We respect your right to privacy and handle your personal data with care. This policy explains what information we collect about you, why we need it, on what legal basis we process it, and how you can control that data. This policy is drafted in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679).
Who is responsible for data processing
The data controller is the seller, whose details are provided below: [company details — to be filled in]. For any questions about how we process your data, you can contact us by email: [contact email — to be filled in].
What data we collect
We try to limit ourselves to the minimum information needed to run the shop. Depending on how you interact with the site, we may collect:
- Order data. When you place an order, we ask for your first and last name, delivery address, email address and phone number. This information is necessary to process the order, deliver the product, and contact you if needed.
- Payment information. We accept cryptocurrency and SEPA bank transfer. We record the fact and parameters of the payment, but we do not store your bank card details — transactions are processed through payment providers and banking infrastructure.
- Technical data and cookies. We use a small set of cookies: an age-gate cookie (remembers that you’ve confirmed you’re over 18) and functional WooCommerce cart cookies (store your cart contents and session). No analytics tools are currently installed on the site.
- Correspondence. If you write to us, we keep the content of your message and your contact details so we can respond and maintain a record of the inquiry.
Why we process data and on what basis
We process your data only for specific, clearly defined purposes. Each purpose has its own legal basis under Article 6 of the GDPR:
- Contract performance. Processing and delivering your order, accepting payment, and providing support related to your purchase. Without this data, we simply cannot fulfil your order.
- Legal obligations. Keeping sales records for accounting and tax purposes, and confirming that a customer is over 18, since some products carry an age restriction.
- Legitimate interest. Ensuring site security, preventing fraud, maintaining correspondence, and improving the quality of our service. We weigh your interests and do not process data more broadly than is reasonably necessary.
How long we keep your data
We keep data no longer than necessary for the purposes it was collected for. Order and payment records are kept for the period required by law for accounting and tax documentation. Correspondence and inquiries are kept for as long as needed to resolve the matter, plus a reasonable period afterward. Functional cart cookies last for the duration of your session; the age-gate cookie lasts a limited period, after which age confirmation is requested again. Once these periods expire, data is deleted or anonymised.
Who we share data with
We do not sell your data and do not share it with third parties for marketing purposes. We share information only with those who help us fulfil your order, and only to the extent necessary:
- Delivery services. Your name, address and contact details are passed to carriers so they can deliver your parcel across Europe.
- Payment providers and banking infrastructure. Data necessary to process and confirm payment by cryptocurrency or SEPA transfer.
- Technical contractors. Hosting and site-maintenance providers who act on our instructions and are required to maintain confidentiality.
In certain cases we may disclose data if required by law or requested by an authorised government body.
Your rights
Under the GDPR, you have a number of rights regarding your personal data:
- the right to access your data and obtain a copy of it;
- the right to have inaccurate or incomplete data corrected;
- the right to erasure (“the right to be forgotten”), where there is no legal basis for retaining the data;
- the right to restrict processing;
- the right to object to processing based on our legitimate interest;
- the right to data portability;
- the right to lodge a complaint with a data protection supervisory authority in your country.
To exercise any of these rights, write to us at [contact email — to be filled in]. We will review your request and respond within the timeframe required by law. Please note that some data may not be deletable while our legal retention obligations remain in effect (for example, sales records).
Changes to this policy
We may update this policy as our processes or legal requirements change. The current version is always available on this page. We will make an effort to highlight any significant changes.
This document is effective as of [date]. Version 1.0.