Privacy and Data Security Policy

The data controller is the company identified at the end of this page. For any privacy question, contact us using the details shown there.

Account data: name, e-mail and password (stored only in hashed form).

Order data: delivery address, postcode, phone, purchased items, amounts and delivery charges.

Technical data: access logs, IP address and the country/language preference stored in your browser.

Performance of the contract: processing orders, calculating delivery by postcode, shipping and customer support.

Legal obligations: invoicing and retention of accounting records.

Legitimate interest: shop security, fraud prevention and service improvement.

Payments are processed on the Viva.com checkout. Card details are entered directly in Viva.com's secure environment and are never stored or processed by this shop; we only receive the transaction result and a payment reference.

We use providers for hosting, database, transactional e-mail, catalogue/order platform and payment processing (Viva.com). All process data only on our instructions under data-processing agreements.

Order and invoicing data: for the applicable statutory period. Account data: until you ask for deletion. Technical logs: short periods, for security and diagnostics only.

We use encrypted connections (HTTPS/TLS), hashed passwords, authenticated sessions, role-based access control in the back office and database isolation rules so each customer can only see their own data.

Administrative access is limited to authorised users and third-party credentials are kept in a secret manager, never in application code.

You may request access, correction, deletion, restriction or portability of your data and object to certain processing. You may also lodge a complaint with your data protection authority.

We use browser local storage for the cart and country/language preference, plus strictly necessary cookies for the sign-in session. We do not use behavioural advertising.