Privacy policy

At Amber Sole, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we collect when you visit our online store or make a purchase, how we use it, who we share it with, and the rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable European data protection laws.

1. Who We Are

Amber Sole is the data controller responsible for your personal data, which means we decide how and why it is processed. For any questions about this policy or your personal data, contact us at contact@ambersole.com.

2. Personal Data We Collect

We collect only the data needed to run our store and provide our services.

Information you provide to us

  • Identity and contact details: first name, last name, email address, telephone number, billing address and shipping address.
  • Account information: login credentials and preferences, if you create a customer account.
  • Order information: products purchased, order history, amounts paid in EUR, returns, refunds and withdrawals.
  • Communications: messages you send us by email or through our contact form, including customer service requests.
  • Marketing preferences: whether you have subscribed to our newsletter or other marketing communications.

Information collected automatically

  • Device and usage data: IP address, browser type, device type, operating system, pages viewed, time spent on pages, referring website and approximate location based on your IP address.
  • Cookies and similar technologies: see Section 8 below.

Payment information

Payments are processed by our secure third-party payment providers. Amber Sole does not store or have access to your full card details. We receive only limited information, such as the payment method, the last four digits of your card and confirmation that the payment succeeded.

3. How We Use Your Data and Our Legal Basis

The GDPR requires a lawful basis for each use of your personal data. We rely on the following:

| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing and delivering your orders, handling payments, returns, refunds and withdrawals | Performance of a contract |
| Creating and managing your customer account | Performance of a contract |
| Responding to your questions and customer service requests | Performance of a contract / Legitimate interests |
| Sending service messages such as order confirmations and shipping updates | Performance of a contract |
| Sending newsletters and marketing communications | Consent |
| Using non-essential cookies for analytics and personalised advertising | Consent |
| Improving our website, products and services, and preventing fraud | Legitimate interests |
| Meeting tax, accounting and other legal obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests |

When we rely on legitimate interests, we balance our interests against your rights and freedoms. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

4. Marketing Communications

We send marketing emails only if you have given your consent or, where permitted by law, if you are an existing customer who bought similar products from us and did not object. Every marketing email includes an "unsubscribe" link. You can also opt out at any time by contacting us at contact@ambersole.com.

5. Who We Share Your Data With

We never sell your personal data. We share it only with trusted parties that help us operate our business, and only as far as necessary:

  • E-commerce platform: our store runs on Shopify, which hosts our website and processes data on our behalf.
  • Payment providers: to process your payments securely and prevent fraud.
  • Shipping and logistics partners: to deliver your orders and process returns.
  • Email and marketing service providers: to send order notifications and, with your consent, newsletters.
  • Analytics and advertising providers: to understand how our website is used and, with your consent, to show relevant ads.
  • Professional advisers and authorities: accountants, legal advisers, or public authorities when the law requires it or to protect our legal rights.

All service providers acting on our behalf are bound by data processing agreements. They may use your data only according to our instructions and in compliance with the GDPR.

6. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA). In those cases, we make sure appropriate safeguards are in place, such as:

  • an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework where applicable; or
  • Standard Contractual Clauses approved by the European Commission.

You may request more information about these safeguards by contacting us.

7. How Long We Keep Your Data

We keep personal data only as long as needed for the purposes described in this policy:

  • Order and transaction data: for the period required by applicable tax and accounting laws, typically between 6 and 10 years depending on the Member State.
  • Customer account data: for as long as your account remains active. If you request deletion, we delete it unless we must retain certain data by law.
  • Marketing data: until you unsubscribe or withdraw your consent.
  • Customer service communications: for up to 3 years after your last contact, unless a longer period is needed to handle a legal claim.
  • Cookie data: according to the retention periods set out in our cookie banner and settings.

When the retention period ends, we securely delete or anonymise your data.

8. Cookies and Similar Technologies

We use cookies and similar technologies in line with the GDPR and the ePrivacy Directive. They fall into these categories:

  • Strictly necessary cookies: needed for the website to work, for example to keep items in your shopping cart and to complete checkout. These do not require consent.
  • Preference cookies: remember your choices, such as language and region.
  • Analytics cookies: help us understand how visitors use our website so we can improve it.
  • Marketing cookies: used to show you relevant advertising on other websites and platforms.

We place preference, analytics and marketing cookies only after you give consent through our cookie banner. You can change or withdraw your consent at any time through the cookie settings on our website or in your browser settings. Disabling certain cookies may affect how the website works.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access: obtain confirmation of whether we process your data and receive a copy of it.
  • Right to rectification: have inaccurate or incomplete data corrected.
  • Right to erasure ("right to be forgotten"): have your data deleted, unless we must keep it by law.
  • Right to restriction of processing: limit how we use your data in certain circumstances.
  • Right to data portability: receive your data in a structured, commonly used, machine-readable format, or have it sent to another controller.
  • Right to object: object to processing based on legitimate interests, and object at any time to direct marketing.
  • Right to withdraw consent: withdraw any consent you have given, at any time.
  • Rights related to automated decision-making: not be subject to decisions based solely on automated processing that significantly affect you. Amber Sole does not make such decisions.

To exercise any of these rights, email us at contact@ambersole.com. We will respond within one month of receiving your request. In complex cases, this period may be extended by two further months, and we will inform you if so. Exercising your rights is free of charge. We may ask you to verify your identity before acting on your request.

10. Right to Lodge a Complaint

If you believe we have processed your personal data unlawfully, you may lodge a complaint with the data protection supervisory authority in the EU Member State where you live, work, or where the alleged infringement took place. We would appreciate the chance to resolve your concern first, so please contact us beforehand.

11. Data Security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include SSL/TLS encryption, secure payment processing and restricted access to personal data. No method of transmission over the internet is completely secure, but we continuously work to protect your information.

12. Children's Privacy

Our store is not intended for children. We do not knowingly collect personal data from anyone under 16 years of age, or under the lower age set by the law of your Member State. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

13. Third-Party Links

Our website may contain links to third-party websites, such as social media platforms. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing any personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The updated version will be published on this page. If the changes are significant, we will notify you by email or through a notice on our website.

Contact

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or need any other help regarding your personal data, contact Amber Sole at:

Email: contact@ambersole.com