Privacy Policy | Based.shop

Who is responsible

The controller for personal data processed on based.shop is:

[Company legal name][Street and number][Postcode City][Country][Commercial register], registration no. [Company registration number]VAT ID: [VAT ID]

For any privacy question or request, email [email protected].

What we collect and why

Orders: name, shipping address, email, phone number (if you give one), the items you buy and payment status. We use them to make, ship and support your order and to send you order and shipping emails. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Payment: payments are processed by our payment provider. We receive the payment status and limited details such as the card type, never the full card number.
Account (only if you create one): email, password (stored hashed), name, saved addresses and order history. Legal basis: contract.
Accounting: order and invoice records we must keep by law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Security and operation: IP address, browser details and server logs, to run the site, keep it secure and prevent fraud and abuse. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
Messages: what you send us when you contact us, to answer you. Legal basis: contract or legitimate interests.

We don’t use analytics or advertising trackers, and we don’t sell your data.

Who we share it with

Printful (and its production partners) prints and ships your order and receives the delivery details it needs.
Shipping carriers deliver your parcel.
Stripe processes payments.
OVHcloud hosts our servers and files in the EU.
Cloudflare delivers the site and protects it from attacks.
[Email provider] sends our emails.
Authorities, when the law requires it.

Some of these companies process data outside the EU, mainly in the USA. Where they do, the transfer relies on the EU–US Data Privacy Framework (for certified companies) or on the European Commission’s Standard Contractual Clauses.

How long we keep it

Order and accounting records: as long as tax and accounting law requires (up to 10 years).
Your account: until you delete it or ask us to.
Server logs: a few weeks.

Cookies

We only use cookies the shop needs to work and cookies that remember choices you make. No analytics or advertising cookies, so there is no cookie banner. Your light/dark theme choice is kept in your browser’s local storage.

Cookie	Purpose	Duration
vendure-auth-token	Keeps your cart and checkout together and keeps you signed in. Necessary.	Up to 1 year
based-options	Remembers the size, color and phone model you picked, so products open with them. Set only when you pick one.	1 year
vendure-currency	Remembers the currency you chose. Set only if you change it.	1 year
NEXT_LOCALE	Remembers the language you chose. Set only if you change it.	Until you close the browser
__cf_bm and similar	Set by Cloudflare to tell people from bots and protect the site. Necessary.	Up to 30 minutes

Your rights

You can ask for access to your data, correction, deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interests. Email us at [email protected]. You can also complain to [Data protection authority, website] or to the data protection authority where you live.

Children

based.shop is not meant for children under 16, and we don’t knowingly collect their data.

Changes

We may update this policy. The date at the top shows the latest version.