Privacy policy
What We Collect
When you shop with us or subscribe to our list, we may collect: name, email, shipping/billing address, phone number, order history, and payment confirmation (not full card details — these are processed directly by Shopify Payments/our payment gateway).
How We Use Your Information
We use your data to: Process and fulfil your orders Communicate with you about your order (shipping updates, customer service) Send marketing communications, only if you've opted in Improve our website and product offering
Legal Basis for Processing (Spanish/EU customers)
For customers in Spain, we process your data under the following legal bases per GDPR: Contract: to fulfil your order Consent: for marketing emails (you can withdraw consent anytime) Legitimate interest: for fraud prevention and site improvement
Data Sharing
We share data only with the third parties needed to run our store: Shopify (platform/hosting), our payment processor, and our shipping carriers. We do not sell customer data.
International Data Transfers
As an Australian business using Shopify (which may process/store data outside your home country), your data may be transferred internationally. Shopify maintains its own compliance framework for these transfers (including EU Standard Contractual Clauses where relevant).
Your Rights
Depending on your location, you may have rights to access, correct, delete, or restrict use of your personal data: Australia: under the Privacy Act 1988 (Cth) New Zealand: under the Privacy Act 2020 Spain/EU: under GDPR (right to access, rectification, erasure, restriction, portability, objection)
To exercise any of these rights, contact gypseana@gmail.com.
Data Retention
We retain order data for as long as required for tax/accounting purposes under Australian law (generally 5 years), and marketing data until you unsubscribe or request deletion.
Cookies
Our site uses cookies for functionality, analytics, and (if applicable) marketing/retargeting. You can control cookie preferences via your browser settings.