Privacy policy

Last updated: August 18, 2026

AmberSole ("AmberSole", "we", "us", or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you visit our website, create an account, place an order, communicate with us, or otherwise use our services.

It also explains your rights under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable European data protection and privacy laws.

1. Who We Are

AmberSole is an online retailer offering footwear and related products to customers in Europe.

Prices and transactions on our store are generally displayed and processed in euros (EUR / €) unless otherwise stated at checkout.

For the purposes of the GDPR, AmberSole acts as the data controller for personal data collected through our website, except where another organisation independently determines how certain data is processed.

For privacy-related questions or requests, please contact us using the contact details provided on our website.

2. Personal Data We Collect

2.1 Information You Provide Directly

This may include:

• First and last name;
• Email address;
• Telephone number;
• Billing address;
• Shipping address;
• Account login information;
• Order number and purchase history;
• Products purchased;
• Order value in EUR (€);
• Delivery instructions;
• Returns, exchanges, and refund information;
• Communications with our customer support team;
• Reviews, feedback, and survey responses;
• Marketing preferences.

2.2 Payment Information

Payments are generally processed by third-party payment providers.

AmberSole may receive limited payment-related information such as:

• Payment method;
• Payment status;
• Transaction identifier;
• Last digits of a payment card where provided by the payment processor.

Full payment card details are generally collected and processed directly by the relevant payment provider and are not stored by AmberSole unless specifically indicated otherwise.

2.3 Information Collected Automatically

When you browse or use our website, we may automatically collect information such as:

• IP address;
• Browser type and version;
• Device type;
• Operating system;
• Device identifiers;
• Approximate location derived from IP address;
• Language and time-zone settings;
• Referring website;
• Pages and products viewed;
• Links clicked;
• Time spent on pages;
• Shopping-cart activity;
• Checkout activity;
• Cookie and similar technology identifiers.

2.4 Information From Third Parties

We may receive personal data from third parties involved in operating our business, including:

• Payment providers;
• E-commerce platforms;
• Shipping companies;
• Fulfilment providers;
• Fraud-prevention providers;
• Analytics providers;
• Advertising platforms;
• Customer-support platforms.

We only use such information where we have a lawful basis to do so.

3. Special Categories of Personal Data

AmberSole does not intentionally request or collect special categories of personal data, such as information concerning:

• Racial or ethnic origin;
• Religious or philosophical beliefs;
• Political opinions;
• Trade union membership;
• Genetic data;
• Biometric data used for identification;
• Health information;
• Sexual orientation or sex life.

Please do not provide this type of information unless it is genuinely necessary and specifically requested.

4. How We Use Personal Data

Order Processing and Fulfilment

We use personal data to:

• Process purchases;
• Confirm orders;
• Process payments;
• Arrange fulfilment;
• Ship and deliver products;
• Provide tracking information;
• Handle exchanges, returns, and refunds.

Customer Support

We may use personal data to:

• Answer questions;
• Resolve complaints;
• Assist with orders;
• Investigate delivery issues;
• Provide after-sales support.

Account Management

Where customer accounts are available, we may process information to:

• Create and maintain your account;
• Authenticate your login;
• Store order history;
• Save preferences.

Fraud Prevention and Security

We may process information to:

• Detect suspicious transactions;
• Prevent fraudulent purchases;
• Protect our website and customers;
• Investigate unauthorised activity;
• Enforce our terms and policies.

Legal and Regulatory Compliance

We may process and retain information where necessary to comply with:

• Tax obligations;
• Accounting requirements;
• Consumer protection laws;
• Fraud-prevention obligations;
• Legal claims;
• Requests from courts, regulators, or other authorities.

Marketing

Where legally permitted, we may use your personal data to send:

• Promotional emails;
• Product updates;
• New-release information;
• Special offers;
• Abandoned-cart communications;
• Relevant product recommendations.

Where consent is required, marketing will only be sent after obtaining that consent.

You may withdraw your marketing consent at any time.

Analytics and Website Improvement

Where permitted by law and, where required, with your consent, we may use analytics information to understand:

• How visitors use our website;
• Which products receive the most interest;
• How customers navigate our store;
• The effectiveness of advertising campaigns;
• How we can improve our website and services.

5. Legal Bases for Processing

Under the GDPR, we must have a lawful basis for processing personal data.

Depending on the circumstances, we may rely on the following legal bases.

Performance of a Contract

Processing is necessary to fulfil our contract with you, for example when:

• Processing an order;
• Taking payment;
• Shipping your products;
• Managing a return or refund.

Legal Obligation

Processing may be necessary to comply with legal requirements such as:

• Accounting;
• Tax reporting;
• Consumer protection;
• Regulatory obligations.

Legitimate Interests

We may process personal data where necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms.

Examples may include:

• Fraud prevention;
• Network and website security;
• Business analytics;
• Improving customer service;
• Establishing or defending legal claims.

Consent

We rely on consent where required, including for certain:

• Marketing communications;
• Advertising cookies;
• Analytics cookies;
• Tracking technologies.

You may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

6. How We Share Personal Data

We do not disclose personal data unnecessarily.

We may share data with service providers that help us operate AmberSole.

E-Commerce Providers

Providers that host, maintain, or support our online store and process customer and order data.

Payment Providers

Companies that process and authorise payments, manage fraud prevention, and handle transaction records.

Shipping and Fulfilment Providers

Carriers, warehouses, suppliers, fulfilment centres, and logistics providers may receive details necessary to deliver your order, such as:

• Name;
• Shipping address;
• Telephone number;
• Email address;
• Order information.

Customer-Support Providers

Platforms used to manage customer enquiries and support requests.

Analytics Providers

Subject to applicable consent requirements, we may use analytics services to understand website performance and customer behaviour.

Advertising and Marketing Providers

Where permitted by law and subject to applicable consent requirements, information may be processed by advertising, email marketing, and social media platforms.

Professional Advisers

We may disclose personal data to advisers such as:

• Lawyers;
• Accountants;
• Auditors;
• Tax professionals.

Public Authorities

We may disclose information where required by:

• Law;
• Court order;
• Regulatory authority;
• Law enforcement request;
• Other legally binding process.

Business Transfers

If AmberSole is involved in a merger, restructuring, financing, acquisition, or sale of business assets, personal data may be transferred as part of that transaction, subject to applicable law.

7. Cookies and Similar Technologies

AmberSole may use cookies and similar technologies on its website.

Strictly Necessary Cookies

These cookies are necessary for the website to function correctly and may support:

• Shopping-cart functionality;
• Checkout;
• Account login;
• Security;
• Fraud prevention;
• User authentication.

Where these cookies are strictly necessary to provide a service requested by the user, consent may not be required.

Functional Cookies

These cookies may remember choices such as:

• Language;
• Region;
• Saved preferences;
• Website settings.

Analytics Cookies

Analytics cookies help us understand how visitors use our website.

Where required under European privacy rules, these cookies will only be activated after receiving your consent.

Advertising and Targeting Cookies

These cookies may be used to:

• Measure advertising effectiveness;
• Create advertising audiences;
• Display more relevant advertisements;
• Understand interactions with advertising campaigns.

Where consent is legally required, these technologies will not be activated until you have given permission.

8. Cookie Preferences

Where applicable, you can manage cookie preferences through the cookie consent tool available on our website.

You should be able to reject or withdraw consent for non-essential cookies without affecting access to basic website functionality.

You may also control cookies using your browser settings.

Disabling strictly necessary cookies through your browser may cause certain website features to stop functioning properly.

9. Marketing Communications

If you subscribe to AmberSole marketing communications, we may send you information about:

• Products;
• Promotions;
• New releases;
• Discounts;
• Store updates.

You may unsubscribe at any time by clicking the unsubscribe link in a marketing email or using another unsubscribe method provided in the communication.

Where SMS marketing is offered, instructions for opting out will be included in the relevant message.

Order confirmations, shipping notices, security communications, refund updates, and other transactional messages are not considered marketing and may still be sent when necessary to provide our services.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods depend on:

• The type of information;
• The purpose of processing;
• Contractual obligations;
• Tax and accounting requirements;
• Consumer protection requirements;
• Applicable limitation periods;
• Legal and regulatory requirements.

For example, transaction records may be retained for several years where required for tax, accounting, legal, or consumer protection purposes.

Marketing information may be retained until you unsubscribe, withdraw consent, or the information is no longer necessary.

When personal data is no longer required, we will delete, anonymise, or otherwise securely dispose of it where reasonably possible.

11. Your GDPR Rights

Subject to the conditions and exceptions provided by applicable law, you may have the following rights.

Right of Access

You may request confirmation of whether AmberSole processes your personal data and obtain access to that information.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

In certain circumstances, you may request deletion of personal data.

This right does not always apply, particularly where we are required to retain information to comply with legal obligations or establish or defend legal claims.

Right to Restriction of Processing

In certain circumstances, you may request that we temporarily restrict the way your personal data is processed.

Right to Data Portability

Where applicable, you may request certain personal data in a structured, commonly used, machine-readable format and ask that it be transferred to another controller where technically feasible.

Right to Object

You may have the right to object to processing based on legitimate interests.

You also have the right to object to processing of your personal data for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

12. How to Exercise Your Privacy Rights

To exercise a privacy right, please contact AmberSole using the privacy or customer-support contact details provided on our website.

Please include enough information to allow us to identify your request.

We may request additional information where reasonably necessary to verify your identity and prevent unauthorised disclosure of personal data.

Under the GDPR, we generally aim to respond to valid requests within one month.

Where permitted by law, this period may be extended where a request is particularly complex or multiple requests are submitted.

If an extension is necessary, we will provide the required notice.

13. Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully, you may have the right to lodge a complaint with the competent data protection supervisory authority in the European Economic Area country where you live, work, or where the alleged infringement occurred.

We encourage you to contact AmberSole first so that we have an opportunity to address your concerns.

14. International Data Transfers

Some of AmberSole's service providers, suppliers, platforms, or technical infrastructure may be located outside the European Economic Area ("EEA").

As a result, personal data may be transferred to or processed in countries outside the EEA.

Where required by the GDPR, we will use an appropriate mechanism to protect international transfers.

Depending on the destination and circumstances, this may include:

• A European Commission adequacy decision;
• Standard Contractual Clauses approved by the European Commission;
• Another legally recognised transfer safeguard.

Where appropriate, supplementary measures may also be implemented.

15. Data Security

AmberSole uses reasonable technical and organisational measures designed to protect personal data from:

• Unauthorised access;
• Accidental loss;
• Destruction;
• Alteration;
• Unauthorised disclosure;
• Misuse.

These measures may include:

• Encryption during transmission;
• Secure payment processing;
• Restricted access to systems;
• Authentication controls;
• Fraud detection;
• Security monitoring.

However, no internet transmission or electronic storage method can guarantee absolute security.

16. Personal Data Breaches

If a personal data breach occurs, AmberSole will assess the incident and take appropriate action.

Where required by the GDPR, we will notify the competent supervisory authority.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals where required by law.

17. Children's Privacy

AmberSole's store is intended for customers who are legally permitted to purchase products through our website.

We do not knowingly seek to collect personal data from children in violation of applicable European data protection laws.

If you believe that a child has provided personal data to AmberSole unlawfully, please contact us so we can investigate and take appropriate action.

18. Third-Party Websites

Our website may contain links to:

• Social media platforms;
• Payment services;
• Delivery services;
• Other third-party websites.

AmberSole does not control the privacy practices of independent third parties.

When you leave our website, we recommend reviewing the privacy notice of the relevant third-party service.

19. Social Media and Advertising Platforms

AmberSole may maintain profiles or advertise on third-party platforms.

When you interact with AmberSole through those platforms, both AmberSole and the relevant platform may process personal data according to their respective roles and privacy policies.

Advertising and tracking technologies will be used in accordance with applicable consent requirements.

20. Fraud Prevention

To protect AmberSole and its customers, we may use information relating to orders, devices, payment attempts, IP addresses, or account activity to identify and prevent:

• Fraud;
• Chargeback abuse;
• Stolen payment methods;
• Account misuse;
• Other suspicious activity.

Where we rely on legitimate interests for such processing, we consider the necessity of the processing and its potential impact on your rights.

21. Automated Processing

Certain service providers may use automated systems to help identify potentially fraudulent or high-risk transactions.

Where automated processing produces a legal or similarly significant effect and the GDPR provides additional rights, those rights will be respected.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our services;
• Changes to the technologies we use;
• New service providers;
• Changes to legal requirements;
• Changes to our data-processing practices.

When we make changes, we will update the "Last updated" date shown at the beginning of this policy.

Where required by law, material changes may also be communicated through an additional website notice or other appropriate method.

Contact Us

If you have questions about this Privacy Policy, how AmberSole processes your personal data, or if you wish to exercise a privacy right, please contact AmberSole Customer Support through the contact details available on our website.

When submitting a privacy request, please include sufficient information to help us identify your account or order while avoiding unnecessary sensitive personal information.