Privacy policy

Last updated: 7 May 2026

This Privacy Policy explains how Daniel Fernández Noáin, trading as Oneforon, collects, uses, stores, and protects personal information when you visit oneforon.com or purchase one of our products. We have prepared this policy to comply fully with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

The data controller responsible for the processing of your personal information is Daniel Fernández Noáin, an individual entrepreneur registered in Spain under NIF 53873891W, with registered address at Carrer del Plom 8, Barcelona, Spain. The trade name under which we operate is Oneforon.

For any matter related to the processing of your personal data — including the exercise of your rights under EU law — you can reach us by email at focus@oneforon.com or by phone at +34 681 118 066. We aim to respond within two business days.

When you place an order, create an account, or contact our customer service, we collect the personal information you submit, including your full name, billing and shipping address, email address, and phone number. If you sign up for our newsletter, we collect your email address and any preferences you indicate.

When you browse oneforon.com, our systems and our service providers automatically collect technical information about your device and visit. This includes your internet protocol (IP) address, browser type and version, operating system, the pages you view, the time and duration of your visit, and the pages that referred you to us. This information is essential to the operation of the website and to detecting fraudulent activity.

When you complete a purchase, we record the products you bought, the amount paid, the payment method used, and the delivery details. The full details of your payment card are never stored on our servers; they are handled exclusively by our payment processors under PCI-DSS standards.

If you arrive at oneforon.com through one of our paid advertisements, our advertising partners may share information with us about that interaction, such as the campaign that referred you. Similarly, our analytics tools provide aggregated information about how users navigate the site.

We use your contact, billing, and shipping information to confirm and process your order, deliver the product, manage returns, and provide customer support. The legal basis for this processing is the performance of the contract you enter into when you place an order, under Article 6(1)(b) of the GDPR.

Spanish commercial and tax law requires us to retain certain transaction records and respond to lawful requests from public authorities. The legal basis for this processing is compliance with our legal obligations, under Article 6(1)(c) of the GDPR.

If you subscribe to our newsletter or consent to receive marketing communications at checkout, we use your email address to send you information about new products, offers, and brand content. The legal basis for this processing is your consent, under Article 6(1)(a) of the GDPR. You can withdraw your consent at any time by clicking the unsubscribe link in any of our emails or by contacting us directly.

We use technical and behavioural data to understand how customers interact with our website, identify problems, measure the performance of our advertising, and improve the products and content we offer. The legal basis for this processing is our legitimate interest in operating and improving our business, under Article 6(1)(f) of the GDPR.

To deliver our service, we share personal data with carefully selected providers acting as data processors on our behalf. These include Shopify Inc., which provides the e-commerce platform that powers oneforon.com; the payment processors displayed at checkout, who handle card and alternative payment transactions; and the shipping carriers responsible for delivering your order.

We use Meta Platforms Ireland Ltd. for advertising and conversion measurement on Facebook and Instagram. With your consent, our website transmits limited information about your visit and purchases to Meta to help us measure the effectiveness of our advertising and to display relevant ads to you and similar audiences.

Where we are required by law, court order, or a lawful request from a competent public authority, we may disclose personal data to tax authorities, law enforcement bodies, or other regulators. We only disclose what is strictly necessary to comply with the request.

Some of our processors are based outside the European Economic Area, particularly in the United States. When personal data is transferred outside the EEA, we rely on the appropriate safeguards required by the GDPR. These include the EU-US Data Privacy Framework certification of our processors, where available, and the Standard Contractual Clauses approved by the European Commission. Where neither applies, we rely on a derogation permitted by Article 49 of the GDPR.

We retain customer and order records for six years after the last transaction in order to comply with the Spanish Commercial Code (Article 30) and the General Tax Law, both of which require retention of accounting records.

We retain marketing data — including your email subscription, preferences, and engagement history — for as long as you remain subscribed. When you unsubscribe, we promptly remove your address from our active marketing list and retain only what is necessary to demonstrate compliance with your withdrawal of consent.

Server logs, browser fingerprints, and aggregated analytics are retained for up to twenty-four months, after which they are anonymised or deleted.

Under EU and Spanish law, you have the right to access the personal data we hold about you, to request correction of inaccurate data, to request deletion of your data where the law allows, to restrict or object to certain types of processing, to receive your data in a portable format, and to withdraw any consent you have given. You also have the right to file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es. To exercise any of these rights, contact us at focus@oneforon.com with a request and a copy of an identifying document; we will respond within thirty calendar days.

We apply technical and organisational measures appropriate to the nature of the data we process and the risks associated with that processing. These include encryption in transit, restricted access to personal data on a need-to-know basis, regular security review of our service providers, and ongoing training. No system is perfectly secure; if a personal data breach occurs and is likely to result in a risk to your rights, we will notify you and the AEPD as required by Articles 33 and 34 of the GDPR.

oneforon.com uses cookies and similar technologies to operate the site, remember your preferences, measure performance, and personalise advertising. On your first visit you will see a cookie banner allowing you to accept, reject, or customise non-essential cookies. Essential cookies — those strictly necessary for the website and checkout to function — do not require your consent. You can change your cookie preferences at any time through the cookie banner.

We may update this Privacy Policy from time to time to reflect changes in the law, our practices, or the services we offer. The most recent version will always be available on this page, with the "Last updated" date at the top. Where the change is material, we will notify subscribed customers by email.