Data controller
[TO BE COMPLETED — company name, address, contact email for data-related questions]
Data collected and purposes
- Orders: identity, contact details, delivery address, purchase history — performance of the contract (delivery, invoicing, customer service). Legal basis: performance of the contract.
- Accounting obligations: invoices kept for 10 years. Legal basis: legal obligation.
- Newsletter: email address — sending of commercial information. Legal basis: consent, which can be withdrawn at any time via the unsubscribe link.
- Contact: name, email, message — replying to your requests. Legal basis: legitimate interest.
- Audience measurement and marketing: only with your consent (see the Cookies page).
Payment
Payments are processed by [TO BE COMPLETED — Shopify Payments / Stripe / PayPal]. Mandora Studio neither collects nor stores any card data.
Recipients
Your data is intended for Mandora Studio and its strictly necessary processors: hosting and e-commerce platform ([TO BE COMPLETED — Shopify / Vercel]), payment, carriers ([TO BE COMPLETED — POST Luxembourg, DHL…]), emailing tool ([TO BE COMPLETED — tool]). Some providers may be located outside the EU; such transfers are covered by appropriate safeguards (standard contractual clauses, EU–US Data Privacy Framework).
Retention periods
- Customers: 3 years after the last purchase or contact.
- Invoices: 10 years (legal obligation).
- Newsletter: until you unsubscribe.
- Cookies: 13 months maximum.
Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time. To exercise these rights: [TO BE COMPLETED — email]. You may also lodge a complaint with the National Commission for Data Protection (CNPD), Luxembourg — cnpd.public.lu.
Local storage in the prototype
Your bag, favourites, language and cookie preferences are saved in your browser's local storage (localStorage and a language cookie), on your device only.