Privacy Policy

1. Data Controller and Contact Information

Sraxylondrdrizae.world operates as the data controller for all personal data processed through our website and services. Our registered address and full contact details are:

For any privacy-related inquiries, data subject requests, or concerns, please contact us using the details above. We aim to respond to all legitimate requests within 30 days.

2. Personal Data We Collect

We may collect and process the following categories of personal data, depending on your interactions with our website and services:

• Identity data: Your full name, title, and any identification you voluntarily provide when placing orders or contacting us.
• Contact data: Email address, telephone number, postal address, and any other contact information you provide for order fulfillment or communication purposes.
• Transaction data: Details of purchases you have made, including order history, payment information (processed securely by third-party payment providers), and delivery preferences.
• Communication data: Messages, inquiries, feedback, and correspondence you send to us via email, contact forms, or other channels.
• Technical data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, device information, and other technology on the devices you use to access our website.
• Usage data: Information about how you use our website, including pages visited, time spent on pages, page interaction information (such as scrolling, clicks, and mouse-overs), and navigation paths.
• Marketing and communications data: Your preferences in receiving marketing from us and your communication preferences, where you have opted in.

3. Purposes of Processing

We process your personal data for the following lawful purposes:

• To process and fulfill your orders, including payment processing, shipping, and delivery coordination.
• To send order confirmations, shipping notifications, and delivery updates.
• To respond to your inquiries, support requests, and feedback.
• To improve our website, products, and services through analysis of usage patterns and customer feedback.
• To comply with legal obligations, including tax, accounting, and regulatory requirements.
• To communicate with you about our products, promotions, and news (only where you have given explicit consent).
• To detect, prevent, and address fraud, security issues, and technical problems.
• To administer and protect our business and website, including troubleshooting, data analysis, testing, and system maintenance.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data on the following legal bases:

• Contract: Processing necessary to perform our contract with you (e.g., fulfilling orders, providing customer support).
• Consent: Where you have given clear, specific, and informed consent (e.g., marketing communications, non-essential cookies). You may withdraw consent at any time.
• Legitimate interests: Where processing is necessary for our legitimate business interests (e.g., improving our services, fraud prevention, website security), provided your interests and fundamental rights do not override those interests.
• Legal obligation: Where processing is necessary to comply with a legal obligation to which we are subject.

5. Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements:

• Order and transaction data: 7 years from the date of the last transaction, in accordance with tax and accounting regulations.
• Marketing consent data: Until you withdraw consent or unsubscribe from our communications.
• Technical and usage logs: Up to 12 months, unless a longer retention period is required for security or legal purposes.
• Cookie data: As specified in our Cookie Policy, depending on the type of cookie.
• Customer support correspondence: Up to 3 years from the date of the last communication.

After the retention period expires, we securely delete or anonymize your data so that it can no longer be associated with you.

6. Your Rights Under GDPR and New Zealand Law

You have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data ("right to be forgotten") in certain circumstances.
• Right to restriction: Request that we limit how we process your data in certain situations.
• Right to data portability: Receive your data in a structured, commonly used, machine-readable format and have it transferred to another controller.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at office@sraxylondrdrizae.world. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, such as the Office of the Privacy Commissioner in New Zealand or your local data protection authority.

7. Data Security Measures

We implement robust technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• HTTPS/TLS encryption for all data transmitted between your browser and our servers.
• Secure storage with access controls, including role-based access and authentication.
• Regular security assessments, vulnerability scanning, and penetration testing.
• Limited access to personal data on a strict need-to-know basis.
• Employee training on data protection and privacy best practices.
• Incident response procedures to address any data breaches promptly.

8. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service providers: Hosting providers, payment processors, shipping and logistics partners, email service providers, and analytics providers, all bound by data processing agreements and confidentiality obligations.
• Legal and regulatory authorities: When required by law, court order, or to protect our legal rights.

All third-party processors are carefully selected and required to implement appropriate security measures and use your data only for the purposes we specify.

9. International Data Transfers

If we transfer your data outside the European Economic Area (EEA) or New Zealand, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or other mechanisms recognized under applicable law.

10. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.