tax ID (NIF): B75592238.
Establishment: Calle Virgen del Sagrario 19, Local 2, 28027 La Concepción, Madrid.
Registered office: Calle Dr. Esquerdo 34, 6º A, 28028 Madrid.
Email: hola@lilalavanda.co.
Telephone / WhatsApp: +34 658 18 03 42.
Data protection contact: soporte@lilalavanda.co.

3. Data Protection Officer (DPO)

No Data Protection Officer has been appointed. For any matter relating to the processing of your personal data, you can write to soporte@lilalavanda.co.

4. What data we process, for what purposes and on what legal basis

4.1 Pickup and delivery orders

Data: name, telephone number and preferred contact method (WhatsApp or call); pickup address (street, number, flat (optional), postal code and city); pickup — and, where applicable, delivery — dates and time slots; the services selected and their quantities; and any notes or referral code you add.
Purpose: to manage, prepare and carry out your pickup and delivery order.
Legal basis: performance of the service contract or, at your request, steps taken prior to entering into it (Art. 6(1)(b) of the GDPR — Regulation (EU) 2016/679).

So that you do not lose your progress while ordering, the details you enter in the order form — including your name, telephone number and address — are also saved in your browser's local storage (localStorage), on your own device, for the sole purpose of restoring the form if you come back to it. They stay on your device until you empty the cart or clear your browser data.

4.2 Address autocomplete

Data: the text you type into the address field and the address you select.
Purpose: to help you enter a valid pickup address.
How it works: while this feature is active, what you type is sent directly from your browser to Google (Google Places) so it can offer you suggestions.
Legal basis: address suggestions are part of handling your order, so they rely on performance of the contract (Art. 6(1)(b) GDPR), with Google acting as the provider of the service. The transfer of this data to Google in the United States is covered by the EU-US Data Privacy Framework.

4.3 Lavanda Club waiting list

Data: name, telephone number with country code, address and number of people.
Purpose: to manage your place on the Lavanda Club waiting list and let you know when places become available.
Legal basis: your consent, given when you submit the sign-up form (Art. 6(1)(a) GDPR).

4.4 Customer service

Data: whatever information you provide when you contact us by WhatsApp or telephone.
Purpose: to deal with your enquiries and requests.
Legal basis: performance of the contract, or of pre-contractual steps, where your enquiry relates to an order (Art. 6(1)(b) GDPR); your consent in all other cases (Art. 6(1)(a) GDPR).

When you write to us on WhatsApp, your message travels through the WhatsApp application (Meta).

4.5 Analytics and advertising measurement

Data: technical and site-usage identifiers (for example, the identifiers in the _ga, _gcl_au, _fbp and _fbc cookies, your IP address and browser details), together with browsing and purchase events. We do not link your name, telephone number or address to these tools: measurement takes place without those identifying details.
Tools: Google Analytics 4, Google Tag Manager and Google Ads conversion measurement (Google), and Meta's pixel and Conversions API (Meta). These tools run both in your browser and on our server.
Purpose: to measure how the site is used, improve the service and assess how effective our advertising is.
Legal basis: your consent, which you manage through this website's own cookie notice (Art. 6(1)(a) GDPR). See the Cookie Policy for details.

Even if you decline analytics cookies, Google may receive anonymous, cookieless technical signals, which are used for aggregate traffic and conversion estimates (a standard practice adopted here).

4.6 Session recording and heatmaps

Data: browsing interactions (cursor movements, scrolling, clicks) and session recordings.
Tool: Microsoft Clarity (Microsoft).
Purpose: to analyse how the site is used, through heatmaps and session recordings, so we can improve it.
Legal basis: your consent, which you manage through this website's own cookie notice (Art. 6(1)(a) GDPR).

5. Whether providing your data is mandatory

The details marked as required in the order and Lavanda Club forms are essential for providing the service you request. You are under no legal obligation to provide them: the only consequence of not doing so is that we will not be able to process your order or your sign-up.

6. Recipients of the data

We do not sell your data. We share it only with the providers involved in delivering the service and running the website:

Internal order-management system (ops.lilalavanda.co), where order and waiting-list data are processed.
Website hosting provider (Vercel), which processes the technical data of each request (for example, the IP address) as part of the infrastructure.
Google, for analytics (Google Analytics 4 and Google Tag Manager), advertising conversion measurement (Google Ads) and address autocomplete (Google Places). For analytics (GA4), Google acts as a data processor on our behalf.
Meta, for advertising measurement (pixel and Conversions API) and for messaging when you contact us on WhatsApp. For the pixel and the Conversions API, we are joint controllers with Meta for the collection and transmission of the data; Meta is responsible for its own subsequent processing.
Microsoft (Microsoft Ireland Operations Limited and Microsoft Corporation), for session recording and heatmaps (Microsoft Clarity).
Web font provider (Adobe Typekit), which receives technical request data (IP address and browser) when the site's fonts load.

Some links on the site take you to external services (Google Maps, Instagram); your use of those services is governed by their own privacy policies.

7. International transfers

Some of our providers are based outside the European Economic Area, mainly in the United States, so your data may be transferred to that country.

Google, Meta and Microsoft rely on their certification under the EU-US Data Privacy Framework, the European Commission framework that recognises an adequate level of protection for transfers to US entities certified under it.
Vercel (hosting) and Adobe (Typekit / Adobe Fonts, web fonts) likewise rely on their certification under the EU-US Data Privacy Framework.

8. Retention periods

We keep your personal data for as long as necessary to fulfil the purpose for which it was collected. Once that purpose has been met, we keep the data blocked for the legally applicable limitation periods, so that we can meet any liabilities arising from the processing; once those periods have expired, we delete it.

As a guide, we apply the following periods by category:

Data category	Retention period
Orders, invoicing and records of the contractual relationship	For the duration of the service relationship and, afterwards, blocked for 6 years (Art. 30 of the Spanish Commercial Code) and, for tax purposes, 4 years (Arts. 66–70 of the Spanish General Tax Law)
Lavanda Club waiting list	Until you withdraw your consent or your request has been dealt with; afterwards, blocked for the applicable limitation periods
Customer service (WhatsApp / telephone)	While your enquiry is being handled and, where it relates to an order, for the same periods as the order data
Analytics and advertising measurement	For the lifetime of each cookie or identifier (see the Cookie Policy) and each tool's aggregate retention periods
Data saved in your browser (localStorage)	On your own device, until you empty the cart or clear your browser data

9. Your rights

You can exercise the following rights at any time, free of charge:

Access to your personal data.
Rectification of inaccurate data.
Erasure of your data.
Objection to the processing.
Restriction of the processing.
Portability of your data.
Withdrawal of the consent you have given, without affecting the lawfulness of any processing carried out before that withdrawal.

To exercise them, write to us at soporte@lilalavanda.co stating which right you wish to exercise. We may ask you to verify your identity.

We do not make decisions based solely on automated processing of your data that produce legal effects for you or similarly significantly affect you.

10. Complaints to the supervisory authority

If you believe that the processing of your data does not comply with the law, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), through its electronic office (https://sedeagpd.gob.es) or its website (www.aepd.es). You can do so without having to exercise your rights with us first.

11. Changes to this policy

We may update this policy to reflect legal changes or changes to our services. The version in force is always the one published on this page, together with its last-updated date.