Privacy policy

 

1. Scope and Privacy Contact

This proposed policy concerns personal information associated with browsing, purchasing from, or contacting alloyapparela.shop. Privacy enquiries may be directed to info@alloyapparela.shop. The domain and email do not substitute for the legal identity and contact details of the data controller.

2. Information to Be Covered

The final policy should describe the information actually handled at each stage of a customer's interaction with the store. Relevant categories to verify include customer names, email addresses, delivery and billing details, order contents, payment status, account information, and correspondence about deliveries or returns.

Technical information must also be checked against the store's configuration, including whether server logs, device identifiers, IP addresses, consent records, or browsing events are collected. This draft does not confirm that all of these categories are collected, or that any particular analytics or advertising system is active.

3. Purposes and Legal Bases

Each actual purpose requires an appropriate GDPR legal basis. The final notice must distinguish order fulfilment and requested pre-contract steps, legal recordkeeping, justified security or claims-related interests, and processing based on consent. Any legitimate interests relied on must be identified rather than described only as a general business need.

4. Store Platform and Other Recipients

Before publication, the merchant must verify its platform arrangements and any payment, delivery, hosting, support, accounting, or marketing providers. The completed notice must identify recipients or meaningful recipient categories and explain their roles. Use of Shopify or any other provider must be described according to the services actually enabled.

The merchant should check which information a fulfilment partner receives, which party handles card details, and whether an optional application has access to customer records. Installing an application can change the disclosures required; this draft does not certify any application or provider arrangement.

5. Cookies and Similar Technologies

Under German terminal-device rules, storing or accessing information on a user's device generally requires informed consent unless a statutory exception applies, such as strict necessity for a service expressly requested by the user. Analytics and advertising technologies must not be assumed to qualify for that exception.

The final implementation must match its cookie and consent disclosures. The merchant must verify the actual tools, purposes, providers and durations, and supply a usable method to revise consent. This policy text does not itself create a consent banner or block tracking scripts.

6. Marketing Preferences

Whether the store sends newsletters, uses advertising audiences, or performs marketing profiling remains unconfirmed. The published notice must accurately describe any such activity and its applicable legal basis and controls. A statement about an unsubscribe link must not be published unless that mechanism is actually available.

7. Transfers and Retention

Where information is transferred outside the EEA, the final notice must explain the applicable safeguards or other lawful transfer mechanism. Retention periods, or meaningful criteria for deciding them, must be specified for actual records. This draft does not establish a fixed retention schedule or confirm that any provider's location or certification makes a transfer lawful.

8. Individual Rights

Depending on the legal conditions, individuals may request access, correction, erasure, restriction, portability, or object to processing. Consent can be withdrawn without affecting earlier lawful processing. Individuals can complain to a competent supervisory authority. The merchant must establish a process for responding within applicable legal deadlines and requesting only proportionate identity verification.

9. Security and Enquiries

Do not send account passwords, full payment-card details, or unnecessary identity documents to the support inbox. If an enquiry requires identity verification, the requested information and transmission method should be proportionate to the request. No assertion that a specific encryption, audit, certification, or fraud-control system is in operation has been verified for this draft.

10. Completing and Updating This Notice

The merchant must confirm whether a data protection officer or representative is required and add the relevant details where applicable. Any automated decisions with legal or similarly significant effects must also be assessed. The final published version should carry a genuine effective date and be reviewed when the underlying processing changes.