Privacy notice.

Data may include name, contact and billing details, order information, payment status, download and licence data, support messages, technical logs, IP address, device and browser data, and consent preferences.

The store normally does not directly process full card data; the selected payment provider processes it under its own terms.

Order processing, digital delivery, licence verification and mandatory customer handling rely on performance of a contract and precontractual steps. Invoicing, accounting and authority records rely on legal obligations. Security logging, abuse prevention and legal claim handling may rely on legitimate interests following an appropriate balancing assessment.

Marketing, profiling and nonessential measurement are based on consent where it is freely given, specific, informed and unambiguous. Refusal or withdrawal does not affect core purchasing functions or the lawfulness of earlier processing.

Order data is used to process the purchase, verify payment, issue invoices, deliver digital files, verify licences and handle mandatory consumer matters.

Shopify and enabled payment, invoicing or digital delivery providers may process the data necessary for their role under their respective terms.

When you contact us, message data is processed to answer the question, prepare a proposal and document the matter. Support may require an order reference, theme name, version and technical error description.

Passwords, card data and unnecessary identity documents should not be submitted.

The store operates on Shopify infrastructure. Payment, invoicing, email, digital delivery, hosting, analytics, support and fraud prevention providers may participate. For each provider, the notice must state its name, address or country, task, data scope, retention role and privacy notice.

To be completed before launch: the contracting Shopify entity, Shopify Digital Downloads, payment provider, invoicing provider, email provider, analytics, consent manager, support service and every additional application. Each role must be identified as processor or independent controller according to actual operation.

A transfer outside the European Economic Area requires a valid legal mechanism and appropriate safeguards, such as an adequacy decision, standard contractual clauses, binding corporate rules or another lawful basis.

For each provider, the destination country or region, safeguard and means of obtaining a copy must be stated. A transfer impact assessment and supplementary technical measures must be used where necessary.

Data is retained only for the stated purpose. Order and contract records may be kept for performance and the applicable limitation period, accounting documents until the end of the statutory accounting period, complaint records and responses for at least three years, and consent evidence for the period necessary after withdrawal and for legal claims.

Support and proposal data is retained after closure only as necessary for legal claims, unsuccessful proposals for a shorter predefined period, and analytics or cookie data for the stated lifetime of the relevant tool. To be completed before launch: the exact period and deletion or anonymization rule for every process.

You may request access, a copy, rectification, erasure, restriction and portability, object to legitimate interest processing, and withdraw consent at any time. Where automated decision making applies, you may request human intervention, express your view and contest the decision.

Requests are answered without undue delay and generally within one month. The period may be lawfully extended due to complexity or number of requests, with notice within the first month. Additional identification may be requested only to the extent necessary to respond securely.

Data required to process an order and perform the contract is a contractual requirement; without it, ordering, invoicing or digital delivery cannot be completed. Marketing, nonessential analytics and optional profile information are voluntary and refusal does not prevent core shopping functions.

Where data is obtained from another source, the source, categories and timing of information will be disclosed under the applicable rules.

Shopify and payment providers may use automated risk signals to detect fraud, unauthorized payments and account security events. To be completed before launch: whether any decision with legal or similarly significant effect is made solely by automated means, the logic and consequences involved, and how human review can be requested.

An automated signal must not result in unlawful discrimination and cannot restrict mandatory data subject rights.

Access control, logging, encrypted transfer, backups, permission review and provider agreements are used to protect confidentiality, integrity and availability.

A documented risk assessment is carried out for a personal data breach. Where required, the supervisory authority and affected individuals are notified within the applicable deadline.