Personal data categories

Processing purposes and GDPR legal bases

Personal data may be processed to perform a contract, provide customer service, operate and secure the website, prevent fraud, comply with legal obligations, and manage consent-based activities where applicable.

• Contract performance: processing orders, delivery, returns, refunds and customer requests.
• Legitimate interests: appropriate fraud prevention, service security, business administration and service improvement where those interests are not overridden by individual rights.
• Legal obligations: records and processing required by applicable law.
• Consent: used where consent is the required legal basis, including certain non-essential cookies or similar technologies where enabled.

Payment processing

Payments are processed through Stripe and relevant payment networks. Payment information may be handled by those providers for authorization, fraud prevention, transaction processing and related services.

Service providers

Personal data may be shared with service providers where reasonably necessary to operate the website and fulfil orders, such as payment processing, hosting, customer service, delivery and technical support. Providers are expected to handle data only for appropriate service purposes and subject to applicable obligations.

International transfers

Because the website serves international customers and may use service providers in different countries, personal data may be processed outside the country where it was collected. Where required by applicable data-protection law, appropriate safeguards are used for international transfers.

Data retention

Personal data is retained for as long as reasonably necessary for the purposes described in this policy, including order fulfilment, customer support, accounting, legal compliance, dispute handling, fraud prevention and security. Retention periods may vary by data type and legal requirement.

Data subject rights

Where the GDPR applies, you may have rights including access, rectification, erasure, restriction, portability, objection, withdrawal of consent and the right to complain to a competent supervisory authority.

• Access to personal data.
• Rectification of inaccurate or incomplete data.
• Erasure where legal conditions are met.
• Restriction of processing where applicable.
• Data portability where applicable.
• Objection to certain processing.
• Withdrawal of consent at any time where processing is based on consent.
• Complaint rights before a competent data-protection authority.

Security

Reasonable technical and organisational measures are used to protect personal data against unauthorised access, loss, misuse or alteration. No internet transmission or storage method can be guaranteed to eliminate all risk.

Privacy contact

For GDPR, privacy, personal data, data subject requests, cookies, consent or data-protection questions, contact privacy@pitchvix.com.