Privacy policy
PRIVACY POLICY
Last Updated: September 2026
1. INTRODUCTION
This Privacy Policy explains how Sugar Browed ("Sugar Browed", "we", "us", or "our") collects, uses, stores, shares, and protects personal information when you visit our website, create an account, purchase products or services, participate in educational programs, access digital content, communicate with us, interact with our social media channels, or otherwise use our services.
This Privacy Policy applies to personal information processed in connection with:
- Our website and online store;
- Customer accounts;
- Physical product purchases;
- Online courses and educational platforms;
- In-person training and educational services;
- Digital products;
- Certifications;
- Customer service and support;
- Email, website chat and other direct communications;
- Social media communications;
- Marketing and advertising;
- Affiliate, referral and ambassador programs;
- Student and community participation;
- Fraud prevention and security;
- Other services offered by Sugar Browed.
Where applicable, we process personal information in accordance with the General Data Protection Regulation ("GDPR"), Spanish data protection law, and other applicable privacy and data protection laws.
2. DATA CONTROLLER
The data controller responsible for the processing described in this Privacy Policy is:
Sugar Browed
Calle Flauta Mágica 11D, Piso 2
29006 Málaga
Spain
NIF: Z3351581A
VAT Number: ESZ3351581A
Email: info@sugarbrowed.com
For privacy-related questions or requests concerning your personal information, please contact:
3. PERSONAL INFORMATION WE COLLECT
The personal information we collect depends on how you interact with Sugar Browed and the services you use.
We may collect the following categories of information.
Identity Information
This may include:
- First name;
- Last name;
- Username;
- Customer or account identifier;
- Account information;
- Customer profile information;
- Business or salon name where relevant.
Contact Information
This may include:
- Email address;
- Telephone number;
- Billing address;
- Shipping address;
- Country or region;
- Communication details provided by you.
Order and Transaction Information
This may include:
- Products or services purchased;
- Order number;
- Order history;
- Purchase dates;
- Transaction records;
- Refund records;
- Return records;
- Shipping and delivery information;
- Tracking information;
- Customs-related information where relevant;
- Discounts or promotions used.
Payment Information
Payments are processed through third-party payment service providers.
Sugar Browed does not normally receive or store complete payment card details.
Depending on the payment method used, payment providers may process information such as:
- Payment method;
- Billing information;
- Transaction identifiers;
- Payment status;
- Fraud-prevention information.
Payment providers process information in accordance with their own applicable privacy notices and legal obligations.
Customer Account Information
Where you create or use a customer account, we may process:
- Login and account information;
- Account activity;
- Purchase history;
- Order information;
- Course enrollments;
- Certifications;
- Account preferences;
- Other information associated with your account.
Educational and Course Information
When you purchase or participate in online courses, training programs, certifications or other educational services, we may process:
- Enrollment records;
- Course access records;
- Date and time access was granted;
- Learning progress;
- Course completion status;
- Quiz or assessment results;
- Certification records;
- Submitted assignments;
- Uploaded materials;
- Student activity records;
- Support requests relating to educational content.
Where our educational platform records digital access, consent or other information relating to the delivery of digital content, those records may be retained where necessary for contract administration, consumer-law compliance, dispute resolution and legal claims.
Customer Service and Communication Information
When you communicate with Sugar Browed, we may process the information contained in those communications.
This may include communications through:
- Email;
- Customer support platforms;
- Website chat;
- Contact forms;
- Instagram;
- Facebook;
- TikTok;
- WhatsApp;
- Other approved communication channels.
Information processed may include:
- Messages;
- Support requests;
- Questions;
- Complaints;
- Order-related communications;
- Attachments;
- Photographs;
- Videos;
- Screenshots;
- Communication history;
- Customer service notes;
- Records of resolutions or agreements;
- Other information you voluntarily provide.
Where a communication relates to an existing customer, we may associate the communication with the relevant customer account, order or support history where reasonably necessary to provide support.
Device and Technical Information
When you use our website or digital services, certain information may be collected automatically, including:
- IP address;
- Browser type;
- Device type;
- Operating system;
- Language settings;
- Time zone;
- Website activity;
- Referring URLs;
- Session information;
- Technical identifiers;
- Cookie or similar technology identifiers.
Marketing and Advertising Information
Where applicable, we may process:
- Newsletter subscriptions;
- Marketing preferences;
- Consent records;
- Advertising interactions;
- Campaign engagement;
- Email engagement;
- Website interactions;
- Shopping behaviour;
- Advertising identifiers;
- Information relating to abandoned carts or checkout activity.
Information You Voluntarily Provide
You may choose to provide additional information when contacting us, participating in a program, submitting content, requesting support or otherwise interacting with Sugar Browed.
Please avoid providing sensitive personal information unless it is necessary for your request.
4. HOW WE COLLECT PERSONAL INFORMATION
We may collect personal information:
- Directly from you;
- When you place an order;
- When you create or use an account;
- When you enroll in a course or training program;
- When you communicate with customer service;
- When you communicate with us through social media;
- Through our website and online store;
- Through cookies and similar technologies;
- Through educational and course platforms;
- Through payment providers;
- Through shipping carriers and logistics providers;
- Through customer service platforms;
- Through marketing and email platforms;
- Through advertising and analytics providers;
- Through affiliate, referral or ambassador programs;
- Through community platforms;
- From service providers assisting us in operating our business;
- Where otherwise permitted by applicable law.
5. LEGAL BASES FOR PROCESSING
Where the GDPR applies, Sugar Browed processes personal information only where an appropriate legal basis exists.
Depending on the circumstances, we may rely on the following legal bases.
Performance of a Contract
We may process personal information where necessary to perform a contract with you or take steps at your request before entering into a contract.
This may include processing necessary to:
- Process orders;
- Process payments;
- Deliver products;
- Arrange shipping;
- Provide customer support;
- Manage returns;
- Provide digital content;
- Provide course access;
- Manage customer accounts;
- Deliver training or educational services;
- Issue certifications;
- Administer other purchased services.
Compliance With Legal Obligations
We may process personal information where necessary to comply with legal obligations, including:
- Tax requirements;
- Accounting requirements;
- Consumer protection laws;
- Product-related legal requirements;
- Regulatory obligations;
- Lawful requests from authorities;
- Record-keeping requirements.
Legitimate Interests
Where permitted by law, we may process information where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms.
These interests may include:
- Providing and improving customer service;
- Improving our products and services;
- Operating and securing our business;
- Preventing fraud;
- Preventing abuse;
- Protecting intellectual property;
- Preventing piracy and unauthorized account sharing;
- Investigating suspicious transactions;
- Enforcing contracts;
- Managing disputes;
- Establishing, exercising or defending legal claims;
- Improving website performance;
- Understanding customer experience;
- Protecting our systems, customers and business.
Consent
Where required, we rely on your consent for processing activities such as:
- Certain marketing communications;
- Newsletter subscriptions;
- Certain cookies and tracking technologies;
- Certain advertising activities;
- Optional promotional activities;
- Other processing for which consent is legally required.
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
6. HOW WE USE PERSONAL INFORMATION
We may use personal information to:
- Process and manage orders;
- Fulfill and deliver shipments;
- Process payments;
- Handle returns and refunds;
- Provide customer service;
- Respond to questions and complaints;
- Maintain customer communication history;
- Deliver digital products;
- Provide course access;
- Operate educational platforms;
- Track course progress;
- Issue certifications;
- Manage customer accounts;
- Administer training programs;
- Provide important service communications;
- Improve our website;
- Improve our products and services;
- Improve customer experience;
- Analyze website and business performance;
- Prevent and investigate fraud;
- Prevent piracy and unauthorized account sharing;
- Protect intellectual property;
- Investigate chargebacks and disputes;
- Enforce our Terms and Policies;
- Establish, exercise or defend legal claims;
- Comply with legal obligations;
- Send marketing communications where permitted;
- Measure and improve advertising effectiveness.
7. CUSTOMER SERVICE AND COMMUNICATION PLATFORMS
Sugar Browed may use third-party customer service and communication platforms to manage customer interactions efficiently.
Where you contact us through email, website chat, social media, messaging services or another customer service channel, your communication and relevant customer information may be processed through such platforms.
This may include linking customer communications with:
- Customer identity information;
- Order information;
- Previous customer service conversations;
- Shipping information;
- Course or account information;
- Other relevant customer records.
We use such information only where reasonably necessary for customer service, contract administration, security, dispute resolution, business operations or another lawful purpose.
Social media platforms and messaging providers may also process information independently under their own privacy policies.
8. FRAUD PREVENTION, SECURITY AND RIGHTS ENFORCEMENT
We may process personal information where necessary for:
- Fraud prevention;
- Chargeback investigations;
- Identity verification;
- Address verification;
- Payment verification;
- Account security;
- Intellectual property protection;
- Copyright enforcement;
- Trademark enforcement;
- Account misuse investigations;
- Piracy investigations;
- Prevention of unauthorized course sharing;
- Dispute resolution;
- Legal claims.
Where necessary, relevant account information, transaction records, communications, access logs, shipping information and other records may be retained for these purposes.
9. CUSTOMER ACCOUNTS
Customer accounts may contain information including:
- Purchase history;
- Order information;
- Educational content access;
- Course progress;
- Certifications;
- Account preferences;
- Learning records.
Sugar Browed may suspend, restrict or terminate accounts where permitted by our Terms of Service and applicable law.
Certain information may continue to be retained after account closure where necessary for:
- Legal compliance;
- Accounting;
- Tax requirements;
- Fraud prevention;
- Security;
- Intellectual property protection;
- Contract enforcement;
- Dispute resolution;
- Establishing, exercising or defending legal claims.
10. COOKIES AND SIMILAR TECHNOLOGIES
Sugar Browed and our service providers may use cookies and similar technologies, including:
- Cookies;
- Pixels;
- Tags;
- Web beacons;
- Analytics technologies;
- Tracking scripts;
- Similar identifiers.
Depending on their purpose, these technologies may be used to:
- Operate our website;
- Remember preferences;
- Maintain website security;
- Provide shopping functionality;
- Improve website performance;
- Understand website usage;
- Measure advertising effectiveness;
- Analyze customer journeys;
- Personalize content where permitted;
- Support marketing and advertising activities.
Where required by applicable law, non-essential cookies and similar technologies are used only after obtaining the required consent.
Users may manage available cookie choices through our cookie consent tools where provided.
11. ANALYTICS, MARKETING AND ADVERTISING
We may use analytics, marketing and advertising services provided by third parties.
Depending on the services enabled, these may include providers and platforms such as:
- Shopify;
- Google;
- Meta, including Facebook and Instagram;
- TikTok;
- Pinterest;
- Email marketing platforms;
- Analytics providers;
- Advertising platforms;
- Other marketing technology providers used by Sugar Browed.
These services may process information concerning interactions with our website, emails, advertisements or other digital services.
Some providers may act as processors on our behalf, while others may process certain information as independent controllers or under other roles determined by applicable data protection law.
Their processing may also be governed by their respective privacy policies.
12. EMAIL MARKETING AND SERVICE COMMUNICATIONS
Where permitted by applicable law, Sugar Browed may send communications including:
- Newsletters;
- Product announcements;
- Educational content;
- Promotional offers;
- Cart or checkout reminders;
- Campaign communications;
- Other marketing communications.
Where required, marketing communications are sent on the basis of consent or another lawful basis permitted by applicable law.
You may unsubscribe from marketing emails using the unsubscribe mechanism provided in the communication.
Unsubscribing from marketing does not prevent Sugar Browed from sending necessary non-marketing communications, including communications relating to:
- Orders;
- Payments;
- Shipping;
- Customer service;
- Account security;
- Course access;
- Legal or policy notices where appropriate.
13. AFFILIATES, REFERRALS, AMBASSADORS AND COMMUNITIES
Sugar Browed may operate or participate in:
- Affiliate programs;
- Referral programs;
- Ambassador programs;
- Partnership programs;
- Membership communities;
- Student communities;
- Social media groups;
- Professional or educational communities.
Participation may require us to process personal information necessary to administer the applicable program, communicate with participants, track participation, calculate benefits or commissions where applicable, prevent abuse and manage the relationship.
Additional terms or privacy information may apply to particular programs.
14. ARTIFICIAL INTELLIGENCE AND AUTOMATED TOOLS
Sugar Browed may use artificial intelligence, AI-assisted technologies, automation and other digital tools to support business operations.
These technologies may assist with activities including:
- Customer service;
- Drafting or translating customer communications;
- Categorizing or routing customer inquiries;
- Retrieving relevant business or customer information;
- Summarizing customer service history;
- Supporting internal decision-making;
- Marketing;
- Content development;
- Data analysis;
- Fraud detection;
- Operational efficiency.
Where customer or other personal information is processed using AI-assisted or automated tools, Sugar Browed seeks to use appropriate technical, organizational and contractual safeguards in accordance with applicable law.
AI-assisted tools may support Sugar Browed personnel but do not remove our responsibility for processing personal information lawfully.
Where required by applicable law, Sugar Browed will not make decisions based solely on automated processing that produce legal effects or similarly significantly affect an individual without an appropriate lawful basis and required safeguards.
15. SHOPIFY AND SHOPIFY SERVICES
Our online store is operated using Shopify.
Shopify may process personal information necessary to provide ecommerce, payment, security, fraud prevention, analytics, personalization and related platform services.
Where Shopify Network Intelligence or related Shopify functionality is enabled, Shopify may process certain customer information in connection with those services in accordance with its applicable privacy documentation and legal obligations.
Depending on the processing activity, Shopify may act in different data protection roles.
Information processed independently by Shopify is subject to Shopify's applicable privacy terms and notices.
16. SHARING PERSONAL INFORMATION
We may share personal information with service providers and other recipients where reasonably necessary to operate Sugar Browed, provide our services or comply with legal obligations.
Recipients may include:
- Shopify and ecommerce service providers;
- Payment processors;
- Payment service providers;
- Shipping carriers;
- Logistics providers;
- Fulfillment providers;
- Educational and course platform providers;
- Customer service platforms;
- Email service providers;
- Communication platforms;
- Cloud and technology providers;
- Analytics providers;
- Marketing and advertising providers;
- Affiliate and referral software providers;
- Community platform providers;
- Fraud prevention and security providers;
- Accountants;
- Legal advisers;
- Other professional advisers;
- Government, regulatory, judicial or law-enforcement authorities where legally required.
We seek to limit sharing to information reasonably necessary for the relevant purpose.
We do not sell personal information for monetary consideration.
Certain advertising or platform activities may nevertheless be treated as "sale", "sharing" or targeted advertising under the laws of some jurisdictions. Where such laws apply, we provide any rights or choices required by applicable law.
17. INTERNATIONAL DATA TRANSFERS
Sugar Browed is based in Spain and operates internationally.
Personal information may therefore be processed in Spain, other countries within the European Economic Area, or other jurisdictions where our service providers operate.
These jurisdictions may include, depending on the services in use:
- Spain;
- Other European Economic Area countries;
- Serbia;
- United Kingdom;
- United States;
- Other countries in which our service providers or their subprocessors operate.
The inclusion of a country in this section does not necessarily mean that all customer information is routinely transferred to that country.
For example, certain historical or logistics-related information may remain processed by service providers connected with previous or temporarily inactive fulfillment operations.
Where personal information is transferred outside the European Economic Area and applicable law requires transfer safeguards, we use or rely on appropriate lawful mechanisms, which may include:
- An adequacy decision;
- Standard Contractual Clauses;
- Other approved contractual safeguards;
- Other transfer mechanisms permitted by applicable data protection law.
Where required, supplementary safeguards may also be implemented.
18. DATA RETENTION
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and as required or permitted by applicable law.
The appropriate retention period depends on factors including:
- The nature of the information;
- The purpose for which it is processed;
- Contractual requirements;
- Tax and accounting requirements;
- Consumer protection obligations;
- Fraud prevention;
- Security requirements;
- Intellectual property protection;
- Dispute resolution;
- Applicable limitation periods;
- Establishing, exercising or defending legal claims.
Order, transaction and invoice information may be retained for periods required under applicable Spanish tax, accounting and commercial law.
Customer service records may be retained for as long as reasonably necessary to manage the customer relationship, resolve disputes, maintain appropriate records and protect legal rights.
Course, certification and educational records may be retained where necessary to document enrollment, completion, certification, contractual performance or other legitimate educational records.
Marketing information may generally be retained until consent is withdrawn, an objection is made where applicable, or the information is no longer required for the relevant purpose.
Where information is no longer required, it may be deleted, anonymized or securely retained where continued storage is required by law.
19. DATA SECURITY
Sugar Browed implements reasonable technical, organizational and administrative measures designed to protect personal information against:
- Unauthorized access;
- Unauthorized disclosure;
- Accidental loss;
- Alteration;
- Misuse;
- Destruction;
- Other unlawful processing.
Access to personal information should be limited to persons and service providers who require access for legitimate business purposes.
However, no method of electronic transmission or storage can be guaranteed to be completely secure.
20. YOUR PRIVACY RIGHTS
Depending on your location and applicable law, you may have rights regarding your personal information.
Under the GDPR, these may include the right to:
- Request access to your personal information;
- Request correction of inaccurate personal information;
- Request deletion of personal information in applicable circumstances;
- Request restriction of processing;
- Object to certain processing;
- Request data portability where applicable;
- Withdraw consent where processing is based on consent;
- Lodge a complaint with a competent supervisory authority.
The existence and scope of a particular right depends on the circumstances and the legal basis for processing.
For example, the right to deletion does not require Sugar Browed to delete information that we are legally required or otherwise lawfully entitled to retain.
To exercise a privacy right, contact:
Please provide sufficient information for us to understand and process your request.
We may request reasonable verification of identity before fulfilling a request where necessary to protect personal information.
We will respond within the time periods required by applicable law.
21. MARKETING AND COOKIE CHOICES
You may withdraw marketing consent or unsubscribe from email marketing at any time using the unsubscribe option contained in marketing communications.
Where available, cookie preferences can be managed through our cookie consent mechanism.
Withdrawal of consent does not affect processing that was lawfully carried out before withdrawal.
Certain cookies or processing activities that are strictly necessary to provide a service requested by you may not require consent where permitted by applicable law.
22. CHILDREN
Sugar Browed's products, professional educational services and business services are not intentionally directed toward young children.
We do not knowingly seek to collect personal information from children in circumstances where parental or guardian authorization is legally required and has not been obtained.
Where age restrictions apply to a particular service, course, certification or program, additional eligibility requirements may apply under our Terms of Service or specific program terms.
If you believe that personal information relating to a child has been provided to us inappropriately, please contact:
23. THIRD-PARTY WEBSITES AND SERVICES
Our website or communications may contain links to third-party websites, platforms or services.
Sugar Browed is not responsible for the privacy practices of independent third parties.
We encourage users to review the privacy information provided by third parties before providing personal information directly to them.
24. DATA PROTECTION COMPLAINTS
If you have a concern about how Sugar Browed processes your personal information, you may first contact us at:
You also have the right, where applicable, to lodge a complaint with the competent data protection supervisory authority.
For Sugar Browed's establishment in Spain, the relevant supervisory authority is:
Agencia Española de Protección de Datos (AEPD)
If you live elsewhere in the European Economic Area, you may also have the right to contact the supervisory authority responsible for data protection in your country.
25. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect:
- Changes to our services;
- Changes to our business operations;
- Changes to service providers or technologies;
- Changes to our data processing activities;
- Legal or regulatory developments;
- Security or operational requirements.
When this Privacy Policy is updated, the revised version will be published on our website and the "Last Updated" date will be changed.
Where required by applicable law, we will provide additional notice or obtain consent before materially changing a processing activity that requires such notice or consent.
Previous consent is not automatically extended to new processing purposes where a new legal basis or new consent is required.
26. CONTACT INFORMATION
For questions regarding this Privacy Policy, requests concerning your personal information, or the exercise of privacy rights, please contact:
Sugar Browed
Calle Flauta Mágica 11D, Piso 2
29006 Málaga
Spain
NIF: Z3351581A
VAT Number: ESZ3351581A
Email: info@sugarbrowed.com