Privacy Policy

Last updated: [date]. This is a framework draft — have it reviewed by a qualified lawyer before going live.

1. Who we are

Memento & Co. ("we", "us") operates this website. [Add your legal company name, registered address and contact email.]

2. What we collect

Order data: name, email, shipping address, phone, order details — processed to fulfil your order.
Payment data: processed by PayPal on their servers. We do not store card details.
Technical data: IP address, device and browser info, pages visited — via privacy-respecting analytics.
Newsletter: email address, only with your explicit consent.

3. Legal bases (GDPR / UK GDPR)

Contract — to fulfil your order.
Consent — marketing emails and non-essential cookies. Consent is opt-in and can be withdrawn anytime.
Legitimate interest — fraud prevention, site security.
Legal obligation — tax and accounting records.

4. Sharing

We share data only with processors necessary to run the store: PayPal (payments), shipping carriers, email service providers, hosting providers. We never sell personal data.

5. International transfers

Data may be processed outside your country (e.g. US-based services). Where required, transfers rely on adequacy decisions, Standard Contractual Clauses or equivalent safeguards.

6. Your rights

You may request access, correction, deletion, restriction or portability of your data, and object to processing. California residents have additional rights under CCPA/CPRA (know, delete, opt-out of sale/sharing). Contact us to exercise any right.

7. Retention

Order data is kept for as long as required by tax law (typically 5–7 years); marketing data until consent is withdrawn.

8. Contact

Email: qiaojingjian@gmail.com · [Add postal address for EU/UK controller or EU representative.]

This is a framework only and not legal advice. GDPR, UK GDPR, CCPA/CPRA and EU cookie rules require country-specific wording, a named controller/representative and a consent mechanism. Have this reviewed by a lawyer before launch.