Privacy policy

Effective date: 28 July 2026

This Privacy Policy explains how Nusmur, S.L., trading as Ventayan, collects, uses, shares and protects personal data when you visit ventayan.com, place an order, contact us, request a return, subscribe to marketing or otherwise interact with us.

1. Data controller

The controller responsible for the personal data described in this policy is:

Nusmur, S.L.
NIF B22637011
Carrer de la Creu Coberta, 77, Sants-Montjuïc, 08014 Barcelona, Spain
Email: scales@ventayan.com
Telephone: +34 627 278 152

For a privacy request, email scales@ventayan.com with “Privacy Request” in the subject line.

2. Applicable privacy framework

Nusmur, S.L. is established in Spain and offers goods to customers in Great Britain. Depending on the processing and the person concerned, applicable requirements may include the EU General Data Protection Regulation, Spain’s Organic Law 3/2018, the UK GDPR, the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

This policy is intended to provide the information required under those frameworks. Rights and legal bases apply according to the law governing the particular processing.

3. Personal data we collect

Depending on how you interact with Ventayan, we may collect:

Identity and contact data

•      name;

•      billing and delivery address;

•      email address;

•      telephone number; and

•      account identifier, where account functionality is used.

Order and transaction data

•      products viewed, placed in a basket or purchased;

•      order number, date, value and status;

•      shipping, tracking and delivery information;

•      returns, exchanges, refunds, complaints and customer-service history;

•      discount or promotion use; and

•      limited payment information such as payment method, transaction identifier, payment status and masked card details.

Complete card details are processed by payment providers and are not directly received or stored by Ventayan.

Device, usage and technical data

•      IP address;

•      browser and device type;

•      operating system;

•      language, time zone and approximate location derived from technical information;

•      pages viewed, links clicked, referral source and interaction events;

•      cookie identifiers, advertising identifiers and consent preferences; and

•      security, diagnostic and fraud-prevention logs.

Marketing and preference data

•      email and SMS subscription status;

•      cookie and advertising choices;

•      product interests inferred from website interactions where permitted;

•      campaign engagement, such as whether a marketing message was opened or a link was used; and

•      requests to unsubscribe or object to marketing.

Communications and submitted content

•      emails, telephone enquiries, contact-form messages and support communications;

•      reviews, ratings, photographs or other content you choose to submit; and

•      information supplied to support a delivery, return, refund, fraud or product-quality investigation.

We do not intentionally request special-category data. Please do not send health information or other sensitive data unless it is reasonably necessary to address a specific product-safety or accessibility concern.

4. How we obtain personal data

We obtain personal data:

•      directly from you at checkout, through forms, in messages or during a support request;

•      automatically from your browser or device through cookies, pixels, tags, local storage, logs and similar technologies, subject to applicable consent requirements;

•      from Shopify and integrated service providers that support the transaction or website;

•      from payment providers concerning transaction status and verification;

•      from fulfilment, delivery and return partners concerning shipment status;

•      from Google, Meta and other marketing or analytics partners where their tools are used and the sharing is permitted; and

•      from fraud-prevention, identity-verification or security providers where reasonably necessary.

5. Why we use personal data and our lawful bases

We use personal data only where we have an appropriate lawful basis.

To take steps at your request and perform the sales contract

We use identity, contact, order, payment-status and delivery data to:

•      process and accept orders;

•      collect or confirm payment;

•      dispatch and deliver products;

•      provide tracking;

•      process cancellations, returns, exchanges and refunds;

•      respond to order-related questions; and

•      provide remedies for damaged, faulty, missing or incorrect goods.

The usual lawful basis is necessity for a contract or steps taken at your request before entering a contract.

To meet legal obligations

We use and retain information where necessary to:

•      maintain accounting and tax records;

•      provide required consumer information;

•      respond to lawful requests from authorities;

•      handle product-safety, recall or compliance matters;

•      comply with data-protection rights; and

•      prevent or report unlawful activity where the law requires.

The lawful basis is compliance with a legal obligation.

For legitimate business interests

Where our interests are not overridden by your rights, we may use data to:

•      secure the website and accounts;

•      prevent fraud, abuse, chargebacks and unauthorised transactions;

•      manage, improve and troubleshoot the website and customer service;

•      maintain business records and defend legal claims;

•      understand aggregated business performance;

•      protect customers, personnel, suppliers and the public; and

•      send limited marketing to existing customers where the applicable electronic-marketing rules permit it and a clear opt-out is provided.

The lawful basis is legitimate interests. We consider necessity, proportionality and the effect on individuals before relying on this basis.

With consent

Where consent is required, we rely on it for:

•      non-essential analytics technologies;

•      advertising and remarketing technologies;

•      email or SMS marketing that cannot rely on another permitted basis; and

•      another optional use specifically explained when consent is requested.

You may withdraw consent at any time. Withdrawal does not make earlier lawful processing unlawful.

6. Shopify and ecommerce infrastructure

The store is hosted on Shopify. Shopify processes information needed to provide the storefront, checkout, order management, security and related ecommerce services.

Shopify may process data in locations outside your country according to its privacy documentation and contractual arrangements. Some Shopify processing may be performed as a service provider to Nusmur, S.L., while Shopify may determine certain processing independently.

7. Payments

Payment data is processed by the payment method selected at checkout, which may include, card networks, wallet providers and their banking or fraud-prevention partners.

These providers may process personal data as independent controllers for payment authorisation, regulatory compliance, credit or eligibility assessment, fraud prevention and account administration. Their own privacy notices apply to that independent processing.

Ventayan normally receives only the transaction status, payment method, transaction reference and limited masked information needed to manage the order.

8. Fulfilment, customs and delivery

Orders are fulfilled from China. To perform the sales contract, we share necessary information with fulfilment partners, logistics providers, customs intermediaries and delivery carriers.

This information may include:

•      customer and recipient name;

•      delivery address;

•      telephone number and email where needed for delivery;

•      order contents and value;

•      parcel and tracking information; and

•      customs information required for lawful import and delivery.

Partners may use the information only for fulfilment, shipping, customs, returns, security and related legal obligations, subject to their legal role and our arrangements with them.

9. Analytics, advertising and tag management

Subject to consent and applicable law, the website may use:

•      Google Analytics to understand website use and performance;

•      Google Ads to measure advertising, attribute conversions and support remarketing;

•      Google Tag Manager to deploy and manage website tags; and

•      Meta Pixel to measure advertising, build audiences and support relevant advertising on Meta services.

These services may receive device, browser, IP-address, cookie-identifier, interaction, campaign and purchase-event information. Google and Meta may combine information with data associated with their services according to their own privacy terms.

Non-essential analytics and advertising tags should be controlled through the cookie-consent tool. See the Cookie Policy.

10. Email and SMS marketing

We may send promotional emails or SMS messages where you have consented or where another rule, such as a permitted existing-customer exception, lawfully applies.

Every marketing email will provide an unsubscribe method. Marketing SMS messages will provide a clear opt-out method, such as replying STOP where supported.

You can also opt out by contacting scales@ventayan.com. We may keep a minimal suppression record so that we can respect the opt-out.

Service messages about an order, delivery, security, return or legal update are not marketing and may still be sent where necessary.

11. Who we share personal data with

Where necessary and lawful, we may share data with:

•      Shopify and ecommerce technology providers;

•      payment processors, card networks, banks, Apple Pay and Google Pay;

•      fulfilment facilities and suppliers in China;

•      carriers, customs agents, return facilities and logistics providers;

•      email, SMS and customer-support providers;

•      cloud hosting, security, fraud-prevention, debugging and IT providers;

•      Google and Meta for consented analytics or advertising;

•      professional advisers, insurers, auditors and accountants;

•      regulators, courts, law-enforcement or tax authorities where required; and

•      a buyer, seller or adviser involved in a genuine corporate transaction, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data for money.

12. International data transfers

Operating the store, fulfilling orders from China and using global technology providers can involve transferring or making personal data accessible outside the United Kingdom and European Economic Area.

Where required, we use a lawful transfer mechanism. Depending on the destination and legal framework, this may include:

•      an applicable adequacy decision or regulation;

•      approved standard contractual clauses;

•      the UK International Data Transfer Agreement or UK Addendum;

•      contractual, technical and organisational supplementary measures; or

•      another transfer mechanism permitted by law.

You may contact scales@ventayan.com to request further information about the relevant safeguards, subject to legitimate confidentiality and security restrictions.

13. Retention

We keep personal data only as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, tax, fraud-prevention, product-safety and dispute periods.

In general:

•      order, payment-status, shipping, return and accounting records may be retained for up to six years after the relevant transaction, or longer if law or an active dispute requires;

•      customer-service records are retained for as long as needed to resolve the issue and support legal or quality records;

•      account information is retained while the account is active and for an appropriate period afterwards;

•      marketing contact data is retained until consent is withdrawn, an objection is made or it is no longer needed, while a limited suppression record may be kept to honour an opt-out; and

•      cookie and analytics data is retained according to the settings and periods described in the cookie-preference tool and relevant provider configuration.

We may anonymise information so that it no longer identifies an individual and retain the anonymous information for statistical or business analysis.

14. Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction.

No online system is completely risk-free. You should use a strong, unique password where accounts are available, protect your devices and avoid sending payment-card credentials or sensitive information through unsecured channels.

15. Your privacy rights

Depending on the applicable law and circumstances, you may have rights to:

•      obtain information about our processing;

•      request access to your personal data;

•      correct inaccurate or incomplete data;

•      request deletion;

•      request restriction of processing;

•      receive certain data in a portable format;

•      object to processing based on legitimate interests;

•      object at any time to direct marketing;

•      withdraw consent at any time;

•      complain to a supervisory authority; and

•      request safeguards concerning certain solely automated decisions.

Some rights are subject to legal conditions and exceptions. We may need to verify your identity before acting on a request. We will respond within the period required by applicable law.

Your right to object to direct marketing is absolute. You may use the unsubscribe method in a message or contact scales@ventayan.com.

16. Automated processing

Ventayan does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on customers.

Payment, fraud-prevention and providers may use automated processes under their own legal responsibilities and privacy notices. Contact the relevant provider about a decision made independently by that provider, or contact us if you need help identifying the provider.

17. Children

The website is intended for adults who can enter a purchase contract. We do not knowingly collect personal data from a child for the purpose of allowing the child to place an order.

If you believe a child has provided personal data improperly, contact scales@ventayan.com.

18. Complaints

Please contact us first so that we can investigate:

Email: scales@ventayan.com
Address: Nusmur, S.L., Carrer de la Creu Coberta, 77, Sants-Montjuïc, 08014 Barcelona, Spain

You may also complain to the supervisory authority that applies to your circumstances, including:

•      the Spanish Data Protection Agency, www.aepd.es; or

•      the UK Information Commissioner’s Office, www.ico.org.uk.

You may have the right to complain to another authority in the place where you live, work or believe an infringement occurred.

19. Changes to this policy

We may update this policy to reflect changes in law, technology, providers or our processing. The current version and effective date will be posted on the website.

Where a change materially affects how we use personal data, we will provide additional notice where required.

20. Contact

Nusmur, S.L., trading as Ventayan
Carrer de la Creu Coberta, 77, Sants-Montjuïc, 08014 Barcelona, Spain
Email: scales@ventayan.com
Telephone: +34 634 74 20 49