Version 1.0 — Last updated: 9 February 2026
| Controller | GFA Group S.L. |
| Tax ID (CIF) | B67870154 |
| Registered office | Calle Fuencarral 74, 28004 Madrid, Spain |
| Contact email | info@yuxus.es |
| Main activity | Promotion and sale of clothing and accessories |
GFA Group S.L. was incorporated by deed dated 23 November 2021, before the Notary Public of Madrid, Juan Aznar de la Haza, under number 765 of his protocol.
Below we set out the purposes, legal bases, retention periods and other details for the data processing activities we carry out through this website:
| Purpose | Legal basis | Data type | Retention period |
|---|---|---|---|
| Website functionality and management | Consent (Art. 6(1)(a) GDPR) | Identifying data | Until withdrawal of consent |
| Responding to queries and requests | Consent (Art. 6(1)(a) GDPR) | Identifying data | Until withdrawal of consent |
| Managing purchases and contract performance | Performance of contract (Art. 6(1)(b) GDPR) | Identifying data, payment data | Duration of purchase management, including returns and claims |
| Newsletter and commercial communications | Consent (Art. 6(1)(a) GDPR) | Identifying data | Until withdrawal of consent |
| SMS promotional communications | Consent (Art. 6(1)(a) GDPR + Art. 21 LSSI-CE) | Phone number | Until withdrawal of consent |
| Administrative management, invoicing, accounting | Legal obligation (Art. 6(1)(c) GDPR) | Identifying data, financial data | 5 years (tax law) / 10 years (Basic Law 7/2012) |
| Legal and regulatory compliance | Legal obligation (Art. 6(1)(c) GDPR) | Identifying data | Until statute of limitations expires |
By completing a purchase and clicking "I accept the terms of service", you consent to the use of your phone number for promotional SMS. You may unsubscribe at any time.
If you join YUXUS Rewards, we process additional data specifically for the operation of the programme:
| Data collected | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, surname, email | Management of your YUXUS Rewards account | Performance of contract (Art. 6(1)(b) GDPR) | Duration of membership + 3 years |
| Purchase history | Point calculation (3 points/€) and tier management | Performance of contract (Art. 6(1)(b) GDPR) | Duration of membership + 6 years (tax obligation) |
| Point balance, tier, coupons | Operation of the rewards programme | Performance of contract (Art. 6(1)(b) GDPR) | Duration of membership |
| Website visit activity | Point accumulation for daily visits | Consent (Art. 6(1)(a) GDPR) | 24 months (rolling) |
| Social sharing data | Point accumulation for social media sharing | Consent (Art. 6(1)(a) GDPR) | Duration of membership |
| Referral data | Referral programme management | Performance of contract (referrer) / Consent (referred person) | Duration of membership |
| Email (commercial communications) | Promotions, offers and news from YUXUS | Express consent (Art. 6(1)(a) GDPR + Art. 21 LSSI-CE) | Until consent is withdrawn |
| Email interaction data | Improvement of communications | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Year of birth | Minimum age verification (14 years) | Legal obligation (Art. 7 LOPDGDD) | Duration of membership |
We apply the principle of data minimisation (Art. 5(1)(c) GDPR). We only collect data strictly necessary for each purpose. Specifically, we do not collect your full date of birth (only the year to verify age), nor detailed web browsing data (only the fact of the visit, not the pages visited), nor data from your social media profiles (only the fact that you have shared content).
To operate our website, process purchases and run the YUXUS Rewards programme, we share your data with the following data processors, with whom we have signed data processing agreements in accordance with Article 28 of the GDPR:
| Provider | Function | Location | Transfer mechanism |
|---|---|---|---|
| Shopify International Limited | E-commerce platform (store, orders, customer accounts) | Ireland (EEA) / Canada | EU-Canada adequacy decision + Standard Contractual Clauses |
| Klaviyo, Inc. | Email and SMS marketing platform | United States | EU-US Data Privacy Framework + Standard Contractual Clauses |
| Vercel, Inc. | Backend technology infrastructure (YUXUS Rewards API) | United States | EU-US Data Privacy Framework + Standard Contractual Clauses |
| Klarna Bank AB | Payment services (buy now, pay later) | Sweden (EEA) | No international transfer (EEA) |
These providers only process your data following our documented instructions and do not use it for their own purposes. Additionally, where required by law, your data may be disclosed to the Tax Authority, banks, and public bodies with jurisdiction.
For Klarna payments, at checkout we may transmit your contact information and order details so Klarna can assess eligibility for its payment methods. Your data is processed in accordance with Klarna's privacy policy.
You may request a copy of the appropriate transfer safeguards by contacting us at info@yuxus.es.
Your data is transferred to the United States and Canada through our technology providers. These transfers are protected by European Commission adequacy decisions (EU-US Data Privacy Framework, Decision 2023/1795, and Canada adequacy decision) and, as an additional mechanism, by Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914).
We have carried out Transfer Impact Assessments to verify that your data is protected at a level equivalent to that of the GDPR.
As a data subject, you may exercise the following rights:
Access
Obtain information about your specific personal data and the processing that has been or is being carried out, including the source of the data and disclosures made or planned.
Rectification
Correct inaccurate or incomplete data. This can only apply to information under our control (e.g. comments published on our page, images or content containing your personal data).
Erasure ("right to be forgotten")
Request the deletion of your data when it is no longer necessary, you withdraw consent or you object to processing. Some data may be retained due to legal obligations (e.g. billing data for 6 years).
Restriction of processing
Request that we restrict the use of your data in certain circumstances, limiting the purposes originally intended by the controller.
Data portability
Receive your data in a structured, commonly used and machine-readable format (CSV/JSON), and transmit it to another controller.
Objection
Object to the processing of your data, especially for direct marketing purposes, which will cease immediately.
Withdrawal of consent
You may withdraw your consent at any time, as easily as you gave it, without affecting the lawfulness of prior processing.
To exercise any of these rights, send a request to info@yuxus.es or by post to Calle Fuencarral 74, 28004 Madrid, Spain (for the attention of GFA Group S.L.), attaching a copy of your national ID or equivalent identification document. We will respond within a maximum of 1 month from receipt of the request.
If you believe your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan 6, 28001 Madrid — www.aepd.es
YUXUS Rewards uses automated processes to assign your membership tier (Initiate, Explorer, Climber, Summit, Refuge) based on accumulated points, and to activate the benefit freeze after 12 months of purchase inactivity. These decisions are based exclusively on objective and predefined criteria set out in the Programme's Terms and Conditions.
No other automated decisions with legal or significant effects are made based on your data. You have the right to obtain human intervention, express your point of view and contest these decisions by contacting info@yuxus.es.
If you are between 14 and 17 years old, you may register for YUXUS Rewards on your own. We have written this Privacy Policy in clear language so that you can understand how we use your data. If you are under 14, you cannot register for the Programme. If we become aware that a person under 14 has registered without parental or guardian consent, we will immediately delete their data.
The tracking of daily website visits for point accumulation requires the use of cookies or similar technologies. This tracking is subject to your prior consent through our cookie banner, in accordance with Article 22.2 of the LSSI-CE. You can consult our full Cookie Policy at Cookie Policy.
We apply appropriate technical and organisational measures to protect your data, matched to the level of risk entailed by the processing, including encryption in transit (HTTPS/TLS) and at rest (AES-256), role-based access controls, encrypted backups, and periodic security audits. These measures are designed to guarantee the completeness, confidentiality and availability of your data.
| Data category | Retention period | Justification |
|---|---|---|
| General customer data | Until withdrawal of consent or end of relationship | Active purpose |
| Rewards member profile data | Duration of membership + 3 years | Active purpose + limitation period |
| Purchase history | Duration of relationship + 6 years | Spanish tax obligation (Commercial Code Art. 30) |
| Point balance and tier data | Duration of membership | Loses purpose upon membership end |
| Website visit tracking data | 12-24 months (rolling) | Proportionate to accumulation mechanism |
| Marketing consent records | Duration of consent + 5 years | To demonstrate compliance |
| Referral data | Duration of membership | Linked to earned points |
| Inactive member data | 24 months after last activity, then anonymise or delete | GDPR best practice |
| Coupon redemption records | 5-6 years | Tax/accounting obligations |
| Tax and accounting documentation | 5 years (tax law) / 10 years (Basic Law 7/2012) | Legal obligation |
In accordance with applicable data protection regulations and Law 34/2002 of 11 July (LSSI-CE), GFA Group S.L. has profiles on Instagram and TikTok for the purpose of advertising products and services.
By joining our pages on social networks, you authorise the processing of personal information published on your public profile. This information is only used within the social network and is not added to any separate file.
You may access the privacy policies of each social network and configure your profile to guarantee your privacy at any time. You may exercise all your data protection rights as described in section 7 above.
Users may post comments, links, images, photographs or any other multimedia content on our pages. Users must hold ownership or have the necessary rights. Content violating morality, ethics, intellectual or industrial property rights, image rights or applicable law will be removed, and the user may be permanently blocked.
GFA Group S.L. is not responsible for content freely published by users. Images posted on our social pages are not stored in any separate file by GFA Group S.L. but remain on the social network.
GFA Group S.L. reserves the right to organise contests and promotions. Terms and conditions will be published on the social network, in compliance with LSSI-CE and applicable regulations. The social network does not sponsor, support or administer our promotions.
GFA Group S.L. uses social networks to advertise products and services. Any direct commercial communications will comply with GDPR and LSSI-CE requirements. Recommending our page to others is not considered advertising.
Social network privacy policies:
We may update this Privacy Policy to reflect changes in our data practices or applicable legislation. Any significant changes will be communicated by email and published on this page. The "last updated" date at the top indicates when the latest revision was made.
