Privacy Policy

Your privacy is important to us. This Privacy Policy explains how Oneight (NAPI PARTNERS SL) collects, uses, and protects your personal information when you use our Shopify store and services. We are committed to handling your data in compliance with the General Data Protection Regulation (GDPR) and Spanish data protection laws. By using our site, you agree to the collection and use of information in accordance with this policy.

Information We Collect and How We Use It

When you visit or make a purchase from Oneight, we may collect the following personal information for the purposes explained:

• Contact and Identity Information: When you place an order or sign up on our site, we collect information such as your name, billing and shipping address, phone number, and email address. We use this information to process and fulfill your orders, to communicate with you about your purchase (order confirmations, invoices, shipping updates), and to provide customer support if needed. We require this data to perform our contract with you (fulfilling your purchase).

• Email Address for Newsletter: By making a purchase or providing your email, you will be automatically subscribed to our newsletter. This means we may use your email to send you news, promotions, or updates about our products (e.g. matcha and coffee tips, special offers). We add you to our mailing list as part of our service to keep customers informed. However, you can opt out at any time (see “Marketing Communications” below). We will not send you marketing emails if you have unsubscribed. Our basis for sending you the newsletter is either your consent (if you explicitly subscribed) or our legitimate interest in maintaining communication with our customers about similar products, as permitted by law.

• Payment Information: When you make a purchase, your payment details (such as credit card number or PayPal information) are processed securely by our payment processor. We do not store your full payment card details on our servers. We only retain transaction identifiers or partial information necessary for record-keeping. Payment information is used solely to charge for your order and to prevent fraud.

• Automatically Collected Data: When you browse our store, we automatically receive certain information about your device and usage via cookies or similar technologies. This may include your IP address, browser type, device information, and browsing actions on our site. We use this data to analyze site traffic, improve our website performance, and personalize your experience (for example, remembering items in your cart). For details, see our Cookies Policy (if applicable). You can manage cookie preferences through your browser settings.

We will not collect any sensitive personal data about you (such as racial or ethnic origin, political opinions, health information, etc.) as part of our routine operations. Our goal is to collect only the data needed to serve you and improve our services.

Marketing Communications and Newsletter

As noted, when you provide us with your email (for example, during checkout or account creation), we may use it to send you our newsletter and promotional emails. Here are our practices regarding marketing communications:

• Automatic Subscription: By default, customers providing an email address are subscribed to Oneight’s newsletter. We may send you occasional emails about new products, recipes, blog posts, special offers, or other updates related to our matcha and coffee products.

• Opt-Out Anytime: If you prefer not to receive these emails, you have the right to unsubscribe at any time. Each marketing email from us will include an “Unsubscribe” link at the bottom. Simply click that link to stop receiving future newsletters. You may also opt-out by contacting us at privacy@oneight.com or support@oneight.com with your request, and we will remove you from the mailing list.

• No Third-Party Marketing: We will not share or sell your email address or personal information to third parties for their marketing purposes. Your email is used exclusively by Oneight to communicate with you. We respect your inbox and will limit our communications to relevant updates.

• Consent for New Subscribers: If you are not an existing customer and you sign up for our newsletter (e.g., by entering your email in a sign-up form), we will only send you emails if you have given explicit consent (for example, by ticking a sign-up box). We adhere to GDPR requirements for obtaining consent for marketing when required.

Data Sharing and Disclosure

We treat your personal data with care and do not disclose it to outside parties except in the following circumstances:

• Service Providers: We share necessary information with trusted third-party service providers who help us run our business. This includes Shopify (which hosts our online store platform), payment processors (for processing payments securely), and shipping/carrier companies (such as Correos, DHL, UPS, or other couriers that deliver your orders) to fulfill the delivery. These providers will receive only the information needed to perform their functions (for example, the courier gets your name and address for delivery). They are contractually obligated to protect your data and use it only for the purposes of providing services to Oneight.

• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., to comply with a court order, tax law obligations, or an investigation of fraud or other wrongdoing).

• Business Transfers: In the unlikely event that NAPI PARTNERS SL (Oneight) is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. If such a change occurs, we will ensure your data remains protected and inform you of any significant changes to how your data is used.

• With Your Consent: Apart from the above, we will not share your personal information with any third party without your consent. We do not sell, rent, or trade your personal data to third parties for their own marketing or other purposes.

Rest assured, we do not share your email or other personal details with advertisers or unrelated parties. Any third parties we engage (e.g. our email service provider for sending newsletters) are also GDPR-compliant and will not use your data for anything other than the specific service we’ve hired them to provide.

Data Retention

We will retain your personal information for as long as necessary to fulfill the purposes we collected it for, including any legal, accounting, or reporting requirements. For example:

• Order Information: We keep information about your purchases (like order records, invoices, and your contact/shipping details) for at least the duration required by Spanish tax and commerce laws (usually 4 to 6 years for fiscal records). This is also useful for us to provide customer service (e.g., processing returns or warranty claims) and to maintain records of transactions.

• Newsletter Data: If you are on our mailing list, we will retain your email address for as long as you remain subscribed. If you unsubscribe, we will remove you from the mailing list promptly and not send further marketing emails. (We may keep a record of your opt-out request to ensure we respect your choice going forward.)

• Browsing Data: Anonymous analytics data collected via cookies may be retained for our internal analysis. You can clear cookies from your browser to remove such data on your side. We generally do not link browsing data to identifiable personal information in our systems.

• Account Data: If you create an account on our site, we will retain your account information while your account is active. You can contact us to delete your account, in which case we will remove or anonymize personal data associated with your account, except for information we are required to keep by law or legitimate interests (e.g., past order records).

When we no longer have a lawful reason or business need to keep your personal data, we will securely delete or anonymize it.

Your Rights under GDPR

As a user of our store and as a customer, you have certain rights regarding your personal data. Oneight respects and upholds these rights, as provided by the GDPR and Spanish data protection regulations. Your rights includetermsfeed.com:

• Right of Access: You have the right to request a copy of the personal data we hold about you and to obtain information about how we process it. We will provide you with a copy of your data in a commonly used format, free of charge (unless the request is excessive or repetitive).

• Right to Rectification: If any personal information we have about you is incorrect or incomplete, you have the right to have it corrected or updated without undue delay. For example, you can ask us to update your address or correct a misspelled name.

• Right to Erasure: You can request that we delete your personal data in certain circumstances (this is also known as the “right to be forgotten”). For instance, if the data is no longer necessary for the purposes it was collected, or if you withdraw consent and we have no other legal basis to continue processing it, we will erase your data upon request. Please note we may not be able to delete information that we are required to retain by law (e.g., purchase records for tax purposes) but we will inform you if that is the case.

• Right to Restrict Processing: You have the right to ask us to suspend the processing of your personal data in certain scenarios – for example, if you contest the accuracy of the data or object to our processing, we will restrict processing while we review your request.

• Right to Data Portability: You are entitled to request a copy of certain data in a machine-readable format (e.g., a CSV file) which you can transfer to another service provider. This typically applies to data you provided to us and that we process by automated means based on your consent or on a contract (such as your order details).

• Right to Object: You have the right to object to our processing of your personal information in some cases. Notably, you can object at any time to the use of your data for direct marketing purposes. If you object, we will stop processing your data for that purpose immediatelytermsfeed.com. You can also object if we are processing your data based on legitimate interests or for statistical purposes, and there is something about your particular situation which makes you want to object.

• Right to Withdraw Consent: If we are processing any of your personal data based on your consent, you have the right to withdraw that consent at any time. For example, if you consented to receive newsletters, you can withdraw consent by unsubscribing. Withdrawal of consent does not affect the lawfulness of processing done before withdrawal.

• Right to Lodge a Complaint: If you believe we have infringed your data protection rights, you have the right to file a complaint with a supervisory authority. Oneight is based in Spain, so our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD). You can contact the AEPD (www.aepd.es) for more information or to lodge a complaint. We encourage you to contact us first, so we can address your concerns directly.

To exercise any of these rights, please contact us using the contact details provided below. We may need to verify your identity (to ensure we don’t disclose data to the wrong person) and we will respond to your request within the legally required timeframes (generally within 1 month, extendable by an additional 2 months if necessary, and we will inform you if an extension is needed).

Data Security

We take appropriate technical and organizational measures to secure your personal data and protect it against unauthorized access, alteration, disclosure, or destruction. Our store uses secure HTTPS encryption for all pages and transactions, which means data (like your payment information and personal details) is encrypted when transmitted between your browser and our site. We store personal information on secure servers and limit access to those employees and service providers who need to process it.

Examples of our security practices:

• We use up-to-date security software and firewall protection on our website platform (Shopify provides a secure infrastructure).

• Payment transactions are handled through PCI-DSS compliant payment gateways, ensuring your credit card data is handled with industry-standard security.

• We regularly update our systems and train our staff on data protection best practices.

• In the unlikely event of a data breach that affects your personal data, we will notify you and the relevant authorities as required by GDPR.

Please note that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. You share information with us at your own risk, but be assured we are using commercially acceptable means to protect your data.

International Data Transfers

Our store operates on the Shopify platform, which may host data on servers outside of Spain (for example, in the United States or Canada). Additionally, some of our service providers might be located in other countries. Whenever your personal data is transferred outside the European Economic Area (EEA), we will ensure that adequate safeguards are in place. This may include using European Commission approved Standard Contractual Clauses or relying on providers certified under the EU-US/Data Privacy Framework (if applicable) or other valid transfer mechanisms to ensure your data receives a level of protection equivalent to that provided in Europe.

By using our services, you acknowledge that your data may be processed outside your country of residence, including in countries that may have different data protection laws. However, our practices will remain governed by this Privacy Policy and the GDPR standards, regardless of where data is stored or processed.

Minors

Our website and services are not directed to children, and we do not knowingly collect personal information from individuals under the age of 14. (Under Spanish law, 14 is the minimum age for valid consent to data processing, and we do not target or allow registrations for younger minors.) If you are under 14, please do not provide any personal information on this site. Parents or guardians should supervise children’s online activities. If we learn that we have inadvertently collected personal data from a child under 14, we will take steps to delete such information promptly. If you are a parent or guardian and believe your child under 14 may have provided personal information to us, please contact us so we can remove it.

Contact Information

Data Controller: NAPI PARTNERS SL (trading as Oneight) is the data controller responsible for your personal information. Our registered address is Calle Portugal 3, Pozuelo de Alarcón, 28224, Spain.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

• Email: info@oneight.com or info@oneight.com

• Postal Mail: NAPI PARTNERS SL (Oneight) – Privacy Inquiry, Calle Portugal 3, Pozuelo de Alarcón, 28224, Madrid, Spain

• Phone: [Insert contact phone number if available]

We will be happy to assist you.

By using our site, you acknowledge that you have read and understand this Privacy Policy. We may update this policy from time to time (for example, to reflect changes in our practices or for legal reasons). We will notify you of any significant changes by updating the date at the top of the policy and/or via a notice on our website. Please review this page periodically for the latest information on our privacy practices.

(Last Updated: April 2025)