✨ AS SEEN ON TIKTOK·🚚 DISPATCHED IN 24 HRS·📦 FREE SHIPPING OVER $35·
✨ AS SEEN ON TIKTOK·🚚 DISPATCHED IN 24 HRS·📦 FREE SHIPPING OVER $35·
TopShop.Club
Back to home

Privacy Policy (GDPR)

Last updated: July 24, 2026

This Privacy Policy explains how we collect, use, and protect your personal data when you visit or interact with TopShop.Club ("the Site"). We comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD).

1. Data Controller

The data controller responsible for your personal data is:

  • Rob & The Young Holdings SL
  • Registered address: C/ Jesús del Valle 12, Madrid, 28004, Spain
  • CIF / VAT number: B27652924
  • Contact: robain@robandtheyoung.com

2. Personal Data We Collect

  • Email address — collected when you sign up to be notified about back-in-stock products.
  • Phone number — optional, collected alongside the notify signup.
  • Cart data — items and cart value at the moment of a notify signup, to reconstruct interest.
  • Country and device type — inferred from your browser and locale.
  • Analytics data — usage information collected via Google Analytics 4 (page views, referrer, device type, approximate location).
  • UTM parameters — captured when you first land on the site via a tagged link, kept for the duration of your session to attribute your visit.

We do not store your shipping address, and we do not process or store credit card details on the Site.

3. Purposes and Legal Bases

  • Notify-me signups — legal basis: your consent (Art. 6(1)(a) GDPR). Used to email you when a product is back in stock.
  • Analytics & site improvement — legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the Site. You can opt out at any time (see Cookies).
  • Fraud prevention and security — legal basis: legitimate interest.
  • Legal compliance — legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).

4. Data Processors and Third Parties

We share personal data only with service providers acting as processors under a data processing agreement:

  • Google Analytics (Google Ireland Limited) — website analytics.
  • Supabase — hosting and database storage of notify-me signups.
  • Resend — transactional email delivery (e.g. back-in-stock confirmations).

Some processors may transfer data outside the EEA. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

5. Data Retention

  • Notify-me signup data: kept until you unsubscribe or request deletion, and in any case no longer than 24 months from your last interaction.
  • Analytics data: retained per Google Analytics default retention (14 months).
  • UTM parameters: kept only in your browser session and discarded when the session ends.

6. Your Rights under the GDPR

You have the following rights, which you can exercise at any time by contacting robain@robandtheyoung.com:

  • Right of access — obtain a copy of your personal data.
  • Right to rectification — correct inaccurate data.
  • Right to erasure ("right to be forgotten").
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest.
  • Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es.

7. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Site and understand its usage:

  • Strictly necessary — cart contents and session state stored in your browser's local/session storage.
  • Analytics — Google Analytics 4 (measurement ID G-KH1F4E24S7) sets cookies to measure how visitors use the Site. You can opt out via your browser settings or by installing the Google Analytics Opt-Out Browser Add-on.

8. Security

We implement appropriate technical and organisational measures to protect personal data, including TLS/HTTPS encryption in transit and access controls on our database. No system is 100% secure, but we work to protect your information.

9. Changes

We may update this policy. The "Last updated" date at the top reflects the current version.