Privacy policy

This Privacy Policy explains how personal information is collected, used, disclosed, stored and otherwise processed when individuals visit, use or make a purchase through couturecandyx.shop, communicate with us or otherwise interact with our ecommerce services.

For the purposes of this Privacy Policy, references to "we," "us" and "our" mean the operator of couturecandyx.shop.

Questions or requests regarding privacy may be sent to:

info@couturecandyx.shop

Data Controller

The operator of couturecandyx.shop determines the purposes and means of processing personal data in connection with the operation of the store and therefore acts as the data controller for processing for which it determines those purposes and means.

Privacy communications may be directed to:

Email: info@couturecandyx.shop

Where another service provider independently determines the purposes and means of particular processing, that provider may act as an independent controller for that processing.

Personal Data We May Collect

Depending on how a person interacts with couturecandyx.shop, we may process information including:

• Name;
• Billing address;
• Shipping address;
• Email address;
• Telephone number where supplied;
• Order information;
• Products purchased or returned;
• Payment-related information;
• Transaction information;
• Customer-account information;
• Customer-service correspondence;
• Product reviews or other content voluntarily submitted;
• IP address;
• Browser and device information;
• Cookie identifiers;
• Website activity;
• Referral information;
• Approximate location derived from technical information;
• Marketing preferences;
• Consent records;
• Fraud-prevention information; and
• Other information voluntarily provided to us.

How Personal Data Is Collected

Personal data may be collected directly from customers when they browse the store, create an account, place an order, enter information during checkout, contact customer service, request a return, exercise a withdrawal right, subscribe to marketing or otherwise communicate with us.

Information may also be generated automatically through the use of the website and may be received from service providers involved in ecommerce operations.

Purposes of Processing

We may process personal data for purposes including:

• Providing and operating couturecandyx.shop;
• Processing and fulfilling orders;
• Processing payments;
• Arranging shipment and delivery;
• Providing order confirmations and transaction communications;
• Handling cancellations, returns, withdrawals and refunds;
• Providing customer support;
• Managing customer accounts;
• Detecting and preventing fraud, abuse and security incidents;
• Protecting the website and users;
• Complying with legal, accounting and regulatory obligations;
• Establishing, exercising or defending legal claims;
• Improving our website and services;
• Measuring website performance;
• Maintaining records;
• Managing consent preferences;
• Providing advertising or marketing where legally permitted; and
• Sending marketing communications where we have an appropriate legal basis.

Legal Bases for Processing

Where the GDPR applies, we process personal data only where an appropriate legal basis exists.

Depending on the relevant activity, the legal basis may include:

Performance of a contract: processing necessary to accept, administer, fulfil or otherwise perform a contract with the customer.

Steps requested before entering into a contract: processing necessary to respond to customer requests before a purchase.

Legal obligations: processing necessary to comply with applicable tax, accounting, consumer-protection, regulatory or other legal requirements.

Legitimate interests: processing necessary for legitimate business interests such as preventing fraud, securing the website, defending legal claims and improving operations, provided those interests are not overridden by the rights and freedoms of the individual.

Consent: processing based on consent where consent is legally required, including certain marketing activities and certain cookies or similar technologies.

Where processing is based on consent, the individual may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Shopify

couturecandyx.shop may use Shopify as an ecommerce platform.

Shopify may process personal data in connection with providing ecommerce infrastructure, checkout functionality, hosting, fraud prevention, analytics, security and related services.

The precise roles of Shopify and the merchant may differ according to the relevant processing activity and services used.

Payment Processing

Payment information may be processed by Shopify, Shopify Payments or other payment-service providers.

Payment providers may collect information necessary to authorize, process, secure and document transactions.

We may receive payment status, transaction identifiers and related information without receiving all sensitive payment credentials.

Fulfilment and Delivery

We may disclose information such as the customer's name, delivery address, contact information and order information to fulfilment providers, warehouses, logistics providers and carriers where necessary to fulfil and deliver an order.

Customer Service

When a customer contacts us, we may process the information contained in the communication together with relevant order, account and transaction information.

This information is used to respond to the request, resolve problems and maintain appropriate customer-service records.

Fraud Prevention and Security

We may process information to identify suspicious transactions, prevent fraud, investigate misuse, protect customer accounts, secure payments and maintain the integrity of couturecandyx.shop.

This processing may involve Shopify, payment providers, fraud-prevention providers and other security service providers.

Cookies and Similar Technologies

couturecandyx.shop may use cookies, pixels, local storage, tags and similar technologies.

Some technologies are necessary for functions such as shopping-cart operation, secure checkout, authentication, fraud prevention or communications requested by the user.

Other technologies, including certain analytics, advertising or personalization technologies, may require consent under applicable German or European law.

Where consent is legally required, such technologies should not be activated before valid consent has been obtained.

Users may be able to manage applicable consent preferences through the cookie or privacy controls made available on the website.

Essential Cookies

Certain cookies and similar technologies may be necessary for providing a service expressly requested by the user or for carrying out communications over a network.

Such technologies may support functions including shopping carts, checkout, authentication, load balancing, security and fraud prevention.

Analytics

Where legally permitted, we may use analytics services to understand how visitors use couturecandyx.shop, identify technical problems, evaluate website performance and improve our services.

Where applicable law requires consent for analytics technologies, they will be used on the basis of the user's consent.

Advertising and Marketing

Where permitted by law, information may be processed to measure advertising performance, understand marketing effectiveness or display advertising.

Where consent is required for advertising cookies, tracking technologies or particular marketing activities, we rely on the applicable consent mechanism.

Email Marketing

We may send promotional electronic communications only where there is a lawful basis to do so.

Where marketing is based on consent, recipients may withdraw consent or unsubscribe using the mechanism provided in the communication or by contacting:

info@couturecandyx.shop

Transactional messages concerning an order, payment, delivery, return or account are not necessarily marketing communications.

Recipients of Personal Data

Personal data may be disclosed to categories of recipients including:

• Shopify and ecommerce technology providers;
• Payment processors;
• Banks and payment networks;
• Fulfilment providers;
• Warehouses;
• Shipping and logistics providers;
• Customer-service providers;
• Hosting and infrastructure providers;
• IT and cybersecurity providers;
• Fraud-prevention providers;
• Analytics providers where legally permitted;
• Advertising and marketing providers where legally permitted;
• Professional advisers;
• Auditors;
• Insurers;
• Government authorities where legally required; and
• Courts or law-enforcement authorities where disclosure is lawful and necessary.

We do not authorize service providers to use personal data for unrelated purposes merely because they receive data in connection with performing services for us.

International Data Transfers

Some service providers may process personal data outside Germany or outside the European Economic Area.

Where personal data subject to the GDPR is transferred to a country outside the EEA, we seek to rely on a legally permitted transfer mechanism, where required.

Such mechanisms may include an adequacy decision, appropriate contractual safeguards or another transfer mechanism permitted by applicable data-protection law.

Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, accounting, contractual, security and dispute-resolution requirements.

Different categories of data may be subject to different retention periods.

For example, transaction records may need to be retained for periods required by tax or commercial-recordkeeping laws, while some consent or security records may be retained for different periods.

When personal data is no longer required, it may be deleted, anonymized or otherwise handled in accordance with applicable law.

Data Security

We use reasonable technical and organizational measures intended to protect personal data against unauthorized access, alteration, disclosure, destruction or loss.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

Customers are responsible for protecting their own passwords, devices and account credentials.

Data Subject Rights

Subject to applicable conditions and limitations, individuals protected by the GDPR may have rights including:

• The right to obtain access to personal data;
• The right to correct inaccurate personal data;
• The right to request deletion of personal data;
• The right to restrict processing;
• The right to object to certain processing;
• The right to receive certain data in a portable format;
• The right to withdraw consent where processing is based on consent; and
• The right to lodge a complaint with a competent data-protection supervisory authority.

Requests may be submitted to:

info@couturecandyx.shop

We may need to take reasonable steps to verify the identity of the person making a request.

Right to Object

Where personal data is processed on the basis of legitimate interests, individuals may have the right to object to that processing for reasons relating to their particular situation.

Where personal data is processed for direct marketing, the individual may object to processing for that purpose in accordance with applicable law.

Right to Withdraw Consent

Where we rely on consent, consent may be withdrawn at any time for future processing.

Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.

Complaints

Individuals have the right, where applicable, to lodge a complaint with the competent data-protection supervisory authority.

We encourage individuals to contact us first where they have questions about the way we handle personal data:

info@couturecandyx.shop

Automated Decision-Making

Certain ecommerce or fraud-prevention systems may use automated processes to assess transactions or security risks.

Where processing constitutes automated decision-making producing legal or similarly significant effects and specific GDPR protections apply, we will comply with applicable requirements.

Children's Privacy

couturecandyx.shop is not intended to knowingly collect personal data from children where doing so would be unlawful.

If a parent or legal guardian reasonably believes that a child has provided personal data unlawfully, the parent or guardian may contact:

info@couturecandyx.shop

Third-Party Websites

couturecandyx.shop may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices of independent third-party websites.

Customers should review the privacy information of those services before providing personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technologies, legal obligations or privacy practices.

The updated version will be published on couturecandyx.shop with a revised effective or update date where appropriate.

Contact

Questions regarding this Privacy Policy or requests concerning personal data may be sent to:

couturecandyx.shop
Email: info@couturecandyx.shop