Contract performance
When you place an order, processing your account and order data is necessary to perform the contract of sale. This covers order fulfilment, shipping, returns, and refunds.
— Privacy Policy —
What we collect
What we collect
and why.
This page covers how this site collects, uses, stores, and shares personal data — and the rights you have under the EU and UK General Data Protection Regulation. Written in plain English, with the legal references named where they apply.
— On this page —
01
— Who we are —
The data controller.
The legal entity responsible for the processing described on this page.
This site is operated by [REGISTERED COMPANY NAME], the legal entity registered as the operator of this online store. Full company details — including registered office, commercial register number, legal representative, and VAT registration — are listed in our Imprint.
For all matters relating to personal data, the primary contact is [PRIVACY EMAIL]. We respond to data protection inquiries within one working day during business hours.
EU representative (Article 27 GDPR)
Where the data controller is established outside the European Economic Area, GDPR Article 27 requires the appointment of an EU representative. The current representative is named in the Imprint, Section 06.
02
— What we collect —
Categories of personal data.
The data the site collects falls into five categories. Each one is listed below with what it includes, when it is collected, and how long it is kept.
Account and order data
When you place an order or create an account: name, email, shipping address, billing address, telephone (optional), order history, and language/currency preference. This data is necessary to fulfil the contract of sale and to provide customer support afterwards.
Payment data
Payment is processed by our payment service providers (Shopify Payments, regional alternatives where applicable). We do not store full card numbers or CVV codes on our servers. What we receive from the processor is a transaction reference, the last 4 digits of the card, the card brand, and the success/failure status.
Communications data
When you write to us — by email, contact form, or chat — we keep the message content and our reply, the email address, and the time of the exchange. This is so we can pick up follow-up questions in context.
Technical data
Server logs collect IP address, browser user-agent, page URL, referrer URL, and timestamp for every request. Logs are retained for 30 days for security and abuse-prevention purposes, then deleted automatically.
Marketing data
If you subscribe to our newsletter or opt into marketing cookies, we collect: email, opt-in timestamp, country, language, open/click behaviour on our emails, and conversion data from advertising platforms. See the Cookie Policy for the full picture on tracking.
03
— Why we collect it —
Specific purposes.
GDPR requires that every category of data has a clearly stated purpose. The list below maps each category to what it is used for.
- To fulfil your order: deliver the product, send confirmations, handle returns and refunds. (Account and order data)
- To process payment: charge the order total via the payment provider. (Payment data)
- To provide support: reply to your questions, resolve issues with deliveries or product use. (Communications data)
- To keep the site secure: detect fraud, prevent abuse, comply with legal record-keeping. (Technical data)
- To improve the site: aggregate analytics on which pages people find useful (only if you opt into analytics cookies). (Technical data)
- To send marketing: newsletter, occasional product updates (only if you subscribe). (Marketing data)
We do not process personal data for any purpose not in the list above. We do not sell personal data to third parties under any circumstances.
04
— Lawful bases —
The legal grounds for processing.
Every act of processing must rest on one of six lawful bases listed in Article 6 of the GDPR. This site uses four of them.
Legal obligation
EU and national tax law require us to retain invoices and order records for set periods (typically 7–10 years). Consumer protection law requires we keep records of complaints and returns.
Legitimate interests
Security logs, fraud prevention, and the customer support function rest on legitimate interests — running a safe, functional commerce site. We have weighed these against your interests and rights and consider the balance reasonable.
Consent
Marketing emails, optional analytics cookies, and advertising cookies all require your active opt-in. You can withdraw consent at any time, and we make that withdrawal as easy as the initial opt-in.
06
— International transfers —
Where your data travels.
Some processors are based outside the European Economic Area. Where this happens, we use the safeguards required by GDPR Chapter V.
The primary platform provider, Shopify, processes data in Canada and the United States. These transfers are covered by the EU–US Data Privacy Framework (where applicable for US transfers) and by Standard Contractual Clauses under Article 46 GDPR. Canada has been designated by the European Commission as providing adequate protection under Article 45 GDPR.
You have the right to request a copy of the transfer mechanism applicable to a specific processor. Write to [PRIVACY EMAIL] and we will provide the relevant Standard Contractual Clauses or adequacy decision reference.
07
— Retention —
How long we keep it.
We keep personal data only for as long as needed for the purpose, or as required by law. The schedule below is the working framework.
- Order and invoice records: 10 years from the order date (tax law requirement)
- Customer accounts: active for as long as the account exists; deleted within 30 days of account deletion request
- Communications: 3 years from the last exchange
- Server logs: 30 days, then automatically purged
- Marketing subscriber lists: until unsubscribe; opt-in record kept 3 years after unsubscribe for proof of consent
- Cookie consent records: 12 months from the choice
At the end of the retention period, data is either deleted or fully anonymised (such that re-identification is no longer possible). Anonymised data may be retained for statistical purposes without restriction.
08
— Security —
How we protect it.
GDPR Article 32 requires appropriate technical and organisational measures. The measures below are the working baseline.
Technical measures
- HTTPS (TLS 1.2+) for all data in transit, with HSTS enabled
- Encryption at rest on databases storing personal data (AES-256 standard via Shopify platform)
- Access controls with role-based permissions and 2FA mandatory for all admin accounts
- Audit logging of administrative actions on customer records
- Regular security updates applied via the Shopify platform pipeline
Organisational measures
- Privacy training for all team members with data access
- Data processing register per Article 30 GDPR
- Data Processing Agreements in place with every processor
- Incident response plan for personal data breaches (Article 33 GDPR notification within 72 hours)
If we discover a breach
In the unlikely event of a personal data breach that creates risk to your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where required by Article 34 GDPR.
09
— Your rights —
What you can ask us to do.
GDPR grants every data subject eight rights. The table below summarises each, with a brief note on how to exercise it on this site.
Right of access
You can request a copy of the personal data we hold about you, along with the purposes of processing, recipients, retention periods, and the source if not collected from you directly.
Right to rectification
You can ask us to correct inaccurate data, or complete data that is incomplete. For account-related fields you can also edit them yourself at /account.
Right to erasure
Also called the right to be forgotten. You can ask us to delete your personal data, subject to legal retention obligations (e.g., tax records must be kept 10 years regardless).
Right to restriction
You can ask us to stop processing your data while a dispute is resolved (e.g., during a rectification request, or if you object to processing on legitimate-interest grounds).
Right to portability
You can request your data in a structured, commonly used, machine-readable format (we typically provide CSV or JSON), and have it transmitted to another controller where technically feasible.
Right to object
You can object to processing based on legitimate interests, and to direct marketing at any time (unsubscribe is the standard channel for the latter).
No automated decisions
We do not use automated decision-making, including profiling, that produces legal effects on you or similarly significantly affects you. Marketing segmentation does not meet this threshold.
Right to complain
If you believe we mishandle your data, you can complain to the supervisory authority in your country of residence, place of work, or place of the alleged infringement.
Getting in touch about your data.
For any exercise of rights, complaint, or general question about how we handle personal data, write to [PRIVACY EMAIL]. We respond within one working day.
Data Protection Contact
Supervisory authorities
You can lodge a complaint with the data protection authority in your country. In the UK: the Information Commissioner's Office. In Germany: the relevant Bundesbeauftragte für den Datenschutz. In France: the CNIL. A full list of EU/EEA authorities is available at edpb.europa.eu/about-edpb/about-edpb/members.
·
— A short note —Privacy policies are often pages of legalese designed to deter reading. We have tried for the opposite: clear sections, plain English, the legal references named when they apply. If something here is unclear, write — we read every message.