Privacy policy
Last updated: 25 September 2026
1. Data controller
SUGAAR LABS, S.L., Tax ID B95016044, with registered office at Calle Paduleta 55, office 209, 01015 Vitoria-Gasteiz (Álava, Spain), email shoesecondlife@gmail.com (hereinafter, THE CONTROLLER), provides the following information, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, GDPR) and Spanish Organic Law 3/2018 of 5 December (hereinafter, LOPDGDD), about the processing of personal data on shoesecondlife.com.
2. Data processed
THE WEBSITE has no forms, user accounts or shop. No name, email or payment details are requested. The only data processed are the technical data generated by browsing:
- IP address, browser and device type, pages visited, date and time of access, recorded in server logs.
- Aggregated visit statistics obtained through Cloudflare Web Analytics, which does not use cookies or identify THE USER.
- The language preference, stored in a technical cookie (see the Cookie policy).
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service and showing THE WEBSITE in the chosen language | Legitimate interest in running the website (art. 6.1.f GDPR) |
| Ensuring security and preventing abuse (request limits, protection against attacks) | Legitimate interest (art. 6.1.f GDPR) |
| Understanding use of the website in an aggregated, anonymous way to improve it | Legitimate interest (art. 6.1.f GDPR) |
No automated decisions are made and no profiles are created.
4. Recipients and processors
No data are disclosed to third parties unless required by law. The infrastructure providers have access to technical data as processors, with the safeguards of article 28 GDPR:
- Microsoft Ireland Operations Ltd. (Microsoft Azure), hosting THE WEBSITE and the photos in European Union data centres (North Europe region).
- Cloudflare, Inc., DNS, security and cookie-free analytics.
When THE USER clicks "Buy on Vinted", they leave THE WEBSITE. The processing of their data on Vinted is the responsibility of Vinted UAB under its own privacy policy.
5. International transfers
Cloudflare, Inc. may process data in the United States. These transfers are covered by the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission.
6. Retention
Server logs are kept for a maximum of 30 days and then deleted, unless they are needed to meet a legal obligation or investigate a security incident. The language cookie is kept for one year.
7. Rights
THE USER may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability by writing to shoesecondlife@gmail.com or to the postal address of THE CONTROLLER, stating the right being exercised. THE USER may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of their country.
8. Changes
THE CONTROLLER may update this policy to reflect changes in the law or in the service. The current version is always the one published on THE WEBSITE, with its update date.
The Spanish version of this text prevails.