Privacy Policy

This privacy policy describes how Winsleyco collects, processes, and protects your personal data when you visit our website winsleyco.com or shop with us.

1. Data Collected

Contact details: name, email address, telephone number, delivery address
Order data: order history, encrypted payment information
Device data: IP address, browser type, operating system
Usage data: pages visited, click behavior, referring URLs
Cookies (see section 4)

2. Purpose of Processing

Processing and delivery of orders
Customer communication and support
Fraud prevention and security
Improvement of our website and services
Marketing communications (only with explicit consent)

3. Legal Bases for Processing (GDPR Art. 6)

Performance of a contract (Art. 6(1)(b)): processing of orders, payments, and deliveries
Legal obligation (Art. 6(1)(c)): statutory tax retention obligations, consumer legislation
Legitimate interest (Art. 6(1)(f)): fraud prevention, website security, analytics services
Consent (Art. 6(1)(a)): marketing communications and non-essential cookies

4. Cookies and Consent

We use cookies. When you first visit our website, we ask for your consent via a cookie banner. You may withdraw your consent at any time via the Cookie Settings in the footer. We use the following cookie categories:

Strictly necessary cookies: necessary for the proper functioning of the store (shopping cart, session, security). No consent required.
Functional cookies: remember your preferences (language, region).
Analytics cookies: Google Analytics (anonymized, IP anonymization enabled) - consent required.
Marketing cookies: for personalized advertisements - consent required.

5. Retention Periods

Order data: 7 years (statutory tax retention obligation)
Customer account data: for as long as your account is active + 2 years after the last activity
Analytics data: maximum 26 months
Marketing communications: until consent is withdrawn

6. Transfers to Third Parties

Data is only transferred to the following categories insofar as necessary for the performance of the contract:

Payment processors: Shopify Payments (Visa, Mastercard, American Express), Apple Pay, Google Pay, Shop Pay
Shipping partners: PostNL and partner couriers
Hosting services: Shopify Inc. (platform and data storage - US, Standard Contractual Clauses apply)
Analytics services: Google Analytics (anonymized)

All third parties are contractually required to comply with applicable data protection legislation.

7. International Transfers

Your data may be transferred to Shopify Inc. (Canada/US) and Google LLC (US). Such transfers take place on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission in accordance with GDPR Art. 46.