Privacy policy
Last updated: October 2026
1. Who is responsible for your data
eu.hurley.com (the “Website”) is the official direct-to-consumer channel of the HURLEY brand in Europe and other markets accessible from the Website. This policy explains which personal data we process, why, for how long and what rights you have.
The Website is managed by HURLEY 999, S.L., the entity authorised to commercially exploit the HURLEY brand in the relevant territories.
Company name: HURLEY 999, S.L.
Tax ID (NIF): B63209084
Registered address: Paseo de Gracia, 112, 1.º, 08008 Barcelona, Spain
Contact: customer@hurley-emea.com
Privacy: privacy@hurley-emea.com
Velara Brands, S.L. acts as the seller of record and contractual counterparty for purchases made on the Website, and issues the corresponding invoices.
Company name: Velara Brands, S.L.
Tax ID (NIF): B22672596
Registered address: C/ Roger de Lauria 19, 4th floor, 46002 Valencia, Spain
Contact: info@velarabrands.com
Each company is the controller of the data it processes for its own purposes:
- HURLEY 999, S.L. processes your data for the newsletter and marketing communications, Website analytics, advertising and general enquiries about the brand.
- Velara Brands, S.L. processes your data to manage your purchases: orders, payments, invoicing, shipping, returns, warranties, your customer account and order-related customer service.
The two companies share with each other the data each needs to carry out its part; for example, Velara Brands, S.L. informs HURLEY 999, S.L. of completed purchases in order to measure campaigns. In this policy, “we”, “us” or “our” refers to HURLEY 999, S.L. and/or Velara Brands, S.L., depending on the activity described in each case.
For any privacy matter, write to us at privacy@hurley-emea.com, whichever company is responsible. We will make sure your request reaches the right one.
2. What data we process
We only process data you give us or that is generated when you use the Website. We do not buy data from third parties.
| Type of data | Examples | Where it comes from |
|---|---|---|
| Identification and contact | First name, last name, email, phone | You, when you buy, register, subscribe or write to us |
| Addresses | Shipping and billing address | You, when you buy |
| Purchases | Products, amounts, date, order status, returns | Your orders |
| Payment | Payment method, last digits of the card, transaction result | The payment gateway. We do not store your full card number |
| Customer account | Login details, order history, wishlist | You, when you create and use your account |
| Communications | Chat messages, emails and contact forms | You, when you contact us |
| Marketing preferences | Newsletter subscription, language, country, viewed products, back-in-stock alerts | You and your browsing, if you have accepted it |
| Browsing | IP address, device, browser, pages visited, source of the visit | Cookies and similar technologies, according to your choice in the banner (see the Cookie Policy) |
| Size | Measurements or fit preferences you enter | You, when you use the size recommender |
We do not need sensitive data (health, beliefs, ethnic origin) and ask you not to send it to us. Data marked as mandatory in each form is needed to handle your request; if you do not provide it, we will not be able to do so.
3. Why we use your data, on what legal basis and for how long
Each use of your data has a legal basis under the General Data Protection Regulation (GDPR). Where the basis is your consent, you can withdraw it at any time.
| Purpose | Controller | Legal basis | Retention period |
|---|---|---|---|
| Managing your purchase: order, payment, shipping and delivery | Velara Brands, S.L. | Performance of the sales contract | For the duration of the relationship and, afterwards, for the legal limitation periods |
| Managing returns, exchanges and warranties | Velara Brands, S.L. | Performance of the contract and legal obligation (consumer law) | During the legal warranty period (3 years) and the limitation periods |
| Issuing invoices and meeting accounting and tax obligations | Velara Brands, S.L. | Legal obligation | 6 years (Spanish Commercial Code) |
| Managing your customer account | Velara Brands, S.L. | Performance of the contract (account terms of use) | Until you delete the account |
| Answering your questions about orders | Velara Brands, S.L. | Performance of the contract | Until the question is resolved and the subsequent limitation periods |
| Answering general questions about the brand | HURLEY 999, S.L. | Your consent, when you contact us | Until the question is resolved and 1 year afterwards |
| Preventing payment fraud | Velara Brands, S.L. | Legitimate interest in protecting customers and the company | As long as needed for the transaction and the limitation periods |
| Recommending a size | Velara Brands, S.L. | Your request when using the recommender | While you use the service |
| Sending you the newsletter, offers and news | HURLEY 999, S.L. | Your consent when you subscribe | Until you unsubscribe |
| Notifying you when a product is back in stock | HURLEY 999, S.L. | Your consent when you request the alert | Until the alert is sent or you cancel it |
| Personalising communications based on your browsing and purchases | HURLEY 999, S.L. | Your consent (newsletter and marketing cookies) | Until you withdraw your consent |
| Measuring use of the Website | HURLEY 999, S.L. | Your consent (analytics cookies) | According to the duration of each cookie |
| Showing you ads on other websites and social networks, and measuring campaigns | HURLEY 999, S.L. | Your consent (marketing cookies) | According to the duration of each cookie and until you withdraw your consent |
| Attributing sales to affiliate websites | HURLEY 999, S.L. | Your consent (marketing cookies) | According to the duration of each cookie |
| Defending ourselves against claims | Either, depending on the case | Legitimate interest | Until legal actions are time-barred |
Newsletter. To subscribe, you tick a box that is never pre-ticked. Every email includes a link to unsubscribe in one click.
Advertising and audiences. If you accept marketing cookies, we may use data about your browsing and purchases to show you relevant ads on Google, Meta and other platforms, and to measure their results. To do so we send those platforms encrypted identifiers, never your email in plain text. If you do not accept, this does not happen.
Automated decisions. We do not make decisions that significantly affect you based solely on automated processing. Personalisation of communications and ads has no legal effects on you.
When the retention period ends, we block the data and keep it only at the disposal of courts and public authorities during the limitation periods. After that, we delete it.
4. Who we share your data with
We do not sell your data. We only share it with those who need it to provide us with a service, or when the law requires us to.
Providers processing data on our behalf. They act as processors, under contract and only on our instructions:
| Provider | Purpose |
|---|---|
| Shopify | Store platform, customer account and checkout |
| Shopify Payments | Processing payments |
| Klarna | Instalment payments, if you choose this option (Klarna also processes your data as an independent controller to assess the financing) |
| Salvat (logistics operator) and the carriers that make the delivery | Preparing, shipping and delivering orders, and collecting returns |
| Reveni | Returns management and size recommender |
| Gorgias | Chat and customer service |
| Klaviyo | Sending the newsletter, alerts and forms |
| Pandectes | Cookie consent management |
| Google, Meta and Microsoft | Analytics and advertising, only if you have accepted it |
| Tradedoubler | Attributing sales to affiliate websites, only if you have accepted it |
| Tax, accounting and legal advisers | Meeting legal obligations and defending our rights |
Other recipients. We disclose data to the tax authorities, courts, law enforcement and other authorities when required by law. If you pay with Shop Pay, Shopify also processes your data as an independent controller to manage your Shop account.
Between the two companies. HURLEY 999, S.L. and Velara Brands, S.L. share the data each needs to carry out the purposes described in section 3.
5. Transfers outside the European Economic Area
Some providers process data outside the European Economic Area: in the United States (Google, Microsoft, Meta, Klaviyo, Gorgias, Cloudflare, Pandectes) and in Canada (Shopify).
We only do so with appropriate safeguards:
- United States: the EU-US Data Privacy Framework, where the provider is certified, and in any case the European Commission’s Standard Contractual Clauses.
- Canada: the European Commission’s adequacy decision.
You can request more information about these safeguards by writing to privacy@hurley-emea.com.
6. Your rights
You can exercise these rights over your data at any time:
| Right | What it means |
|---|---|
| Access | Knowing whether we process your data and getting a copy |
| Rectification | Correcting inaccurate or incomplete data |
| Erasure | Asking us to delete your data when it is no longer needed |
| Objection | Objecting to processing based on legitimate interest and, always, to direct marketing |
| Restriction | Asking us to keep your data without using it while a complaint is resolved |
| Portability | Receiving the data you gave us in a commonly used format, or having us send it to another company |
| Withdrawing consent | Withdrawing it whenever you want, without affecting what was done before |
How to exercise them. Write to privacy@hurley-emea.com stating which right you want to exercise. If we have reasonable doubts about your identity, we will ask for the information needed to confirm it. We will reply within one month, extendable by two further months in complex cases, and we will let you know if so.
You can also unsubscribe from the newsletter using the link in each email, change your cookie preferences from the Website footer, and edit or delete your account from “My account”.
Complaints. If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country of residence. We would appreciate it if you wrote to us first so we can try to resolve it.
7. Minors, security and changes to this policy
Minors. You must be of legal age to buy on the Website. Children under 14 may not give us their data or subscribe to the newsletter without the consent of their parents or guardians. If we detect data from a minor obtained without that consent, we will delete it.
Security. We apply technical and organisational measures to protect your data against loss, unauthorised access or alteration: encrypted connections, payments processed by certified providers and access restricted to staff who need it. If a security breach poses a high risk to you, we will inform you.
Changes. We will update this policy when our processing or the law changes. The date of the latest update appears at the top. If the changes are significant, we will notify you by email or with a notice on the Website.