← EMBR CBD

Privacy Policy

Last updated: [TODO: date]

Data controller

[TODO: legal/trading name] — see the legal notice for full contact details.

Data collected and purposes

Data Purpose Legal basis (GDPR)
Language selection (EN/FR) Display preference, stored locally (localStorage) Legitimate interest / strictly necessary
Cart contents Site functionality, stored locally (localStorage) Strictly necessary
Email address (newsletter) Product updates, on voluntary sign-up Consent
Name, delivery address, email (order) Order processing and shipping Performance of a contract
Payment data Processed directly by Stripe — never stored by the trader Performance of a contract

Cookies & trackers

This site uses browser local storage (localStorage) for language and cart — strictly necessary for the site to function, no consent required. Payment processing (Stripe) may set its own technical cookies needed for fraud prevention. No advertising or third-party analytics cookie is set without your prior consent — see the banner shown on your first visit.

Data recipients

GitHub, Inc. (hosting); Stripe, Inc. (payment processing); [TODO: email/newsletter provider, if any]. Data is never sold to third parties.

Retention period

Order data: kept for the statutory accounting/tax retention period applicable in the trader's home country (commonly 6-10 years in the EU). Newsletter email: kept until unsubscribe.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. To exercise these rights, contact [TODO: dedicated privacy/DPO email]. You may also lodge a complaint with your own country's data protection authority — find yours via the EDPB member list.