PRIVACY POLICY

1. Who is responsible for your personal data?

  • Data controller: LAB NOMA S.L.

  • Trade name: The Today Project

  • NIF: B16696072

  • Registered office: Av. Via Augusta 15–25, Parc Empresarial @Sant Cugat, 08174 Sant Cugat del Vallès, Barcelona, Spain

  • General email: noma@labnoma.com

  • WhatsApp customer service: +34 951 328 485

  • Data Protection Officer: PYMELEGAL, S.L.

  • Privacy and rights email: dpd@labnoma.com

This Privacy Policy explains how LAB NOMA S.L. processes personal data collected through https://thetodayproject.net, its online store, customer accounts, forms, newsletters and related communications.

2. What data may we collect?

Depending on how you interact with us, we may collect:

  • identity and contact data, such as name, postal address, email address and telephone number;

  • account and authentication information;

  • order, delivery, return, refund and customer-service information;

  • billing, tax and transaction information;

  • payment status and limited payment metadata supplied by the payment provider; LAB NOMA S.L. does not receive complete card credentials;

  • communications, enquiries, complaints and product-review content;

  • newsletter subscriptions and communication preferences;

  • technical and usage data, such as IP address, browser, device, pages viewed, interactions and cookie identifiers, subject to the Cookie Policy; and

  • any other information you voluntarily provide to us.

Please do not submit health data or other special-category personal data through general contact, review or order forms unless specifically requested and legally justified.

3. Why do we process your data, and on what legal basis?

PurposeMain dataLegal basisAnswer enquiries, requests for quotations and pre-contractual questionsIdentity, contact details and message contentSteps at your request before entering into a contract; and, where appropriate, legitimate interest in responding to general enquiriesCreate and manage customer accountsIdentity, contact and authentication dataPerformance of a contract or pre-contractual measuresProcess orders, payments, deliveries, returns, refunds and after-sales supportIdentity, contact, order, delivery and transaction dataPerformance of the sales contractIssue invoices and comply with accounting, tax, product-safety and other legal dutiesIdentity, billing, transaction and order dataCompliance with legal obligationsPrevent fraud, secure the Website and establish, exercise or defend legal claimsTechnical, transaction, account and communication dataLegitimate interests in security, fraud prevention and legal defence; and compliance with legal obligations where applicableSend newsletters and promotional communicationsName, email and communication preferencesConsent; or, for existing customers and similar products, the lawful exception permitted by applicable electronic-marketing rules, with a simple opt-out in every messageMeasure Website use and campaign performanceDevice, browser, IP address, interactions and identifiersConsent where non-essential cookies or similar technologies are used; see the Cookie PolicyManage interactions on our social-media profilesPublic profile data, messages and interactionsConsent, performance of requested actions and legitimate interest in managing our public profiles and communityComply with requests from courts, regulators or public authoritiesData relevant to the requestCompliance with legal obligations

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may always object to direct marketing.

4. Is it mandatory to provide your data?

Fields marked as mandatory are necessary to process your request or order. If you do not provide them, we may be unable to create an account, complete a purchase, deliver an order, issue an invoice or answer the relevant request. Newsletter subscription and non-essential cookies are voluntary and are not required to browse or purchase from the Website.

5. How long do we keep personal data?

We keep data only for as long as necessary for the relevant purpose and, afterwards, blocked or restricted where required for legal claims and statutory obligations. In particular:

  • account data: while the account remains active and, after closure, for the periods necessary to address legal responsibilities;

  • order, invoice, payment and accounting records: for the applicable commercial, tax and consumer-law retention periods, generally up to six years where Spanish commercial law requires it;

  • enquiries that do not lead to a contract: normally for up to 12 months after the enquiry is resolved, unless a longer period is needed for a complaint or legal claim;

  • customer-service, complaint and claim records: until the matter is resolved and during the applicable limitation periods;

  • newsletter and marketing data: until consent is withdrawn or the user objects, after which only the minimum suppression evidence may be retained to honour the opt-out and demonstrate compliance;

  • cookie and analytics data: for the periods stated in the Cookie Policy; and

  • legal-claim and compliance data: for as long as required by the relevant legal obligation or limitation period.

6. Who receives personal data?

Personal data may be disclosed or made accessible, only where necessary, to:

  • Squarespace and its group companies, as Website, online-store and hosting service providers;

  • Stripe and the relevant financial institutions for card payments, Apple Pay, Google Pay and Klarna, where selected by the customer;

  • PayPal, where selected by the customer;

  • delivery, courier and logistics providers, including Correos Express, GLS, DHL, UPS and MRW, according to the destination and service selected;

  • Squarespace, including Squarespace Email Campaigns, for Website, customer-account, online-store, newsletter and customer-communication functions;

  • analytics, advertising and tag-management providers, including Google, only in accordance with consent requirements where applicable;

  • translation and localisation providers, including Weglot;

  • IT, cybersecurity, professional, legal, accounting and tax advisers acting under appropriate confidentiality and data-processing terms;

  • competent courts, regulators, tax authorities, law-enforcement bodies or other public authorities where required by law; and

  • a purchaser, investor or adviser involved in a genuine corporate transaction, subject to appropriate safeguards.

These providers may act as processors, independent controllers or joint controllers depending on the service. LAB NOMA S.L. requires processors to use personal data only on documented instructions and to implement appropriate security measures.

7. International transfers

Some providers or their subprocessors may process data outside the European Economic Area, including in the United States. Where this occurs, LAB NOMA S.L. will rely on a valid transfer mechanism, such as an applicable European Commission adequacy decision—including the EU–US Data Privacy Framework where the recipient is duly certified—or the European Commission’s Standard Contractual Clauses together with supplementary safeguards where required.

Information about the safeguards applicable to a specific provider may be requested at dpd@labnoma.com.

8. Automated decisions and profiling

LAB NOMA S.L. does not use automated fraud scoring or make decisions based solely on automated processing that produce legal effects or similarly significant effects on users. Website analytics and advertising tools may create audience or interest segments when the user has consented to the relevant technologies, but they are not used by LAB NOMA S.L. to make such legally significant decisions.

9. Your rights

You may exercise the following rights, where applicable:

  • access your personal data;

  • rectify inaccurate or incomplete data;

  • request erasure;

  • request restriction of processing;

  • object to processing based on legitimate interests and object at any time to direct marketing;

  • receive or transmit data in a portable format;

  • withdraw consent at any time; and

  • not be subject to a decision based solely on automated processing where Article 22 GDPR applies.

To exercise your rights, email dpd@labnoma.com or write to LAB NOMA S.L. at the registered-office address above. Please state your name, the right you wish to exercise and sufficient information to identify the relevant relationship or request. We will request additional identity evidence only where we have reasonable doubts about the requester’s identity.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es.

10. Data security

LAB NOMA S.L. applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No Internet service is completely risk-free, and users should protect their account credentials and notify us of suspected unauthorised access.

11. Minors

The online store is intended for persons aged 18 or over who have legal capacity to contract. We do not knowingly request personal data from children for purchasing purposes. If a parent or legal guardian believes that a minor has provided personal data without appropriate authorisation, they may contact dpd@labnoma.com.

12. Third-party websites and social networks

Third-party websites, payment services and social networks operate under their own privacy policies. Users should review those policies before providing personal data through the relevant service.

13. Changes to this Policy

We may update this Privacy Policy to reflect legal, technical or operational changes. Material changes will be communicated through the Website or, where appropriate, directly to affected users.

Last updated: 18 August 2026