Privacy policy

 

This Privacy Policy explains how petalandpupo.shop collects, uses, stores, discloses, and otherwise processes personal data when individuals visit our website, place an order, contact us, subscribe to marketing communications, or otherwise interact with our online store.

1. Data Controller

For personal data processed in connection with this online store, the store is identified as:

petalandpupo.shop
Email: info@petalandpupo.shop

petalandpupo.shop determines the purposes and means of processing personal data relating to store operations, except where a service provider independently acts as a controller under applicable law.

2. Scope of This Policy

This policy applies to personal data collected through:

  • The petalandpupo.shop website

  • The Shopify checkout

  • Customer accounts

  • Product and order pages

  • Customer service communications

  • Marketing subscription forms

  • Cookies and similar technologies

  • Returns, refunds, and payment disputes

  • Other interactions with petalandpupo.shop

This policy does not independently govern websites or services operated by third parties.

3. Personal Data We Collect

Depending on how a customer interacts with the store, we may collect the following categories of personal data.

Identity and Contact Information

This may include:

  • Full name

  • Billing address

  • Shipping address

  • Email address

  • Telephone number

  • Country or region

  • Customer-account details

Order and Transaction Information

This may include:

  • Products purchased

  • Product size, color, and quantity

  • Order number

  • Order value

  • Discounts

  • Payment status

  • Shipping method

  • Delivery status

  • Returns and refunds

  • Customer-service history

  • Fraud-prevention information

Payment Information

Payments are processed through the payment methods available during checkout.

We may receive limited payment-related information, such as:

  • Payment method

  • Payment status

  • Transaction identifier

  • Billing details

  • Fraud-screening result

  • Partial or masked payment details

Complete payment-card information is generally processed by the applicable payment provider and is not normally stored directly by petalandpupo.shop.

Device and Technical Information

This may include:

  • Internet Protocol address

  • Browser type

  • Device type

  • Operating system

  • Language setting

  • Approximate location derived from IP address

  • Referring website

  • Pages viewed

  • Dates and times of access

  • Cookie identifiers

  • Session information

  • Website interaction information

Communications

When an individual contacts us, we may process:

  • Email address

  • Message contents

  • Attachments

  • Photographs

  • Order information

  • Customer-service notes

  • Records of our response

Marketing Information

This may include:

  • Marketing subscription status

  • Communication preferences

  • Email engagement

  • Advertising interactions

  • Consent records

  • Withdrawal-of-consent records

4. How We Collect Personal Data

We collect personal data:

  • Directly from customers

  • Through the Shopify platform

  • Through cookies and similar technologies

  • From payment providers

  • From shipping and logistics providers

  • From fraud-prevention providers

  • From customer-service applications

  • From advertising or analytics providers, where permitted

  • From publicly available sources where lawful

  • When required to investigate suspected fraud or misuse

5. Purposes and Legal Bases

We process personal data only when an applicable legal basis exists.

Performance of a Contract

We process data when necessary to:

  • Process and fulfill orders

  • Accept and verify payments

  • Deliver products

  • Provide order updates

  • Manage customer accounts

  • Process cancellations

  • Handle returns, exchanges, and refunds

  • Respond to order-related enquiries

  • Provide contractual customer support

The legal basis is generally Article 6(1)(b) GDPR.

Compliance With Legal Obligations

We process data when necessary to:

  • Maintain accounting and transaction records

  • Comply with tax obligations

  • Respond to lawful government requests

  • Comply with consumer-protection requirements

  • Process valid data-protection requests

  • Detect and report legally relevant activity

  • Establish required records

The legal basis is generally Article 6(1)(c) GDPR.

Legitimate Interests

We may process personal data when necessary for legitimate business interests, provided those interests are not overridden by the individual’s rights and freedoms.

These interests may include:

  • Preventing fraud

  • Protecting the store and customers

  • Securing the website

  • Detecting technical errors

  • Improving store performance

  • Managing customer enquiries

  • Defending legal claims

  • Maintaining business records

  • Measuring service quality

  • Preventing abuse of promotions or return systems

The legal basis is generally Article 6(1)(f) GDPR.

Consent

Where required, we rely on consent for:

  • Email marketing

  • Personalized advertising

  • Non-essential cookies

  • Certain analytics technologies

  • Other optional processing activities

The legal basis is generally Article 6(1)(a) GDPR.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Shopify

Our store is hosted on Shopify.

Shopify provides the ecommerce infrastructure used to operate the website, display products, manage checkout, process orders, store relevant customer information, and support store functionality.

Depending on the service and processing activity, Shopify may process personal data as a processor acting on our instructions or may process certain data for its own purposes as an independent controller.

Shopify may process data in countries outside the customer’s country of residence. Such transfers are subject to applicable contractual and legal safeguards.

Customers who use Shopify-operated services such as Shop or Shop Pay may also have a separate relationship with Shopify. Shopify’s own privacy terms may apply to those services.

7. Payment Providers

When a customer selects a payment method, personal data may be disclosed to the applicable payment provider for:

  • Payment authorization

  • Payment processing

  • Fraud prevention

  • Identity verification

  • Chargeback management

  • Refund processing

  • Compliance with financial regulations

Payment providers may independently determine certain purposes and means of processing and may act as separate data controllers.

The payment methods available to a customer are displayed during checkout.

8. Shipping and Fulfillment Providers

We may disclose personal data to shipping, warehouse, fulfillment, and logistics providers for:

  • Order preparation

  • Product packaging

  • Address verification

  • Customs processing

  • Delivery

  • Tracking

  • Delivery-problem resolution

  • Return management

The information disclosed may include the customer’s name, delivery address, telephone number, email address, order contents, and delivery instructions.

9. Other Recipients

Personal data may be disclosed to:

  • Shopify

  • Payment processors

  • Shipping companies

  • Warehouses and fulfillment partners

  • IT and hosting providers

  • Email service providers

  • Customer-support providers

  • Fraud-prevention services

  • Analytics providers

  • Advertising providers where permitted

  • Accountants, auditors, and professional advisers

  • Insurers

  • Courts, regulators, and public authorities

  • Parties involved in a business restructuring or transfer

We do not disclose personal data merely for an unrelated recipient’s independent marketing purposes without an appropriate legal basis.

10. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage, software development kits, tags, and similar technologies.

Essential Technologies

Essential technologies may be used to:

  • Keep the website operational

  • Maintain shopping-cart contents

  • Remember checkout information

  • Authenticate customer accounts

  • Protect against fraud

  • Secure website sessions

  • Process orders

  • Remember privacy preferences

These technologies may be used without consent where permitted because they are necessary to provide a service requested by the user.

Non-Essential Technologies

Subject to consent requirements, non-essential technologies may be used for:

  • Analytics

  • Performance measurement

  • Personalization

  • Advertising measurement

  • Retargeting

  • Marketing attribution

  • Audience analysis

Where required, non-essential cookies will not be activated until consent is provided.

Customers may manage available cookie preferences through the website’s privacy or cookie settings.

Withdrawing consent does not affect the lawfulness of prior processing.

11. Marketing Communications

We may send promotional communications when:

  • The customer has provided valid consent; or

  • Another lawful basis permits the communication.

Marketing messages may include information about:

  • New products

  • Seasonal collections

  • Promotions

  • Discounts

  • Store updates

Customers may unsubscribe by using the unsubscribe mechanism in the communication or by contacting info@petalandpupo.shop.

Service communications relating to an order, payment, delivery, security issue, return, or legal notice are not marketing communications and may still be sent when necessary.

12. International Data Transfers

Some service providers may process personal data outside Germany or the European Economic Area.

Where required, international transfers will be based on an appropriate safeguard, which may include:

  • An adequacy decision

  • Standard contractual clauses

  • Supplementary technical or organizational measures

  • Another legally recognized transfer mechanism

No safeguard can eliminate every risk associated with international data processing, but reasonable steps are taken to use providers that maintain appropriate protections.

13. Data Retention

Personal data is retained only for as long as reasonably necessary for the relevant purpose.

Retention periods may depend on:

  • The duration of the customer relationship

  • Order fulfillment

  • Return and warranty periods

  • Accounting and tax obligations

  • Fraud-prevention requirements

  • Payment-provider rules

  • Limitation periods

  • Pending complaints or disputes

  • Legal proceedings

  • Consent status

Order and transaction records may be retained for the periods required by applicable accounting, commercial, and tax laws.

Marketing data may be retained until consent is withdrawn or an objection is received, subject to retention of a limited suppression record to ensure that the preference is respected.

14. Data Security

We use reasonable technical and organizational measures designed to protect personal data against:

  • Unauthorized access

  • Accidental loss

  • Unlawful disclosure

  • Alteration

  • Destruction

  • Misuse

Measures may include access controls, encrypted communications, platform security tools, account protections, data minimization, and service-provider controls.

No online transmission or storage system can be guaranteed to be completely secure.

Customers should protect account credentials and contact us promptly if they suspect unauthorized use.

15. Automated Decision-Making and Fraud Screening

Orders may be subject to automated or semi-automated fraud screening.

Relevant indicators may include:

  • Transaction characteristics

  • Device information

  • IP address

  • Billing and shipping discrepancies

  • Previous transaction patterns

  • Payment-provider risk signals

A suspicious order may be delayed, reviewed, cancelled, or rejected where permitted.

Where a person has rights relating to a qualifying solely automated decision, those rights may be exercised by contacting info@petalandpupo.shop.

16. Data-Protection Rights

Subject to applicable conditions and exceptions, individuals may have the right to:

  • Request access to personal data

  • Request correction of inaccurate data

  • Request completion of incomplete data

  • Request deletion

  • Request restriction of processing

  • Object to processing based on legitimate interests

  • Object to direct marketing

  • Withdraw consent

  • Receive certain data in a portable format

  • Lodge a complaint with a supervisory authority

  • Request human review of certain automated decisions

Requests may be sent to:

info@petalandpupo.shop

We may request information reasonably necessary to verify identity and prevent unauthorized disclosure.

We will respond within the period required by applicable law. That period may be extended where legally permitted because of complexity or the number of requests.

17. Right to Object

Where personal data is processed on the basis of legitimate interests, an individual may object on grounds relating to their particular situation.

Where personal data is processed for direct marketing, the individual may object at any time. Personal data will no longer be processed for that direct-marketing purpose after a valid objection.

18. Right to Complain

Individuals have the right to lodge a complaint with a competent data-protection supervisory authority, particularly in the country of habitual residence, place of work, or place of the alleged infringement.

Customers are encouraged, but not required, to contact us first so that we have an opportunity to address the concern.

19. Children’s Data

Our store is not intended for children who are legally unable to enter into a binding purchase contract.

We do not knowingly request personal data directly from young children for independent use of the store.

A parent or legal guardian who believes that a child has provided personal data improperly should contact info@petalandpupo.shop.

20. Third-Party Links

The website may contain links to third-party websites or services.

We are not responsible for the privacy practices, security, availability, or content of third-party services. Individuals should review the privacy information of the relevant third party before submitting personal data.

21. Changes to This Policy

We may update this Privacy Policy to reflect:

  • Legal changes

  • Regulatory guidance

  • Changes to our services

  • Changes to Shopify features

  • New payment or delivery providers

  • Security practices

  • Operational requirements

The updated version will be posted on the website with a revised effective date.

Material changes may also be communicated through another appropriate method where required.

22. Contact

Questions, concerns, objections, consent withdrawals, and data-protection requests may be sent to:

petalandpupo.shop
Email: info@petalandpupo.shop