Last updated: July 2026

1. INTRODUCTION AND OVERVIEW

ESPAWSO VITAL, S.L. (hereinafter "Soybazar", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website soybazar.com, use our mobile application, or engage with our services, including our social commerce platform featuring livestreaming, group bargaining, product reviews, and community interactions.

Soybazar is a fashion e-commerce platform that combines social networking features with innovative shopping experiences. Our platform allows users to discover fashion trends, participate in live-streamed shopping events, form groups to access discounted pricing, share outfit reviews with photos and videos, and interact with a community of fellow fashion enthusiasts.

This policy applies to all personal data processed by us as a data controller. We encourage you to read this policy carefully to understand our practices regarding your personal data.

Data Controller: ESPAWSO VITAL, S.L.

CIF: B21680426

Registered Address: C/ Leonardo Da Vinci 4, Escalera 5, Piso 6, Puerta D, 45224 Seseña, Toledo, Spain

Email: privacy@soybazar.com

Commercial Registry: Registro Mercantil de Toledo, Volume 1234, Folio 56, Section 8, Sheet TO-56789

2. WHAT PERSONAL DATA WE COLLECT AND HOW

We collect various categories of personal data to provide and improve our services. The types of data we collect depend on how you interact with our platform.

2.1 Account Registration Data

When you create an account on Soybazar, we collect:

Full name or username you choose to display publicly
Email address (used as your primary login identifier)
Password (stored in encrypted form)
Phone number (optional but recommended for account recovery and WhatsApp notifications)
Date of birth (to verify you are at least 16 years of age)
Profile picture (optional)
Shipping and billing addresses
Language and currency preferences

2.2 Transaction Data

When you make a purchase or participate in group bargaining, we collect:

Products viewed, added to cart, or added to wishlist
Order details, including items purchased, quantities, prices, and discounts applied
Group bargaining participation records, including groups created or joined
Payment information (credit/debit card details are processed by our PCI-DSS certified payment processors; we only store the last four digits, card type, and expiration date)
Shipping information and delivery preferences
Order history and return/exchange records
Invoice and receipt data

2.3 User-Generated Content

As a social commerce platform, we collect content you voluntarily create and share:

Product reviews, ratings, and written feedback
Photos and videos uploaded as part of outfit reviews ("OOTD" posts)
Comments and replies on other users content
Livestreaming content if you host or participate in live shopping events
Messages sent through our platform communication features
Forum posts and community discussions

2.4 Technical Data Automatically Collected

When you access our website or app, we automatically collect:

IP address and device identifiers (e.g., IDFA, AAID, advertising ID)
Browser type, version, and language settings
Operating system and device type (mobile, tablet, desktop)
Pages visited, time spent on pages, clickstream data, and navigation paths
Referring URL and exit pages
App crash reports and performance data
Approximate geolocation derived from IP address

2.5 Location Data

With your explicit consent, we may collect precise geolocation data from your mobile device to:

Show nearby pick-up points and delivery options
Provide location-based promotional offers
Calculate estimated delivery times

You can withdraw your consent for precise location tracking at any time through your device settings.

2.6 Data from Third Parties

We may receive personal data about you from:

Social media platforms (if you sign up using Google, Facebook, or Apple ID)
Payment processors and fraud detection services
Logistics and shipping partners
Marketing and advertising partners
Credit reference agencies (for fraud prevention)

3. HOW WE PROCESS YOUR DATA

We process your personal data only when we have a lawful basis to do so. The following sections describe each processing activity, its purpose, the legal basis we rely on, and your rights in relation to that processing.

3.1 Direct Marketing

We may use your contact information to send you marketing communications about our products, services, promotions, and events. Our marketing channels include:

Email Marketing:

If you have created an account or made a purchase on Soybazar, we may send you commercial emails about new collections, exclusive offers, and personalized recommendations. We rely on our legitimate interest to send you direct marketing by email when you are an existing customer (Article 6(1)(f) GDPR), and on your explicit consent when required by applicable law (e.g., for non-customer subscribers in certain jurisdictions). You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email or by adjusting your communication preferences in your account settings.

SMS Marketing:

With your prior explicit consent, we may send promotional text messages to your mobile phone number. You can opt out of SMS marketing at any time by replying "STOP" to any message we send you or by updating your preferences in your account settings.

WhatsApp Marketing:

With your explicit consent, we may send you promotional messages, order updates, and personalized recommendations via WhatsApp. You can withdraw your consent at any time by sending "STOP" via WhatsApp or by disabling WhatsApp notifications in your account settings. Standard messaging rates from your provider may apply.

Push Notifications:

If you have installed our mobile application and granted permission, we may send push notifications about new arrivals, flash sales, abandoned cart reminders, and order status updates. You can disable push notifications at any time through your device settings (Settings > Notifications > Soybazar).

Consent Management:

We maintain a record of all consents you have granted or withdrawn. You have the right to withdraw your consent for any marketing channel at any time, and the withdrawal will not affect the lawfulness of processing based on consent before its withdrawal. We process all withdrawal requests within 72 hours.

3.2 Product Reviews and User-Generated Content

Soybazar encourages users to share their fashion experiences through product reviews, ratings, photos, and videos. When you submit a review or upload content:

Your review and display name will be published publicly on the product page
Photos and videos you upload as part of an outfit review ("OOTD") will be visible to other users
You represent and warrant that you have obtained all necessary consents from any individuals identifiable in your uploaded content, including explicit consent to publish their image
We may feature selected reviews and photos on our homepage, marketing materials, or social media channels with your prior consent
You have the right to request deletion of your reviews or user-generated content at any time by contacting us at privacy@soybazar.com

Legal basis for processing reviews and UGC is Article 6(1)(b) GDPR (performance of a contract with you, as the ability to share reviews is part of our service) and Article 6(1)(f) GDPR (our legitimate interest in enabling community interaction and social proof features).

3.3 Customer Service Chat Evaluation

To continuously improve our customer service quality, we may evaluate chat conversations between you and our customer service agents. This process includes:

De-identification of chat transcripts (removal of your name, contact details, and other direct identifiers)
Automated analysis using artificial intelligence tools to assess service quality, response accuracy, and customer satisfaction
Manual review by our quality assurance team on a random sample basis
Aggregate reporting on service performance metrics

We process chat evaluations based on our legitimate interest (Article 6(1)(f) GDPR) in maintaining high service standards. You have the right to opt out of chat evaluation by notifying our customer service team at the start of your chat session. If you opt out, your chat transcript will be excluded from all evaluation processes and used solely for resolving your specific inquiry.

Soybazar includes social networking features that allow you to:

Create a public profile with your chosen username, profile photo, and bio
Follow other users and see their activity feed
Post outfit photos, fashion tips, and style inspiration
Like, comment on, and share other users content
Participate in community discussions and fashion challenges

Your social platform content is public by default. Any information you post on your profile, in community discussions, or as part of fashion challenges will be visible to all Soybazar users and may be indexed by search engines. You should exercise caution when sharing personal information publicly. You can adjust your privacy settings to limit visibility of certain content or make your profile private.

Livestreaming:

When you host or participate in a livestream shopping event, your video feed, voice, and any comments you post during the stream will be visible to all viewers of that livestream. Livestreams may be recorded and made available as replays for a limited period. We will notify you before a livestream is recorded and provide you with the option to decline participation.

3.5 Group Bargaining Participation

Group bargaining is a core feature of Soybazar that allows users to form groups to access discounted pricing on selected products. When you participate in group bargaining:

If you create a group, your chosen username and the product you are bargaining for will be visible to other users who can join your group
If you join a group, the group creator and other members will see your username
Group chat functionality allows members to coordinate their purchase decisions
Your group bargaining history is stored to track discount achievements and leaderboard rankings
Group bargaining data is processed based on Article 6(1)(b) GDPR (performance of a contract) as group bargaining is a contractual feature of our service

We may share your personal data with the following categories of recipients for the purposes described below:

Corporate Organization:

We share data within our corporate group, including subsidiaries, affiliates, and parent companies, for internal administrative purposes, business operations, and to provide unified services across our brands. All entities within our group are bound by internal data processing agreements that ensure the same level of data protection as set out in this policy.

Third-Party Sellers:

Soybazar may act as a marketplace platform for third-party sellers. When you purchase from a third-party seller through our platform, we share your order details, shipping address, and contact information with that seller to enable them to fulfill your order. Third-party sellers are independent data controllers and are responsible for their own compliance with data protection laws.

Service Providers:

We engage trusted third-party service providers to perform functions on our behalf, including:

Payment processing (Stripe, PayPal, and other payment gateways)
Logistics and shipping (courier services, warehouse operators)
Cloud hosting and infrastructure (AWS, Google Cloud)
Email and SMS delivery services
Customer service platform providers (Zendesk, Intercom)
Analytics and advertising platforms (Google Analytics, Facebook Ads, Microsoft Ads)
Fraud detection and prevention services

All service providers are contractually obligated to process your data only on our instructions and to implement appropriate technical and organizational security measures.

Legal Compliance:

We may disclose your personal data when required to do so by applicable law, regulation, legal process, or governmental request. This includes responding to subpoenas, court orders, or requests from regulatory authorities such as the Spanish Data Protection Agency (AEPD).

Co-Branded Services:

We may offer co-branded promotions, products, or services with third-party partners. If you choose to participate in a co-branded offering, your personal data may be shared with the relevant partner. In such cases, you will be informed at the point of data collection about the partner involved and their privacy practices.

With Your Consent:

We may share your personal data for any other purpose with your explicit, informed consent.

Corporate Transactions:

In the event of a merger, acquisition, restructuring, bankruptcy, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change in ownership and the choices you may have regarding your personal data.

5. COOKIES AND SIMILAR TECHNOLOGIES

5.1 What Are Cookies

Cookies are small text files that are stored on your device (computer, tablet, or mobile) when you visit a website. They allow the website to recognize your device and remember information about your visit, such as your preferences and browsing behavior. Similar technologies include pixel tags (web beacons), Flash cookies, and HTML5 local storage.

When you first visit soybazar.com, a cookie consent banner is displayed that allows you to:

Accept all cookies
Reject all non-essential cookies
Customize your cookie preferences by category
Withdraw or change your consent at any time by clicking the "Cookie Settings" link in the website footer

We use a Consent Management Platform (CMP) that records your consent preferences and ensures that cookies are only loaded based on your selections. Your consent preferences are stored for 12 months.

5.3 Types of Cookies We Use

1. Strictly Necessary Cookies

These cookies are essential for the website to function properly and cannot be disabled in our systems. They are typically set in response to actions you take that constitute a request for services, such as setting your privacy preferences, logging in, filling in forms, or adding items to your shopping cart. You can set your browser to block or alert you about these cookies, but some parts of the website may not function properly. Examples include session cookies that maintain your logged-in status and cart contents.

Purpose: Enable core website functionality
Legal basis: Article 6(1)(f) GDPR / ePrivacy Directive Article 5(3) exemption
Retention: Session duration or up to 12 months

2. Performance and Analytics Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our website. They help us understand which pages are most and least popular and see how visitors navigate the website. All information these cookies collect is aggregated and therefore anonymized.

Purpose: Analyze website usage, improve performance, and optimize user experience
Examples: Google Analytics (_ga, _gid, _gat), Hotjar
Legal basis: Your consent (Article 6(1)(a) GDPR)
Retention: Up to 26 months

3. Functional Cookies

These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, some or all of these services may not function properly.

Purpose: Remember your preferences (language, currency, region), personalization
Examples: Language preference cookies, currency selection cookies
Legal basis: Your consent (Article 6(1)(a) GDPR)
Retention: Up to 12 months

4. Advertising and Targeting Cookies

These cookies are set through our website by our advertising partners. They may be used to build a profile of your interests and show you relevant advertisements on other websites. They do not directly store personal data but are based on uniquely identifying your browser and internet device.

Purpose: Deliver personalized advertisements, measure ad effectiveness, retargeting
Examples: Google Ads cookies, Facebook Pixel, Microsoft Bing Ads
Legal basis: Your consent (Article 6(1)(a) GDPR)
Retention: Up to 12 months

5. Social Media Cookies

These cookies are set by social media services that we have integrated into our website to enable you to share content with your friends and networks. They can track your browser across other websites and build up a profile of your interests.

Purpose: Enable social sharing, track cross-site activity for social media advertising
Examples: Facebook Share button, Instagram integration, TikTok Pixel
Legal basis: Your consent (Article 6(1)(a) GDPR)
Retention: As set by the respective social media platform

6. ANALYTICS AND REMARKETING

6.1 Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies to help us analyze how users navigate and interact with our website. The information generated by the cookie about your use of the website (including your IP address) is transmitted to and stored by Google on servers in the United States.

We have activated the IP anonymization feature (anonymizeIp) on Google Analytics, which truncates your IP address before it is sent to Google servers, making it anonymous. Google will use this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide other services relating to website activity and internet usage.

Google may transfer personal data to the United States and other jurisdictions. Such transfers are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission. For more information, see Google Privacy Policy at https://policies.google.com/privacy.

6.2 Behavioral Remarketing

We use behavioral remarketing services to advertise on third-party websites to you after you have visited our website. This means that after you browse Soybazar, you may see our advertisements on other websites across the internet.

Google Ads Remarketing:

We use Google Ads Remarketing, operated by Google Ireland Limited. Google uses cookies to serve ads based on your past visits to Soybazar. You can opt out of Google remarketing by visiting https://www.google.com/settings/ads.

Facebook Custom Audiences:

We use the Facebook Pixel on our website to create Custom Audiences for advertising on Facebook and Instagram, operated by Meta Platforms Ireland Limited. The Facebook Pixel collects information about your browsing behavior on our website, which is then used to show you relevant advertisements on Facebook and Instagram. You can opt out by adjusting your Facebook ad preferences at https://www.facebook.com/ads/preferences.

Microsoft Bing Ads Remarketing:

We use Microsoft Bing Ads Remarketing, operated by Microsoft Corporation. The Universal Event Tracking (UET) tag collects information about your browsing behavior to serve targeted ads on Bing search results and the Microsoft Audience Network. You can opt out at https://account.microsoft.com/privacy.

7. OTHER TRACKING TECHNOLOGIES

In addition to cookies, we use the following tracking technologies on our website and mobile app:

Clickstream Data:

We automatically log your navigation path through our website, including pages viewed, time spent on each page, clicks, mouse movements, and scrolling behavior. This data is used to improve website usability and user experience.

JavaScript Tags:

We use JavaScript tags (also known as web beacons or tracking pixels) on our website and in our emails. These are small, transparent graphic images that allow us to track user behavior, such as whether you have opened an email or clicked on a link. JavaScript tags help us measure the effectiveness of our marketing campaigns and improve our content.

Entity Tags (ETags):

ETags are HTTP headers that enable us to cache website content efficiently and improve page load times. They may also be used to recognize returning visitors.

HTML5 Local Storage:

Our website uses HTML5 local storage to store data locally on your device, such as your shopping cart contents and browsing preferences. Unlike cookies, HTML5 local storage does not automatically transmit data to our servers unless your browser specifically sends it.

Mobile App SDKs:

Our mobile application may integrate third-party software development kits (SDKs) that collect data about app usage, device information, and advertising identifiers to enable analytics and advertising. You can reset your advertising identifier at any time through your device settings.

8. SECURITY PRECAUTIONS

We implement appropriate technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our security measures include:

Encryption of personal data in transit using TLS 1.3 (Transport Layer Security) protocol
Encryption of personal data at rest using AES-256 encryption
Pseudonymization and anonymization techniques where feasible
Regular security audits, penetration testing, and vulnerability assessments
Strict access controls and role-based permissions for employee access to personal data
Multi-factor authentication for administrative accounts
Regular staff training on data protection and privacy best practices
Incident response and breach notification procedures
PCI-DSS compliance for all payment processing activities

We maintain a data breach response plan and will notify you and the relevant supervisory authority (AEPD) within 72 hours of becoming aware of a data breach that poses a risk to your rights and freedoms, as required by Article 33 and 34 of the GDPR.

9. YOUR RIGHTS

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data. We will respond to any request to exercise these rights within one month of receipt, which may be extended by two additional months for complex or multiple requests. All requests are processed free of charge, unless they are manifestly unfounded or excessive.

9.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation from us as to whether or not we are processing your personal data and, where that is the case, access to the personal data and the following information: the purposes of processing; the categories of personal data concerned; the recipients or categories of recipients to whom the data have been or will be disclosed; the envisaged retention period; the existence of your other rights; the right to lodge a complaint with a supervisory authority; and any available information about the source of the data if not collected directly from you. We will provide a copy of the personal data undergoing processing. For additional copies requested by you, we may charge a reasonable fee based on administrative costs.

9.2 Right to Rectification (Article 16 GDPR)

You have the right to obtain the correction of inaccurate personal data concerning you without undue delay. You can update most of your account information directly through your account settings. For corrections that cannot be made through your account, please contact us at privacy@soybazar.com.

9.3 Right to Erasure (Right to be Forgotten) (Article 17 GDPR)

You have the right to obtain the erasure of your personal data without undue delay when one of the following grounds applies: the personal data are no longer necessary for the purposes for which they were collected or processed; you withdraw your consent on which the processing is based and there is no other legal ground for the processing; you object to the processing and there are no overriding legitimate grounds; the personal data have been unlawfully processed; the personal data must be erased for compliance with a legal obligation; or the personal data have been collected in relation to the offer of information society services to a child. Please note that we may not be able to erase data that is necessary for compliance with legal obligations (e.g., tax records must be retained for 4 years under Spanish law).

9.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to obtain restriction of processing where: you contest the accuracy of the personal data (for a period enabling us to verify the accuracy); the processing is unlawful and you oppose the erasure and request restriction instead; we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims; or you have objected to processing pending the verification of whether our legitimate grounds override yours. When processing is restricted, we may store the data but not further process it, except with your consent or for legal claims.

9.5 Right to Data Portability (Article 20 GDPR)

You have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) and the right to transmit that data to another controller without hindrance from us, where: the processing is based on consent or on a contract; and the processing is carried out by automated means. This right applies to data you have actively and knowingly provided to us.

9.6 Right to Object (Article 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data based on our legitimate interests (including profiling). Where we process your personal data for direct marketing purposes, you have the right to object at any time without providing any grounds, and we will cease processing for such purposes immediately. This includes profiling to the extent that it is related to direct marketing.

9.7 Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can manage your consents through your account settings or by contacting us at privacy@soybazar.com.

9.8 Right Not to Be Subject to Automated Decision-Making (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not engage in automated decision-making that produces legal effects for our users. Any automated recommendations (product suggestions, size recommendations) are for guidance only and you can always make the final decision.

9.9 Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR. The relevant supervisory authority for Soybazar is:

Agencia Espanola de Proteccion de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
Website: https://www.aepd.es
Phone: +34 901 100 099

9.10 Right to Compensation (Article 82 GDPR)

You have the right to claim compensation from us for material or non-material damage suffered as a result of an infringement of the GDPR. Any such claims should be addressed to our DPO at dpo@soybazar.com.

How to Exercise Your Rights:

To exercise any of your rights, please submit a request through one of the following channels:

Email: Send your request to privacy@soybazar.com with the subject line "Data Subject Request"
Online Form: Access the "Privacy Settings" section in your account dashboard
Postal Mail: Write to us at ESPAWSO VITAL, S.L., C/ Leonardo Da Vinci 4, Escalera 5, Piso 6, Puerta D, 45224 Sesena, Toledo, Spain, marking the envelope "Data Protection"

We may need to verify your identity before processing your request. We will request a copy of your government-issued ID or other identifying documentation. This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it.

10. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Account Data:

We retain your account data for as long as your account is active. If you delete your account, your personal data will be deleted or anonymized within 30 days, except where we are required by law to retain certain data for longer periods.

Transaction Data:

Transaction records, including invoices and receipts, are retained for 6 years to comply with Spanish tax and commercial law requirements (Ley General Tributaria and Codigo de Comercio).

Marketing Preferences and Consents:

Records of your marketing preferences and consents are retained for as long as we send you marketing communications plus 2 years following your last interaction with our marketing.

User-Generated Content:

Reviews, photos, and other content you post on our platform are retained until you delete them or request their deletion. We may retain anonymized versions for analytics purposes.

Customer Service Communications:

Chat transcripts and email correspondence with our customer service team are retained for 2 years from the date of the last communication.

Technical Data and Logs:

Server logs, clickstream data, and analytics data are retained for 26 months.

Cookie Data:

Cookie retention periods vary by cookie type as specified in Section 5.3 above and in our Cookie Policy.

Legal Hold:

If a legal claim or regulatory investigation arises, we may retain relevant personal data for the duration of such proceedings plus any applicable appeal period.

11. THIRD-PARTY WEBSITES

Our website and mobile application may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Examples of third-party links on Soybazar include:

Social media platforms (Facebook, Instagram, TikTok, Pinterest)
Payment processors (Stripe, PayPal)
Shipping carriers (Correos, DHL, UPS, MRW)
Third-party seller stores hosted on our marketplace platform

12. CHILDRENS PRIVACY

Soybazar is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, please do not create an account on Soybazar or submit any personal data to us.

If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information as soon as possible. If you believe that a child under 16 may have provided us with personal data, please contact us immediately at privacy@soybazar.com.

In the event that we offer services to children aged 16 or above in specific jurisdictions, we will implement appropriate age verification mechanisms and obtain parental consent where required by applicable law.

13. INTERNATIONAL DATA TRANSFERS

As a global fashion platform with operations in Spain and sourcing relationships in China and other countries, we may transfer your personal data to countries outside the European Economic Area (EEA). We ensure that any international transfer of your personal data is carried out in compliance with applicable data protection laws.

Transfers to Adequate Jurisdictions:

We may transfer personal data to countries that the European Commission has determined provide an adequate level of data protection pursuant to Article 45 GDPR. These currently include Andorra, Argentina, Canada, Switzerland, Faroe Islands, Guernsey, Iceland, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, United Kingdom, and Uruguay.

Standard Contractual Clauses (SCCs):

Where we transfer personal data to countries that do not benefit from an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914) to ensure an equivalent level of data protection. This includes transfers to our service providers in the United States (e.g., AWS, Google Cloud). A copy of the SCCs can be obtained by contacting us at privacy@soybazar.com.

Transfers for Contract Fulfillment (Article 49(1)(b) GDPR):

We may transfer personal data to third countries where necessary for the performance of a contract between you and us or for the implementation of pre-contractual measures taken at your request. This includes transfers to:

Our suppliers and manufacturers in China for the purpose of fulfilling orders placed on our platform
Logistics partners in destination countries for delivery purposes
Payment processors for transaction processing

China-Specific Transfers:

Given that Soybazar sources fashion products from manufacturers and suppliers in China, we may transfer order-related personal data (name, shipping address, phone number, order details) to our Chinese business partners for the purpose of order fulfillment, quality control, and logistics coordination. We have implemented contractual safeguards with our Chinese partners, including data processing agreements that require them to comply with data protection standards equivalent to those under the GDPR. The Personal Information Protection Law (PIPL) of China provides legal protections for personal data processed within China.

14. CONTACT US AND DATA PROTECTION OFFICER

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer (DPO) or our Data Protection Contact (DPC):

Data Protection Officer (DPO):

We have appointed a Data Protection Officer who is responsible for overseeing our data protection strategy and ensuring compliance with the GDPR. The DPO can be reached at:

Email: dpo@soybazar.com
Postal: FAO Data Protection Officer, ESPAWSO VITAL, S.L., C/ Leonardo Da Vinci 4, Escalera 5, Piso 6, Puerta D, 45224 Sesena, Toledo, Spain

Data Protection Contact (DPC):

For general privacy inquiries, data subject requests, and marketing preference management:

Email: privacy@soybazar.com
Online Contact Form: Available in the "Help Center" section of our website
Postal: ESPAWSO VITAL, S.L., C/ Leonardo Da Vinci 4, Escalera 5, Piso 6, Puerta D, 45224 Sesena, Toledo, Spain

We aim to respond to all inquiries within 48 hours and resolve any complaints within one month.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other operational reasons.

When we make material changes to this policy:

We will update the "Last updated" date at the top of this policy
We will notify you by email (if we have your email address) at least 30 days before the changes take effect
We will display a prominent notice on our website and mobile application
We may request your renewed consent where required by applicable law

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of our platform after the effective date of any changes constitutes your acceptance of the revised policy.

If you do not agree with the changes, you should stop using our platform and delete your account. You can delete your account at any time through your account settings or by contacting us at privacy@soybazar.com.

Cookie Policy

for soybazar.com

Last Updated: July 15, 2026

ESPAWSO VITAL, S.L. | B21680426

1. What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile) when you visit a website. They are widely used to make websites work more efficiently, enhance user experience, and provide information to the website owners.

Cookies can be classified according to several criteria:

First-party vs Third-party cookies: First-party cookies are set by the website you are visiting (soybazar.com). Third-party cookies are set by domains other than the one you are visiting, typically by external services integrated into the site (e.g., Google Analytics, Facebook).
Persistent vs Session cookies: Persistent cookies remain on your device for a set period or until you manually delete them. Session cookies are temporary and are deleted when you close your browser.

2. Who Is the Data Controller?

The data controller responsible for the processing of personal data through cookies on soybazar.com is:

Company: ESPAWSO VITAL, S.L.
CIF / Tax ID: B21680426
Registered Address: C/ Leonardo Da Vinci 4, Escalera 5, Piso 6, Puerta D, 45224 Seseña, Toledo, Spain
Email: privacy@soybazar.com
Website: https://www.soybazar.com

3. How Does soybazar Use Cookies?

When you visit soybazar.com for the first time, a cookie banner will appear requesting your consent to the use of non-essential cookies. You may accept all cookies, reject all non-essential cookies, or customize your preferences by selecting specific categories.

We use a Consent Management Platform (CMP) that records your preferences and ensures that cookies are only loaded after your explicit consent. The CMP also allows you to change your preferences at any time by clicking the "Cookie Settings" link available in the footer of the website.

Your consent is stored and can be withdrawn at any time. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal.

4. Types of Cookies Used on soybazar.com

Below is a detailed breakdown of the categories of cookies used on this website. Each category includes a description and a table listing the specific cookies.

4.1 Strictly Necessary Cookies

These cookies are essential for the website to function properly and cannot be disabled in our systems. They are usually set in response to actions made by you that amount to a request for services, such as logging in, filling in forms, or setting your privacy preferences. You can set your browser to block or alert you about these cookies, but some parts of the site will not work. These cookies do not store any personally identifiable information.

Cookie Name	Category	Purpose	Duration
soybazar_session	Strictly Necessary	Maintains user session state across page requests	Session
XSRF-TOKEN	Strictly Necessary	Protects against cross-site request forgery attacks	Session
cookie_consent	Strictly Necessary	Stores the user's cookie consent preferences	1 year
soybazar_lang	Strictly Necessary	Remembers the user's selected language	Session
PHPSESSID	Strictly Necessary	PHP session identifier for site functionality	Session
__cf_bm	Strictly Necessary	Cloudflare bot management and DDoS protection	30 minutes
cf_clearance	Strictly Necessary	Cloudflare security clearance after challenge	1 year

4.2 Performance and Analytics Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you have visited our site.

Cookie Name	Category	Purpose	Duration
_ga	Performance	Used by Google Analytics to distinguish unique users	2 years
_gid	Performance	Used by Google Analytics to distinguish users	24 hours
_gat	Performance	Used by Google Analytics to throttle request rate	1 minute
_ga_*	Performance	Used by Google Analytics to persist session state	2 years
_gcl_au	Performance	Used by Google AdSense for experimenting with advertisement efficiency	3 months
_dc_gtm_*	Performance	Used by Google Tag Manager to throttle request rate	1 minute

4.3 Functional Cookies

Cookie Name	Category	Purpose	Duration
soybazar_compare	Functional	Stores products added to the comparison list	1 year
soybazar_wishlist	Functional	Stores products added to the wishlist	1 year
soybazar_recent	Functional	Stores recently viewed products for quick access	30 days
soybazar_currency	Functional	Remembers the user's preferred currency	7 days
soybazar_zip	Functional	Stores the user's zip/postal code for shipping calculations	30 days
soybazar_search	Functional	Remembers recent search queries	Session

4.4 Targeting and Advertising Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. They do not store directly personal information but are based on uniquely identifying your browser and internet device.

Cookie Name	Category	Purpose	Duration
_fbp	Advertising	Used by Facebook to deliver a series of advertisement products	3 months
_gcl_aw	Advertising	Used by Google Ads for conversion tracking and remarketing	90 days
_gac_*	Advertising	Google Ads conversion tracking and attribution	90 days
_ttp	Advertising	Used by TikTok for tracking, analytics and ad targeting	13 months
_tt_enable_cookie	Advertising	TikTok cookie consent marker	13 months
_pin_unauth	Advertising	Used by Pinterest for analytics and ad targeting	1 year
_pinterest_ct_ua	Advertising	Pinterest conversion tracking	1 year
ads_prefs	Advertising	Stores advertising preference data	2 years
IDE	Advertising	Used by Google DoubleClick for ad serving and targeting	13 months
test_cookie	Advertising	Used by Google DoubleClick to check browser support	15 minutes

These cookies are set by social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit.

Cookie Name	Category	Purpose	Duration
datr	Social Media	Used by Facebook to identify the browser for security and integrity	2 years
fr	Social Media	Used by Facebook for ad delivery and measurement	3 months
sb	Social Media	Used by Facebook for browser identification and security	2 years
_tld_	Social Media	Used by TikTok to share data across subdomains	Session
guest_id	Social Media	Used by Twitter/X for guest user identification	2 years
guest_id_marketing	Social Media	Used by Twitter/X for marketing purposes	2 years
personalization_id	Social Media	Used by Twitter/X for content personalization	2 years
lidc	Social Media	Used by LinkedIn for routing and optimization	24 hours
bcookie	Social Media	Used by LinkedIn for browser identifier	2 years
bscookie	Social Media	Used by LinkedIn for secure browser identifier	2 years

5. Third-Party Cookies

In addition to our own cookies, we use various third-party services that also set cookies on your device when you visit soybazar.com. These third-party cookies are subject to the respective privacy policies of these external services.

Below is a list of the main third-party services we use, along with links to their privacy policies:

Service	Purpose	Privacy Policy URL
Google Analytics	Analytics and performance measurement	https://policies.google.com/privacy
Facebook / Meta	Advertising, analytics, and social media features	https://www.facebook.com/privacy/policy/
Google Ads	Online advertising and conversion tracking	https://policies.google.com/privacy
TikTok	Advertising and analytics	https://www.tiktok.com/legal/privacy-policy
Pinterest	Advertising and content sharing	https://policy.pinterest.com/privacy-policy
LinkedIn	Social media features and analytics	https://www.linkedin.com/legal/privacy-policy
Twitter / X	Social media integration and advertising	https://twitter.com/privacy
Cloudflare	Security and performance optimization	https://www.cloudflare.com/privacypolicy/
Google DoubleClick	Ad serving and remarketing	https://policies.google.com/privacy
Microsoft Bing Ads	Advertising and conversion tracking	https://privacy.microsoft.com/privacy

6. Analytics

We use Google Analytics, a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies to help us analyze how users interact with the website. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.

IP Anonymization: We have activated the IP anonymization feature (anonymizeIP) on this website. Google will truncate/anonymize the last octet of the IP address for Member States of the European Union as well as for other parties to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address sent to and shortened by Google servers in the USA.

Opt-Out: You may refuse the use of cookies by selecting the appropriate settings in your browser. You can also prevent Google's collection and use of data generated by the cookie and related to your use of the website by downloading and installing the Google Analytics Opt-out Browser Add-on available at: https://tools.google.com/dlpage/gaoptout

7. Behavioral Remarketing

We use behavioral remarketing services to show you relevant advertisements based on your browsing behavior on our site. When you visit our site, these services place cookies on your device that enable us to show you targeted advertisements when you visit other websites or social media platforms.

Google Ads Remarketing: We use Google Ads remarketing to show advertisements to users who have previously visited our website. Google uses cookies (such as the Google Analytics cookie and the Google Ads conversion cookie) to serve ads based on a user's past visits. Users may opt out of Google's use of cookies by visiting the Google Ads Preferences Manager at https://adssettings.google.com.

Facebook Remarketing (Meta Pixel): We use the Meta Pixel (formerly Facebook Pixel) to track conversions, build audience segments, and serve targeted ads on Facebook and Instagram. The pixel collects data about the actions users take on our website, which is then used to display relevant ads. The data collected remains anonymous to us; Facebook may link this data to your Facebook account. You can adjust your ad preferences at https://www.facebook.com/ads/preferences.

Microsoft Bing Ads Remarketing: We use Microsoft Bing Ads Universal Event Tracking (UET) to track conversions and serve remarketing ads through the Bing network. Bing uses cookies to collect information about your interactions with our website. You can opt out of personalized advertising by visiting https://account.microsoft.com/privacy/ad-settings.

8. Other Tracking Technologies

In addition to cookies, we may use other similar tracking technologies on soybazar.com:

Clickstream Data: We automatically collect log data and clickstream information to track user navigation patterns. This includes the pages you visit, the time and date of your visit, the time spent on pages, and the sequence of pages viewed. This data is collected for analytical purposes and site optimization.
JavaScript Tags: We use JavaScript tracking tags (pixels) from third-party services such as Google Analytics, Facebook, and TikTok. These tags execute small pieces of JavaScript code that collect information about user interactions and transmit it to the respective third-party service.
Entity Tags (ETags): ETags are HTTP headers that help us validate cached content and improve load times. In some cases, ETags can be used as a tracking mechanism by assigning a unique identifier to your browser.
HTML5 Local Storage: We use HTML5 local storage to store data locally in your browser for enhanced site functionality. Unlike cookies, local storage data is not automatically transmitted to the server with each HTTP request and can store larger amounts of data.
Web Beacons (Clear GIFs): Web beacons are small graphic images (1x1 pixel, invisible) embedded in web pages and emails. They are used to track user behavior, measure email open rates, and gather aggregated statistics. We use web beacons in conjunction with our email campaigns and third-party services.
Browser Fingerprinting: We may collect certain non-personal information about your browser configuration, such as screen resolution, installed fonts, browser type, and operating system, to create a unique browser fingerprint for security and fraud prevention purposes.

9. Location Information

We may collect and process information about your approximate location. We use various technologies to determine location, including IP address, GPS, and sensor data from your device. Location data may be used to:

- Provide localized content (e.g., prices in your currency, shipping options)
- Serve geographically relevant advertisements
- Analyze traffic by geographic region
- Comply with regional legal requirements (e.g., GDPR in the EU, applicable data protection laws)
This information is collected only with your consent where required by applicable law. You can disable location sharing through your browser or device settings at any time.

10. How to Manage and Delete Cookies

You have the right to decide whether to accept or reject cookies. You can exercise your cookie preferences by clicking the "Cookie Settings" link on our website. Alternatively, you can manage cookies directly through your browser settings. Below are instructions for the most common browsers:

Google Chrome: Go to Settings > Privacy and security > Cookies and other site data. From here you can block or allow cookies, clear browsing data, and manage site-specific exceptions. Alternatively, click the lock icon in the address bar to manage permissions for the current site.
Mozilla Firefox: Go to Options > Privacy & Security > Cookies and Site Data. You can enable "Delete cookies and site data when Firefox is closed," manage exceptions, or clear individual cookies. For third-party cookies, you can set Firefox to block them entirely.
Apple Safari: Go to Safari > Preferences > Privacy. Here you can "Block all cookies" or manage website tracking. Safari also offers Intelligent Tracking Prevention (ITP) which limits third-party cookie tracking by default.
Microsoft Edge: Go to Settings > Cookies and site permissions > Cookies and site data. You can block or allow cookies, clear browsing data on exit, and manage site-specific permissions. Edge also offers Tracking Prevention settings under Privacy, search, and services.
Other browsers: Please refer to your browser's help documentation or visit https://www.aboutcookies.org for comprehensive guides on managing cookies across all browsers.

11. Do-Not-Track Signals

Some browsers allow you to enable a "Do Not Track" (DNT) signal that indicates to websites that you do not wish to be tracked. Currently, there is no uniform standard for how websites should respond to DNT signals. As a result, soybazar.com does not currently respond to DNT signals. However, you can manage your preferences through the cookie settings on our website or through your browser settings as described in Section 10 above.

We will continue to monitor developments in this area and update our practices accordingly.

12. Policy Updates

We may update this Cookie Policy from time to time to reflect changes in our practices, applicable regulations, or the cookies and technologies we use. When we make changes, we will revise the "Last Updated" date at the top of this policy.

If we make material changes to this policy, we will notify you by posting a prominent notice on our website or by sending an email notification. We encourage you to review this Cookie Policy periodically to stay informed about our use of cookies and related technologies.

This Cookie Policy was last updated on July 15, 2026.

13. Contact Us

If you have any questions, concerns, or requests regarding this Cookie Policy or our use of cookies and other tracking technologies, please contact us: