Privacy Policy

LEGAL BASIS FOR PROCESSING (EEA RESIDENTS)

If you are located in the European Economic Area (EEA), we process your personal data only when we have a valid legal basis to do so under the General Data Protection Regulation (GDPR). The legal bases we rely on include:

Contract Performance (Article 6(1)(b) GDPR): We process your Order Information to fulfill our contract with you, including processing your payment, arranging shipping, sending order confirmations, and providing customer support related to your purchase.

Legitimate Interests (Article 6(1)(f) GDPR): We process your Device Information to pursue our legitimate interests, specifically to: monitor and prevent fraud and unauthorized transactions; improve and optimize our website and user experience; and analyze how customers browse and interact with the Site. We have assessed that these interests do not override your fundamental rights and freedoms.

Consent (Article 6(1)(a) GDPR): Where you have provided your explicit consent, we process your personal data for marketing communications and targeted advertising. You have the right to withdraw your consent at any time by contacting us at [email protected] or by clicking the “unsubscribe” link in any marketing email.

Legal Obligation (Article 6(1)(c) GDPR): We may process your data where necessary to comply with applicable laws, such as tax and accounting regulations or responding to lawful government requests.

Specifically, we share your data with the following categories of third-party service providers:

– Payment Processors: PayPal, Stripe (or your applicable payment gateway) to process your transactions securely. They receive your payment and billing information only as needed to complete purchases.

– Shipping & Fulfillment Partners: USPS, UPS, FedEx, and DHL to deliver your orders. They receive your name, shipping address, and order details.

– Analytics Providers: Google Analytics to understand site traffic and usage patterns. They collect anonymized browsing data and IP addresses.

– Hosting Provider: Our website hosting service stores and processes data on servers located in the United States.

– Email/Marketing Tools: We use email marketing platforms to send transactional emails (order confirmations, shipping updates) and, with your consent, promotional communications.

Each of these providers is contractually required to protect your data and use it only for the purposes for which it was shared.

INTERNATIONAL DATA TRANSFERS

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our primary operations and some of our service providers are based.

When we transfer your personal data outside the EEA, we ensure that appropriate safeguards are in place to protect your data, including:

– Transfers to recipients in countries that have been deemed to provide an adequate level of data protection by the European Commission;

– Use of Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to countries without an adequacy decision;

– Reliance on the EU-U.S. Data Privacy Framework, where the recipient is a certified participant.

You may request a copy of the safeguards in place by contacting us at [email protected].

DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specifically:

– Order Information (name, address, payment details, purchase history): Retained for up to 7 years after your last purchase for tax, accounting, and legal compliance purposes.

– Account Information (email, login details): Retained for as long as your account is active. You may request account deletion at any time.

– Device Information (IP address, cookies, browsing data): Google Analytics data is retained for 26 months. Server logs are retained for up to 12 months.

– Marketing Consent Records: Retained for as long as the consent is valid, plus 3 years after withdrawal for compliance documentation.

– Customer Support Communications: Retained for up to 3 years after the last interaction.

When your data is no longer needed, we will securely delete or anonymize it. If deletion is not possible (for example, because data is stored in backup archives), we will securely isolate it and cease further processing until deletion is possible.

YOUR RIGHTS (EEA RESIDENTS)

If you are a resident of the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR). To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you, free of charge.

Right to Rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure / Right to Be Forgotten (Article 17): You have the right to request that we delete your personal data when it is no longer necessary for the purpose it was collected, when you withdraw consent, or when there is no overriding legitimate interest for continued processing. Please note that we may need to retain certain data for legal or regulatory purposes.

Right to Restriction of Processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when processing is unlawful.

Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller.

Right to Object (Article 21): You have the right to object to the processing of your personal data based on our legitimate interests. You also have the right to object to processing for direct marketing purposes at any time.

Right to Withdraw Consent (Article 7): Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.

Right to Lodge a Complaint: If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. For residents of Germany, the relevant authority is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI). For residents of France, the relevant authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).

How to Exercise Your Rights: Email: [email protected] Subject line: “GDPR Data Request – [Your Name]” We may ask you to verify your identity before processing your request. We will respond within 30 days of receiving your verified request.