Privacy Policy

Date: 2025-09-22

1. About This Policy

This Privacy Policy applies to all users of eurivicy.store (“we”, “us”, “our”) and outlines how we collect, use, store, protect, and share your personal data when you interact with our website—whether browsing products, creating an account, placing an order, or contacting customer support. We are committed to complying with the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable regional data protection laws to safeguard your privacy rights and ensure transparent, responsible data handling.

“Personal data” refers to any information that can identify you directly or indirectly, including but not limited to your full name, email address, postal address, phone number, payment details (e.g., last 4 digits of a credit card), browsing history, device information (IP address, browser type/version, operating system), and preferences (e.g., saved shipping addresses). This policy does not apply to third-party websites, apps, or services linked from our site (e.g., social media platforms like LinkedIn or Instagram)—we encourage you to review the privacy policies of these third parties independently before engaging with them.

2. Data Controller & Contact Information

The data controller responsible for managing your personal data is the operator of eurivicy.store. For any privacy-related inquiries, requests (e.g., accessing your data, updating information, withdrawing consent), or complaints, please contact our dedicated privacy team using the following:

• Email: service@eurivicy.store (subject line: “Privacy Inquiry”)
• Response Commitment: We acknowledge all privacy requests within 1 business day and aim to resolve them within 30 days. For complex requests (e.g., large data exports), we may extend this timeline by up to 2 months, but we will notify you of the delay and provide regular updates.

3. What Personal Data We Collect

We collect personal data only for specific, legitimate purposes and do not gather more information than necessary. The types of data we collect depend on your interaction with our site:

3.1 Data Collected When Browsing (No Registration Required)

When you visit our site to view products (e.g., home decor, furniture, kitchenware) without creating an account or making a purchase, we automatically collect technical data from your browser. This data is essential to maintain site functionality, optimize performance, and ensure security. The collected data includes:

• IP address: To identify your general geographic region (e.g., state) for service optimization (e.g., matching you to nearby shipping carriers) and detect fraudulent activity (e.g., unusual login attempts from high-risk regions).
• Date and time of each visit: To analyze peak traffic periods (e.g., weekends vs. weekdays) and allocate server resources to avoid downtime during high-demand times.
• Pages viewed and links clicked: To understand which products (e.g., “ceramic vases” or “mid-century chairs”) are most popular, refine site navigation (e.g., adding faster access to top-viewed categories), and fix broken links.
• Amount of data transmitted: To troubleshoot loading issues for users with limited bandwidth (e.g., optimizing image sizes for slower internet connections).
• Browser type/version, operating system, and device model: To ensure the site is compatible with your device (e.g., responsive design for mobile vs. desktop) and deliver bug fixes (e.g., resolving display errors for Safari 17.0 users).
• Referral source: To track how you found our site (e.g., via a search engine like Google, a social media link, or a third-party blog) and evaluate the effectiveness of our marketing channels.

This collection is based on Article 6(1)(f) GDPR (our legitimate interest in maintaining a functional, secure, and user-friendly website) and CCPA Section 1798.100 (reasonable business purposes).

3.2 Data Collected for Account Registration

If you create a customer account to save preferences, track orders, or streamline future purchases, we collect voluntarily provided data that you choose to share. Account registration is optional—you can still make purchases as a guest—but an account enhances your user experience. The collected data includes:

• Full name: To personalize your account dashboard (e.g., “Welcome, [Name]”) and ensure order details (e.g., delivery address) match your identity (reducing fraud risks).
• Email address: To send account confirmations (verifying your email ownership), password reset links (if you forget your login credentials), and order updates (e.g., “Your order has shipped”).
• Password: Stored in encrypted form using industry-standard hashing technology (e.g., bcrypt). We never access or store your raw password—even our team cannot view it.
• Optional phone number: For SMS delivery notifications (e.g., “Your package will arrive today”) if you opt in during registration. You can disable SMS notifications anytime via your account settings.
• Communication preferences: Whether you want to receive marketing emails (e.g., sale alerts, new product launches) or SMS promotions. You can opt out of these communications at any time (see Section 7.7).
• Optional profile details: Information like your preferred decor style (e.g., “modern,” “bohemian”) or household size, which you may provide to receive personalized product recommendations (e.g., “Top 5 sofas for small apartments”).

3.3 Data Collected for Purchases

When you place an order on our site, we collect transactional data necessary to process, fulfill, and track your purchase. This data is required to meet our contractual obligation to deliver your order. The collected data includes:

• Delivery address: Full address (including apartment number, building name, and postal code) to ensure your product is shipped to the correct location. You may also provide special instructions (e.g., “Leave package at front door” or “Deliver after 5 PM”) to assist the carrier.
• Billing address: To verify your payment method (e.g., ensuring the address matches the one on file with your credit card issuer) and comply with financial regulations (e.g., anti-money laundering laws).
• Order details: Product name, model number, quantity, price, and any customizations (e.g., “blue fabric sofa” or “engraved wooden tray with ‘Family’”).
• Payment method identifiers: Last 4 digits of a credit card, PayPal ID, or Apple Pay token. We never store full credit card details—all payment processing is handled by PCI DSS (Payment Card Industry Data Security Standard)-compliant third-party providers (e.g., Stripe, PayPal), who encrypt and secure your financial data.
• Order notes: Any additional requests you provide (e.g., “Gift wrap this item” or “Include a handwritten note: ‘Happy Birthday!’”) to personalize your order.
• Payment status: Whether the order is “pending,” “paid,” “refunded,” or “partially refunded” to track transaction progress.

This collection is based on Article 6(1)(b) GDPR (necessary to fulfill our contractual obligation to deliver your purchased products) and CCPA Section 1798.100 (fulfilling customer contracts).

3.4 Data Collected When Contacting Us

If you reach out to our customer support team via email, contact form, or social media (e.g., to ask about product dimensions, report a delivery delay, or request a return), we collect support-related data to resolve your inquiry efficiently:

• Your name and email address/phone number: To identify you (e.g., linking your inquiry to your order history) and respond to your request (e.g., sending a follow-up email with answers).
• Details of your inquiry: Order number (if applicable), product issue (e.g., “damaged vase”), and any relevant context (e.g., “package arrived with a cracked ceramic base”).
• Attachments: Photos of damaged products, screenshots of site errors (e.g., a frozen checkout page), or copies of order confirmations—these help verify your concern and speed up resolution.
• Communication history: A record of all messages exchanged (e.g., your initial inquiry and our responses) to ensure consistency if you follow up later (e.g., “You mentioned a replacement vase—here’s the tracking number”).

We retain this data only until your inquiry is fully resolved (typically 30 days after the last communication) to ensure follow-up support if needed (e.g., checking if a replacement arrived safely).

3.5 Data Collected via Cookies & Tracking Technologies

We use cookies, web pixels, and similar tracking technologies to enhance your user experience, analyze site performance, and deliver personalized content. A “cookie” is a small text file stored on your device that recognizes your browser and remembers preferences. We categorize cookies as follows:

You can manage cookie preferences via your browser settings (e.g., Chrome, Safari) or our site’s cookie banner (accessible via the “Manage Cookies” link in the footer). Disabling non-essential cookies (e.g., marketing cookies) will not affect basic site functionality but may limit personalized features.

We also use web pixels (small, invisible images embedded in emails or web pages) to track actions like email opens (e.g., “Did the user open our Black Friday sale email?”) or purchase conversions (e.g., “Did the user buy a product after clicking an ad?”). This data is aggregated and anonymized unless you have provided consent to link it to your personal data.

4. How We Use Your Personal Data

We use your personal data exclusively for the purposes it was collected and do not use it for unstated purposes without your explicit consent. Key uses include:

4.1 Fulfilling Orders & Providing Services

• Process payments: Share your billing address and payment identifiers with PCI DSS-compliant providers (e.g., Stripe) to verify and complete your transaction.
• Arrange shipping: Share your name, delivery address, and order number with our U.S. shipping carriers (e.g., UPS, FedEx) to ensure timely delivery and enable tracking.
• Send order updates: Notify you via email/SMS (if opted in) about order status changes (e.g., “Order confirmed,” “Dispatched,” “Out for delivery,” “Delivered”).
• Resolve order issues: Use your order history and support communications to address problems like missing items, incorrect products, or delivery delays (e.g., initiating a carrier investigation for a lost package).
• Fulfill special requests: Use order notes (e.g., “gift wrap”) to personalize your order (e.g., including a gift receipt instead of a pricing receipt).

4.2 Managing Your Account

• Maintain your profile: Update your saved preferences (e.g., default shipping address, communication opt-ins) and store your order history (so you can reorder favorite products quickly or track past purchases).
• Secure your account: Use IP address and device data to detect unauthorized access (e.g., a login attempt from a device you’ve never used) and send security alerts (e.g., “We noticed a login from California—was this you?”).
• Provide password reset functionality: Send reset links to your registered email address if you forget your password or request a change.
• Personalize recommendations: Use optional profile details (e.g., preferred decor style) to suggest products you may like (e.g., “Based on your love for modern decor, check out this minimalist lamp”).

4.3 Improving Our Website & Products

• Analyze aggregated, anonymized data: Combine browsing and purchase data (removing identifiers like names or email addresses) to identify trends (e.g., “60% of users view dining sets before sofas”) and optimize site layout (e.g., moving popular categories to the homepage).
• Test new features: Roll out beta tools (e.g., virtual room planners, product comparison tools) to a subset of users and use their feedback to refine functionality (e.g., adding more furniture styles to the planner).
• Fix technical issues: Use browser/device data to resolve bugs (e.g., “Users on Android 14 cannot add items to cart”) and improve site speed (e.g., compressing images to reduce loading time).
• Evaluate content effectiveness: Track how users interact with product descriptions, images, and videos (e.g., “Do users who watch the product video stay longer on the page?”) to enhance content quality (e.g., adding more videos for top-selling items).

4.4 Communicating With You

• Transactional emails: Send non-marketing communications required to fulfill our contract (e.g., account confirmations, order receipts, delivery notifications). These emails are not optional but are essential for keeping you informed.
• Marketing communications: Send emails about seasonal sales (e.g., “Black Friday: 20% off all decor”), new product launches (e.g., “Introducing our fall candle collection”), or exclusive offers—only if you opt in during account registration or via the site’s cookie banner. You can unsubscribe from marketing emails anytime by clicking the “Unsubscribe” link in the email or updating your account preferences.
• SMS promotions: Send text messages about flash sales (e.g., “Last 24 hours: 10% off sofas”) or order updates—only if you explicitly opted in to SMS communications. You can opt out by replying “STOP” to any SMS or updating your account settings.
• Customer support follow-ups: Send a brief survey (e.g., “How did we handle your damaged product request?”) after resolving your inquiry to improve our support quality. We may also send a reminder (e.g., “Your return authorization expires in 3 days”) to help you complete pending actions.

4.5 Ensuring Security & Compliance

• Detect and prevent fraud: Use IP address, billing/delivery address matching, and order frequency data to flag suspicious activity (e.g., multiple large orders from the same IP address with different billing addresses). We may also use third-party fraud detection tools (e.g., Signifyd) to verify the legitimacy of orders.
• Comply with legal obligations: Retain order and payment records for 7 years to meet tax and accounting requirements (e.g., responding to IRS audits) and disclose data if required by law (e.g., court orders, subpoenas).
• Resolve disputes: Use your order history and communication records to address customer complaints (e.g., “You claimed the product was damaged—here’s the photo you provided”) or defend against false claims (e.g., “The order was delivered to your address, as confirmed by the carrier”).

5. How We Share Your Personal Data

We never sell your personal data to third parties for marketing purposes—this includes sharing your email address, phone number, or browsing history with advertisers, data brokers, or other businesses for their own marketing. We only share your data with trusted partners who assist us in providing services, and these partners are bound by strict contractual obligations to protect your data and use it only as instructed by us. Key sharing scenarios include:

5.1 Payment Service Providers

We share your billing address, order amount, and payment identifiers (e.g., last 4 digits of a credit card) with PCI DSS-compliant providers (e.g., Stripe, PayPal) to process payments securely. These providers use your data only for transaction processing (e.g., verifying funds, charging your card) and do not retain it for longer than necessary (typically 30 days after the transaction is complete). They may also use your data to detect payment fraud (e.g., flagging a stolen credit card) but will not share it with third parties without your consent.

5.2 U.S. Shipping & Logistics Partners

We share your name, delivery address, and order number with our U.S. shipping carriers (e.g., UPS, FedEx, DHL) to deliver your product. Some carriers may also receive your email address/phone number with your consent to send you delivery updates (e.g., “Your package is 2 stops away”). Carriers are prohibited from using your data for any purpose other than delivering your order (e.g., they cannot add you to their marketing lists) and must delete your data once delivery is confirmed.

If you request special delivery services (e.g., white-glove furniture delivery), we may share additional details (e.g., product weight, assembly requirements) with the logistics partner to ensure proper handling.

5.3 Technical Service Providers

We share anonymized browsing data (e.g., pages viewed, device type, aggregated traffic trends) with our website hosting, security, and analytics partners (e.g., Google Analytics, Cloudflare). These partners use the data to:

• Maintain site performance: Hosting providers (e.g., AWS) ensure our server stays online and scales to handle traffic spikes (e.g., during sales events).
• Detect cyber threats: Security providers (e.g., Sucuri) block DDoS attacks, malware, and unauthorized access attempts.
• Improve user experience: Analytics partners (e.g., Google Analytics) help us understand how users navigate the site (e.g., “What percentage of users abandon the checkout page?”) and identify areas for improvement.

Anonymized data cannot be linked to individual users—identifiers like IP addresses are truncated or hashed to prevent identification. For example, Google Analytics may receive your IP address but will truncate it (e.g., “192.168.1.XXX”) to avoid linking it to your identity.

5.4 Marketing Service Providers

If you have opted in to marketing communications, we may share your email address or phone number with trusted marketing partners (e.g., Mailchimp for email campaigns, Twilio for SMS) to send targeted promotions. These partners are contractually required to:

• Use your data only to execute our marketing campaigns (e.g., sending our sale emails, not their own).
• Protect your data with security measures (e.g., encrypting email lists).
• Honor your opt-out requests (e.g., removing you from our email list if you unsubscribe).

We may also share aggregated, anonymized marketing data (e.g., “50% of users who clicked the ad purchased a vase”) with advertising platforms (e.g., Google Ads, Facebook Ads) to optimize campaign performance—but this data does not include personal identifiers.

5.5 Legal & Regulatory Authorities

We may disclose your personal data if required by law (e.g., to comply with a court order, tax audit, or anti-fraud investigation) or to protect our legitimate interests (e.g., investigating fraudulent orders, defending against legal claims). We only disclose the minimum amount of data necessary to fulfill the request and will notify you of the disclosure unless prohibited by law (e.g., a sealed court order).

For example, if a law enforcement agency requests data about a fraudulent order placed using your email address, we may share your order history and billing address—but not your payment details—if required by a valid subpoena.

6. Data Security & Retention

6.1 Data Security Measures

We use technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction:

• Encryption: All data transmitted between your browser and our server (e.g., account registration, payment details) is encrypted using SSL/TLS 1.3 technology (the industry standard for secure online communications). This ensures that even if data is intercepted during transmission, it cannot be read without the encryption key.
• Secure Storage: Sensitive data (e.g., encrypted passwords, order records) is stored on servers with restricted physical access (e.g., data centers with 24/7 security guards, biometric entry systems) and digital access controls (e.g., multi-factor authentication for authorized staff, role-based access limits—only customer support teams can view order details, not marketing teams).
• Regular Audits: We conduct quarterly security audits and penetration testing (by third-party firms like HackerOne) to identify and fix vulnerabilities (e.g., weak password policies, unpatched server software). We also perform annual PCI DSS compliance audits to ensure our payment processing meets global security standards.
• Employee Training: All staff receive annual data protection training to ensure they understand their responsibilities (e.g., not sharing customer data with unauthorized individuals, recognizing phishing attempts) and comply with privacy laws. Employees who handle sensitive data (e.g., customer support, finance) undergo additional background checks and security training.
• Data Breach Response Plan: We maintain a detailed plan to respond to data breaches, including steps to contain the breach, notify affected users and regulators, and remediate the issue. In the event of a breach that poses a risk to your rights (e.g., unauthorized access to your email address and order history), we will notify you and relevant regulatory authorities within 72 hours of discovery (as required by GDPR and CCPA) and provide steps to protect yourself (e.g., resetting your password, monitoring for identity theft).

While we take every reasonable step to secure your data, no system is 100% secure. We cannot guarantee that unauthorized third parties will never be able to bypass our security measures and access your personal data. However, we will take all commercially reasonable steps to mitigate such risks.

6.2 Data Retention Periods

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, plus any additional time required by law:

• Account data: Retained while your account is active. If you close your account, we delete all account data (e.g., name, email, saved addresses, profile preferences) within 30 days—unless legal obligations (e.g., tax records) require longer retention.
• Order data: Retained for 7 years to comply with U.S. tax and accounting laws (e.g., IRS requirements for retaining sales records). After 7 years, we anonymize the data (remove all identifiers like your name or address) so it can no longer be linked to you. Anonymized order data may be retained indefinitely for business analytics (e.g., tracking long-term sales trends).
• Browsing data: Anonymized or deleted within 3 months of your last visit. Cookie data is retained for the duration specified in the cookie (e.g., strictly necessary cookies expire when you close your browser; marketing cookies expire after 12 months).
• Support inquiry data: Deleted 30 days after your inquiry is resolved. If the inquiry involves a legal dispute (e.g., a refund claim), we may retain the data until the dispute is finalized (e.g., until a court judgment is issued).
• Marketing data: Retained only as long as you remain opted in to marketing communications. If you opt out, we delete your email address/phone number from our marketing lists within 7 days—but may retain a record of your opt-out to avoid re-adding you to lists in the future.

If you request erasure of your data (via the “Right to Erasure” in Section 7), we will delete or anonymize it within 14 business days—unless we are required by law to retain it (e.g., order records for tax purposes). In such cases, we will “block” the data (restrict access to authorized staff only) until the legal retention period expires, after which it will be deleted.

7. Your Privacy Rights

Under GDPR, CCPA, and other regional laws, you have the following rights regarding your personal data. To exercise these rights, email service@eurivicy.store with proof of identity (e.g., a copy of your order confirmation email, a photo of your government-issued ID with sensitive details redacted, or a response to a security question linked to your account):

7.1 Right to Access

You can request a copy of all personal data we hold about you, including details of:

• What data we collected (e.g., your email address, order history).
• When and how it was collected (e.g., “Collected via account registration on 2025-01-15”).
• How we used and shared it (e.g., “Used to send order updates; shared with UPS for shipping”).
• The retention period for the data (e.g., “Retained until 2032 for tax compliance”).

We will provide this data in a machine-readable format (e.g., CSV file) if requested, free of charge for the first request. For subsequent requests within a 12-month period, we may charge a reasonable fee to cover administrative costs.

7.2 Right to Rectification

If your personal data is inaccurate or incomplete (e.g., an outdated delivery address, misspelled name), you can request to correct it. We will update your data within 7 business days of verifying your request and notify you once the changes are made. For example, if your last name was misspelled in your account, we will correct it and update all linked records (e.g., order receipts, shipping labels).

7.3 Right to Erasure (“Right to Be Forgotten”)

You can request that we delete your personal data if:

• It is no longer necessary for the purpose for which it was collected (e.g., your account is inactive and you have no pending orders).
• You withdraw consent for data use (e.g., you opted out of marketing emails and there is no other legal basis for processing).
• You object to processing (and your rights override our legitimate interests).
• The data was collected unlawfully (e.g., we collected your phone number without your consent).

We will confirm deletion within 14 business days—unless legal retention obligations apply (e.g., tax records), in which case we will block the data instead of deleting it. If we have shared your data with third parties (e.g., a shipping carrier), we will notify them to delete your data (if possible) or stop using it.

7.4 Right to Restriction of Processing

You can request to limit how we use your data if:

• You dispute the accuracy of the data (we will restrict processing until we verify it).
• Processing is unlawful (but you do not want the data deleted).
• We no longer need the data, but you need it for legal claims (e.g., you are suing us over a damaged product and need your order history as evidence).

While processing is restricted, we will only use your data with your consent or for legal purposes (e.g., defending against a lawsuit). We will notify you when the restriction is lifted (e.g., once we verify the accuracy of your data).

7.5 Right to Data Portability

You can request to receive your personal data in a structured, machine-readable format (e.g., CSV, JSON) so you can transfer it to another service provider (e.g., another online home goods store). This applies to data you provided to us (e.g., your name, email, order history) and data processed based on your consent or a contract (e.g., purchase data).

We will provide this data within 14 business days of your request. If technically feasible, you can also request that we transfer the data directly to the other service provider (e.g., “Send my order history to XYZ Store”).

7.6 Right to Object

You can object to the processing of your data for:

• Marketing purposes: We will stop processing immediately—no need to provide a reason. This includes opting out of marketing emails, SMS, and targeted ads.
• Processing based on our legitimate interests (e.g., using your browsing data to improve the site): We will review your request and stop processing if your rights override our interests (e.g., if the processing causes you harm, such as anxiety from targeted ads). If we continue processing, we will provide a written explanation of our compelling legitimate interests.

You can exercise this right by emailing service@eurivicy.store or using the opt-out mechanisms in our marketing communications (e.g., the “Unsubscribe” link in emails).

7.7 Right to Withdraw Consent

If you previously consented to data processing (e.g., for marketing emails, SMS notifications, or cookie use), you can withdraw consent at any time. Withdrawal does not affect the legality of processing before consent was withdrawn (e.g., marketing emails sent before you opted out are still lawful).

To withdraw consent:

• For marketing emails: Click the “Unsubscribe” link in any email or update your account preferences.
• For SMS: Reply “STOP” to any SMS or contact us via email.
• For cookies: Use the “Manage Cookies” link in the site footer to disable non-essential cookies.

We will confirm receipt of your consent withdrawal within 3 business days and stop processing your data for the relevant purpose within 7 days.

7.8 Right to Lodge a Complaint

If you believe we have violated your privacy rights (e.g., we processed your data without consent, failed to respond to your access request), you have the right to lodge a complaint with a data protection supervisory authority in your country:

• EU residents: Contact your local data protection authority (e.g., CNIL in France, ICO in the UK, BfDI in Germany).
• California residents: Contact the California Attorney General’s Office or the California Privacy Protection Agency (CPPA).
• Other U.S. residents: Contact the Federal Trade Commission (FTC) or your state’s attorney general’s office.

You do not need to notify us before lodging a complaint, but we encourage you to contact us first to resolve the issue informally.

8. Changes to This Policy

We may update this Privacy Policy to reflect changes in legal requirements (e.g., new state privacy laws like the Virginia Consumer Data Protection Act), website features (e.g., adding a loyalty program that collects additional data), or data processing practices (e.g., switching to a new payment provider). When we make changes:

• We will post the revised policy on our site with a new “Last Updated” date.
• We will notify account holders of material changes (e.g., new data collection practices, changes to how we share data) via email at least 7 days before the changes take effect. The email will include a summary of the key changes and a link to the full revised policy.
• For non-material changes (e.g., minor updates to contact information), we will post the revised policy on the site without additional notification.

Your continued use of eurivicy.store after the revised policy is posted constitutes acceptance of the changes. We encourage you to review this policy periodically (e.g., every 6 months) to stay informed about how we protect your data.

9. Children’s Privacy

We do not intentionally collect personal data from children under the age of 13 (or the age of majority in your jurisdiction, if higher). Our website is not directed at children, and we ask that parents or legal guardians ensure children do not provide personal data on our site. If we become aware that we have collected personal data from a child without parental consent, we will delete the data within 7 business days and notify the parent or guardian (if contact information is available).

If you believe your child has provided personal data on our site, please contact us at service@eurivicy.store