Privacy policy

1. ABOUT THIS PRIVACY POLICY

CANDYCE DUVAL respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use and share personal information when you visit our website, place an order, contact us or otherwise interact with our online store.

CANDYCE DUVAL uses Shopify to operate its online store.

For full business identification information, please refer to our Legal Notice.

2. INFORMATION WE COLLECT

Depending on how you interact with our website, we may collect:

your name;
email address and telephone number;
billing and shipping address;
order and transaction information;
information you provide when contacting us;
technical information such as your IP address, browser, device and interactions with the website;
marketing preferences, where applicable.

Payment information is processed securely by Shopify and/or the payment providers available at checkout. CANDYCE DUVAL does not need to store your full payment card details.

3. HOW WE USE YOUR INFORMATION

We process personal information for the following purposes:

To process and fulfil orders
We use your contact, order, delivery and payment-related information to process purchases, manufacture or prepare products, arrange shipping, provide order updates and manage returns or customer service.

Legal basis: performance of a contract.

To comply with legal obligations
Certain order, invoice and transaction information may be retained where required for accounting, tax or other legal purposes.

Legal basis: compliance with a legal obligation.

To communicate with you
We use your contact information to answer questions, provide customer support and communicate regarding your orders.

Legal basis: performance of a contract or our legitimate interest in responding to customer enquiries.

Security and fraud prevention
We may process technical and transaction information to maintain the security of the website and prevent fraudulent or unlawful activity.

Legal basis: legitimate interests.

Marketing
Where you have chosen to receive marketing communications, we may use your email address to send news, product launches or other communications from CANDYCE DUVAL.

Legal basis: your consent.

You can unsubscribe from marketing communications at any time.

4. COOKIES AND WEBSITE DATA

Our website may use cookies and similar technologies that are necessary to operate the store and, where permitted, to understand website usage or support marketing activities.

Non-essential cookies are used in accordance with your choices provided through our cookie consent settings.

You can change your privacy choices where these controls are available on the website.

Shopify provides privacy and cookie-consent tools specifically for this purpose. Shopify Help Center

5. HOW WE SHARE INFORMATION

We may share personal information with service providers where necessary to operate the store and fulfil your order, including:

Shopify, which hosts and operates our e-commerce platform;
payment providers;
shipping and delivery providers;
technology or hosting providers;
professional advisers or authorities where required by law.

We only share information where necessary for these purposes or where legally required.

6. SHOPIFY

Our online store is hosted by Shopify.

Shopify processes certain personal information in order to provide the e-commerce services used by our store. In some circumstances, Shopify may act as a processor acting on our instructions, while certain Shopify services may involve Shopify processing information as an independent controller.

You can learn more about Shopify's processing of personal information through Shopify's Consumer Privacy Policy and Privacy Portal.

This section is worth keeping because your current template already correctly explains Shopify's role. Markdown collé Shopify also confirms that merchants are generally the controllers of customer data while Shopify may act as processor or, for some enhanced services, as controller. Shopify Help Center

7. INTERNATIONAL DATA TRANSFERS

Some service providers, including Shopify, may process information outside Spain or the European Economic Area.

Where personal information is transferred internationally, appropriate safeguards are used where required by applicable data protection law, such as adequacy decisions or approved contractual safeguards.

8. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to fulfil orders, maintain appropriate business records, comply with legal and tax obligations and resolve disputes.

Retention periods may vary depending on the type of information and the applicable legal requirements.

The RGPD specifically requires either a retention period or the criteria used to determine it.

9. YOUR RIGHTS

If applicable under data protection law, you may have the right to:

access your personal information;
correct inaccurate information;
request deletion of your information;
request restriction of processing;
object to certain processing;
receive certain information in a portable format;
withdraw consent where processing is based on consent.

Withdrawing consent does not affect processing carried out before the withdrawal.

You may exercise these rights by contacting us using the details below.

You also have the right to lodge a complaint with the competent data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

These rights correspond to the transparency information expected under the RGPD.

10. SECURITY

We use appropriate organisational and technical measures, together with the security measures provided by Shopify and our service providers, to protect personal information.

However, no method of electronic transmission or storage can guarantee absolute security.

11. CHILDREN

Our online store is not specifically directed at children, and we do not knowingly collect personal information from children in circumstances where parental consent would be required by applicable law.