Privacy Policy — Ava's Rack

1. Introduction & Data Controller

Thank you for visiting our website. Below we explain how we handle your personal data when you use our site. Personal data means any information that can be used to identify you.

The data controller responsible for processing personal data on this website, under the General Data Protection Regulation (GDPR), is Ava's Rack.

Our website uses SSL/TLS encryption to protect the transmission of personal data and other sensitive content (such as orders or inquiries). You can recognize a secure connection by "https://" and the padlock icon in your browser's address bar.

We do not carry out any automated decision-making or profiling that produces legal effects or similarly significantly affects you, as defined in Art. 22 GDPR.

2. Data Collected When Visiting Our Website

When you visit our website purely to browse — without registering or submitting any information — we automatically collect data that your browser sends to our server ("server log files"). This includes:

• The page(s) visited
• Date and time of access
• Amount of data transferred
• The referring website or source
• Browser type and version
• Operating system used
• IP address (anonymized where applicable)

This data is processed under Art. 6(1)(f) GDPR, based on our legitimate interest in keeping our website stable, secure, and functional. We do not share or otherwise use this data, except where necessary to investigate suspected misuse of the site.

3. Cookies

We use cookies to make your visit to our website more enjoyable and to enable certain features. Cookies are small text files stored on your device. Session cookies are deleted once you close your browser; persistent cookies remain on your device so that we (or our partners) can recognize your browser on a future visit.

Cookies may collect information such as browser type, approximate location, and IP address. Some cookies help simplify your experience — for example, remembering items in your shopping cart. Where personal data is processed via cookies, this is done under Art. 6(1)(b) GDPR (to fulfill a contract) or Art. 6(1)(f) GDPR (our legitimate interest in a smooth, user-friendly website).

We may work with advertising partners to make our offers more relevant to you. If so, cookies from these partners may also be placed on your device, and you will be informed separately about their use.

On your first visit, you'll see a cookie banner asking for consent to non-essential cookies. You can change your preferences at any time. Please note that blocking cookies may limit some website functionality. Instructions for managing cookies are available in your browser's help settings (Chrome, Firefox, Safari, Edge, Opera).

4. Contacting Us

When you contact us — for example via a contact form or email — we collect the personal data included in your message. We use this data solely to respond to your inquiry and for related administrative purposes.

The legal basis is our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR), or, if your inquiry relates to a contract, Art. 6(1)(b) GDPR. We delete this data once your inquiry has been fully resolved, unless we are legally required to retain it longer.

5. Customer Accounts & Order Processing

When you place an order or create a customer account, we collect and process the personal data needed to fulfill the contract, under Art. 6(1)(b) GDPR. The specific data collected is shown in the relevant form.

You may delete your account at any time by contacting us. Once an order or account is closed, your data is restricted from further use and deleted after any legally required retention period (e.g. tax or commercial law), unless you've given separate consent for further use.

6. Marketing Communications

6.1 Newsletter Subscription

If you sign up for our email newsletter, we'll send you updates about our offers. Only your email address is required; any additional information is optional and used to personalize your experience.

We use a double opt-in process: after signing up, you'll receive a confirmation email, and your subscription only becomes active once you click the confirmation link (Art. 6(1)(a) GDPR). We log the IP address and timestamp of your sign-up to help prevent misuse.

You can unsubscribe at any time via the link in any newsletter email or by contacting us directly. Your email will be removed from our list promptly upon request.

6.2 Offers for Existing Customers

If you've previously provided your email address when placing an order, we may occasionally send you information about similar products or offers, based on our legitimate interest under Art. 6(1)(f) GDPR. You can opt out of this at any time, free of charge, by contacting us — we'll stop immediately.

7. Order Fulfillment & Payment Processing

To deliver your order, we share necessary personal data with our shipping providers. Payment details are shared with the relevant payment provider to process your transaction. The legal basis for this is Art. 6(1)(b) GDPR.

7.1 Payment Providers

Depending on the payment method you choose at checkout (e.g. credit card, PayPal, or other supported providers), your payment information is transmitted directly to that provider solely for the purpose of processing your payment. Some providers may conduct standard fraud-prevention or creditworthiness checks as part of their own processes. Please refer to your chosen payment provider's own privacy policy for full details on how they handle your data.

8. Review Requests

With your explicit consent (Art. 6(1)(a) GDPR), we may send you a one-time email inviting you to leave a review of your order. You can withdraw this consent at any time by contacting us.

9. Social Media Links

Our website may include links to our social media pages (such as Instagram or Facebook). These are simple links, not embedded plugins — visiting our site does not automatically send data to these platforms. Data is only exchanged if you actively click through and interact with the linked platform, at which point that platform's own privacy policy applies.

10. Analytics & Advertising

We may use website analytics tools to understand how visitors use our site, so we can improve the shopping experience. Where used, IP addresses are anonymized where technically possible, and data is not used to personally identify you. This processing is based on our legitimate interest in improving our website (Art. 6(1)(f) GDPR).

We may also run advertising campaigns (for example through Google or Meta) to reach people interested in our products. These platforms may use cookies to measure ad performance. Where consent is legally required for this type of tracking, we will ask for it via our cookie banner. You can manage your preferences at any time through your browser settings or via the Digital Advertising Alliance (www.aboutads.info).

11. Your Rights

Under applicable data protection law, you have the right to:

• Access — request information about the personal data we hold about you (Art. 15 GDPR)
• Rectification — request correction of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure — request deletion of your data, subject to legal exceptions (Art. 17 GDPR)
• Restriction — request that we limit processing under certain conditions (Art. 18 GDPR)
• Notification — be informed if your data was shared with third parties and rectified/erased/restricted (Art. 19 GDPR)
• Data portability — receive your data in a structured, machine-readable format (Art. 20 GDPR)
• Withdraw consent — at any time, without affecting past lawful processing (Art. 7(3) GDPR)
• Lodge a complaint — with your local data protection supervisory authority (Art. 77 GDPR)

Right to Object

Where we process your data based on legitimate interest, you may object at any time for reasons relating to your particular situation. If you object to processing for direct marketing purposes, we will stop immediately.

12. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described above, or as required by applicable tax and commercial law. Once these periods expire, your data is routinely deleted.

13. Contact

If you have any questions about this Privacy Policy or would like to exercise any of your rights, please contact us at:

info@avasrack.com