④ Privacy Policy
1. Controller Luxour Creative OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia · Email: davidandgoliath.shop@outlook.com.
2. What we collect and why
- Order & account data (name, email, billing/shipping address, order contents): to process and deliver your purchase. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- Payment data: processed by our payment providers (see below). We do not store full card details.
- Technical data (e.g. IP address, device/browser info, collected automatically by our store platform): to operate the store securely and prevent fraud. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Legal/tax records: to meet retention obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
3. Who receives your data (processors & partners)
- Shopify — store platform & hosting.
- Shopify Payments (Stripe) and PayPal — payment processing.
- MarketPrint (MarketConsultive GmbH) — printing & fulfilment. For US orders, data is processed at their production facility in Houston, USA.
- Shipping carriers (e.g. DHL, UPS) — delivery. We share only what is necessary to fulfil your order.
4. International data transfers Some recipients are located in the USA (e.g. Shopify, PayPal, and MarketPrint's US facility for US orders). Such transfers are safeguarded by an EU adequacy decision and/or EU Standard Contractual Clauses.
5. Cookies Our store sets cookies that are strictly necessary for it to function (e.g. cart, checkout). Non-essential or marketing cookies are only set with your consent. » NOTE: Once you add a cookie-consent tool and/or marketing cookies, describe them here and make sure non-essential cookies fire only after consent.
6. Retention We keep your data only as long as needed to fulfil your order and to meet legal retention periods (e.g. accounting records, generally up to 7 years).
7. Your rights You have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. Where processing is based on consent, you may withdraw it at any time. You may also lodge a complaint with a data protection supervisory authority (in Estonia: the Estonian Data Protection Inspectorate; or the authority in your country of residence).
8. California residents (CCPA/CPRA) If you are a California resident, you have the right to know, delete and correct your personal information, and to opt out of its "sale" or "sharing". We do not sell your personal information. To exercise these rights, contact davidandgoliath.shop@outlook.com.
9. Contact For any privacy request: davidandgoliath.shop@outlook.com.
» PRIVACY — ADD THESE SECTIONS WHEN YOU ADD THESE TOOLS
Each of the following, once installed, MUST be disclosed here — and marketing/analytics ones generally require prior cookie consent:
- Meta (Facebook/Instagram) Pixel or TikTok Pixel → advertising & conversion tracking; consent required.
- Google Analytics → usage analytics; consent required.
- Email/newsletter tool (e.g. Klaviyo, Mailchimp, Shopify Email) → describe signup, double opt-in, and unsubscribe.
- Cookie-consent tool → describe how consent is obtained and managed. Tell me which you add, and I'll write the matching section.