Privacy policy
Effective date: July 2026 · From Lab to Field, S.L.
Welcome to From Lab to Field, S.L. ("we", "us", or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your personal information when you visit our website and purchase from our online store.
We comply with the General Data Protection Regulation (GDPR) and applicable Spanish data protection laws, including the LOPDGDD.
Contents
- Who We Are
- Minimum Age
- What Personal Data We Collect
- How We Use Your Data
- Legal Basis for Processing
- How Long We Keep Your Data
- Who We Share Your Data With
- Your Rights Under GDPR
- Automated Decision-Making
- Cookies
- Data Breach Notification
- Data Security
- Changes to This Policy
- Contact Us
1. Who We Are
From Lab to Field, S.L.
Astondo bidea, edificio nº612, Parque Científico y Tecnológico de Bizkaia, 48160 Derio, Bizkaia, Spain
support@fromlabtofield.com
CIF/NIF: B-44764041
2. Minimum Age
To use our services and make a purchase, you must be at least 18 years old. By registering or placing an order, you confirm that you meet this requirement. If we become aware that someone under 18 has submitted personal data, we will delete it immediately.
3. What Personal Data We Collect
We collect the following categories of data:
- Identification data: name, surname, email address, phone number, and country.
- Purchase data: billing address, shipping address, order history, and purchase amounts.
- Payment data: card type and last 4 digits. Full payment details are processed directly by Stripe and are never stored by us.
- Profile data: user profile where provided (e.g., athlete, physiologist, nutritionist).
- Usage data: website interactions and browsing behaviour.
- Technical data: IP address, device information, and browser type.
All data is processed in accordance with applicable data protection laws and is only accessible to authorised personnel for legitimate business purposes.
4. How We Use Your Data
We use your personal data to:
- Process and fulfil your orders, including payment and delivery.
- Send transactional emails such as order confirmations and shipping updates.
- Handle returns, refunds, and customer service requests.
- Send marketing and commercial communications, where you have given your consent or where we have a legitimate interest as an existing customer.
- Improve and personalise your experience on our website.
- Prevent fraud and ensure the security of transactions.
- Fulfil our legal and tax obligations.
5. Legal Basis for Processing
- Performance of a contract — to process your orders and fulfil our obligations to you.
- Your consent — when you sign up for marketing communications or agree to non-essential cookies.
- Legitimate interest — to send marketing communications to existing customers, prevent fraud, and improve our services.
- Legal obligation — when required by applicable law.
6. How Long We Keep Your Data
- Order and purchase data: 5 years from the date of purchase, as required by Spanish tax law.
- Account data: until you delete your account or request removal.
- Marketing data: until you withdraw your consent or unsubscribe.
- Legal and administrative records: as required by Spanish law.
You may request deletion of your data at any time (see Section 8).
7. Who We Share Your Data With
We do not sell your data. We share it only with the third parties necessary to operate our store and fulfil your orders:
- Shopify Inc. — platform, hosting, and checkout (Canada)
- Stripe Payments Europe, Ltd. — payment processing (Ireland)
- Mailchimp / Klaviyo — email marketing (USA)
- Google LLC — analytics and advertising (USA)
- Meta Platforms Inc. — advertising and conversion tracking (USA)
- GUREAK DATAPOST — logistics and fulfilment (Spain)
All third parties have been engaged through Data Processing Agreements (DPAs) ensuring GDPR compliance.
International data transfers
- Shopify (Canada): covered by the European Commission's adequacy decision for Canada.
- Stripe, Google, Meta, Mailchimp/Klaviyo (USA): covered by the EU-US Data Privacy Framework where the provider is certified, and by Standard Contractual Clauses (SCCs) as an additional safeguard.
8. Your Rights Under GDPR
You have the right to:
- Access your personal data.
- Correct any inaccurate information.
- Delete your data (right to be forgotten).
- Restrict or object to processing.
- Data portability — request your data in a common format.
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us at support@fromlabtofield.com.
You can also file a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.
9. Automated Decision-Making
We do not use automated decision-making processes that produce legal or similarly significant effects on you. Some of our advertising partners (such as Meta and Google) may use your data for interest-based targeting and audience modelling. You can manage these preferences through the Cookie Policy below and the relevant platform settings.
10. Cookies
We use cookies and similar tracking technologies on our website. For full details on the types of cookies we use, their purpose, and how to manage your consent, please see our Cookie Policy below.
11. Data Breach Notification
If a data breach occurs that may affect your rights or freedoms, we will inform you without undue delay, in compliance with Articles 33 and 34 of the GDPR. We will also notify the relevant data protection authority as required.
12. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Secure encrypted storage.
- Role-based access controls.
- Regular audits and backups.
13. Changes to This Policy
We may update this Privacy Policy to reflect legal, technical, or operational changes. If we make important changes, we will notify you via email or on our website.
14. Contact Us
Email: support@fromlabtofield.com
Address: Astondo bidea, edificio nº612, Parque Científico y Tecnológico de Bizkaia, 48160 Derio, Bizkaia, Spain
Cookie Policy
Effective date: July 2026 · From Lab to Field, S.L.
This Cookie Policy explains how we use cookies and similar technologies on our website. It forms part of this Privacy Policy and complies with the GDPR, the Spanish LSSI-CE, and applicable guidance from the AEPD.
C1. What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They allow the website to function properly, remember your preferences, and understand how you interact with the site. Cookies may be first-party (set by us) or third-party (set by external providers such as Google or Meta).
C2. Types of Cookies We Use
We use four categories, matching the options in our consent banner:
Required
Necessary for the website to function — navigation, cart, login, session security. Always active, no consent required.
Legal basis: Article 6(1)(b) GDPR — strictly necessary for the service requested.
Personalization
Store details about your previous actions to personalise your next visit — language, region, or currency preferences.
Legal basis: consent (Article 6(1)(a) GDPR). Only active if you accept them.
Analytics
Help us understand how visitors interact with our website — traffic, usage patterns, navigation flows. Data is pseudonymised.
Legal basis: consent (Article 6(1)(a) GDPR). Only active if you accept them.
Marketing
Used by us and our partners to optimise advertising and show you relevant ads on Meta, Google, and TikTok.
Legal basis: consent (Article 6(1)(a) GDPR). Only active if you accept them.
C3. Cookie List
Required cookies
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| session_id | From Lab to Field | Session state | Session | First-party |
| csrf_token | From Lab to Field | CSRF security | Session | First-party |
| auth_token | From Lab to Field | User authentication | 7 days | First-party |
| _shopify_y | Shopify | Visitor tracking | 1 year | First-party |
| _shopify_s | Shopify | Session analytics | 30 min | First-party |
| cart_sig / cart_ts | Shopify | Cart functionality | Session | First-party |
| secure_customer_sig | Shopify | Customer login | 1 year | First-party |
Personalization cookies
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _shopify_sa_t | Shopify | Marketing attribution tracking | 30 min | First-party |
| _shopify_sa_p | Shopify | Marketing attribution parameters | 30 min | First-party |
Analytics cookies
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _ga | Google LLC | Distinguishes users for analytics | 2 years | Third-party |
| _ga_* | Google LLC | Session state for analytics | 2 years | Third-party |
Marketing cookies
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _fbp | Meta Platforms | Ad targeting and conversion | 3 months | Third-party |
| _fbc | Meta Platforms | Click tracking for Meta Ads | 1 year | Third-party |
| _gcl_au | Google LLC | Google Ads conversion tracking | 3 months | Third-party |
| _ttp | TikTok | Ad measurement and targeting | 13 months | Third-party |
C4. Third-Party Providers and International Transfers
- Google LLC (USA): EU-US Data Privacy Framework and SCCs.
- Meta Platforms Inc. (USA): Standard Contractual Clauses (SCCs).
- TikTok (USA/Singapore): Standard Contractual Clauses (SCCs).
- Shopify Inc. (Canada): European Commission adequacy decision for Canada.
C5. How to Manage Cookies
Consent banner: When you first visit our website, a consent banner lets you accept all, decline all non-essential cookies, or configure preferences by category. Non-essential cookies will not activate without your prior consent.
Cookie settings panel: Change your preferences at any time via "Manage preferences" on our website.
Browser settings: You may also delete or block cookies through your browser settings. Blocking required cookies may affect website functionality.
C6. Your Rights
You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and to withdraw consent at any time. Contact us at support@fromlabtofield.com or file a complaint with the AEPD: www.aepd.es.
C7. Updates to This Cookie Policy
We may update this Cookie Policy to reflect legal, technical, or operational changes. Updates will be published on this page with a revised effective date.
From Lab to Field, S.L. · NIF: B-44764041 · Astondo bidea, edificio nº612, Parque Científico y Tecnológico de Bizkaia, 48160 Derio, Bizkaia, Spain