Privacy policy

TEMPLATE — this text needs review by a qualified lawyer before you publish it or rely on it. It is a starting point for a small EU web shop, not legal advice.

This policy explains how the business named in the footer handles personal data under the EU General Data Protection Regulation (GDPR) and Spain's Ley Orgánica 3/2018 (LOPDGDD). The controller is that business. Contact them on the email in the footer. A data protection officer is not appointed in this demo; appoint one if you are required to.

What we collect - Account: your name, email, password (stored as a hash), optional phone, marketing preference. - Delivery: address and country. - Orders: items, amounts, VAT, status, tracking number. - Curl profile, only with a separate consent: optional nickname or first name of the child, age band (not a date of birth), hair type, length, thickness, challenges, accessory colours, and sensitivities you choose to type. We do not ask for a photograph of the child. - Support messages you send, and consent records (cookies, marketing, child-data consent). - Payment card numbers are handled by Stripe when payments are live. We store Stripe customer and subscription ids, not the full card number.

Children's data The curl profile is data about a child under 16. We collect the minimum we use to pack a box. The legal basis is your explicit consent (GDPR Article 6(1)(a)), which you can withdraw. Withdrawing consent deletes the curl profile. There is no separate date of birth. Hair type is not treated here as health data, but sensitivity notes can hint at health. Write only what you are comfortable sharing, and do not include a diagnosis. If a note looks like health data, the safer legal basis and safeguards should be confirmed by your lawyer before you go live.

Other legal bases - Account, orders, delivery and subscription: contract (Article 6(1)(b)). - Invoices and accounting: legal obligation (Article 6(1)(c)). - Security of the site and a record of consent: legitimate interests (Article 6(1)(f)), balanced against your rights.

Retention - Curl profile and nickname: while the account is open, and deleted when you delete the profile, withdraw consent, or delete the account. - Orders and invoices: kept for the statutory accounting period after the personal story is removed. On deletion we strip the name and email from those records (they show as deleted) rather than destroying accounting totals. - Enquiries: up to 24 months. - Cookie preferences: stored in your browser until you clear them.

Your rights You can ask for access, correction, erasure, restriction, portability and objection, and you can withdraw consent. Use the privacy page in your account to download a copy or delete the account, or email the address in the footer. You can also complain to the Agencia Española de Protección de Datos (aepd.es) if Spain is the right authority. Your lawyer should confirm the lead authority.

This demo stores data in a local database. A production host, email tool or image store may sit outside your country. List those processors and, if needed, the transfer tool (such as SCCs) before launch. We do not sell personal data.