Privacy Policy

Herse Boutique ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit our website or make a purchase. This policy applies to customers worldwide and complies with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

1. Data Controller

Herse Boutique is the data controller responsible for your personal data. If you have any questions about this privacy policy or our data practices, please contact us at:

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, phone number
• Purchase Information: Billing and shipping addresses, payment details
• Communication Data: Correspondence with our customer service team
• Preferences: Marketing preferences, wishlist items, language settings

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent, click patterns, search queries
• Location Data: Country and city based on IP address
• Cookies: See our Cookie Policy for details

2.3 Information from Third Parties

• Payment processors (transaction confirmation, fraud prevention data)
• Shipping carriers (delivery status, tracking information)
• Analytics providers (aggregated website usage data)

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill your orders and provide our services
• Legitimate Interests: Fraud prevention, security, improving our services, and marketing (where applicable)
• Consent: Marketing communications, non-essential cookies, and newsletters
• Legal Obligation: Tax records, regulatory compliance, and responding to legal requests

4. How We Use Your Information

• Process and fulfill your orders, including shipping and payments
• Communicate with you about orders, shipping, and customer service inquiries
• Send marketing communications (with your consent where required)
• Personalize your shopping experience and product recommendations
• Detect and prevent fraud and unauthorized transactions
• Improve our website, products, and services
• Comply with legal obligations and enforce our terms
• Analyze website traffic and user behavior (in aggregated form)

5. Information Sharing

We do not sell, rent, or trade your personal information. We may share your data with:

5.1 Service Providers

• Payment Processors: Secure payment processing partners
• Shipping Carriers: International logistics providers for order delivery
• Email Services: For transactional and marketing emails
• Hosting Services: Secure data storage and processing
• Analytics: Website performance and usage analysis

5.2 Legal Requirements

We may disclose your information when required by law, to respond to legal process, to protect our rights, or to prevent fraud or illegal activity.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity with appropriate notice and protections.

6. International Data Transfers

Your information may be transferred to and processed in countries outside your residence. When we transfer data internationally, we implement appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Compliance with applicable data transfer frameworks

7. Data Retention

We retain your personal data only for as long as necessary:

• Account Data: Until account deletion plus 30 days for backup
• Order Data: 7 years for tax and legal compliance
• Marketing Data: Until consent withdrawal plus 30 days
• Analytics Data: 26 months in anonymized form
• Customer Service: 3 years from last interaction

8. Your Rights

8.1 Rights for All Users

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Opt-out: Unsubscribe from marketing communications

8.2 Additional Rights for EEA/UK Residents (GDPR)

• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time without affecting prior processing
• Complaint: Lodge a complaint with your local data protection authority

8.3 California Residents (CCPA/CPRA)

California residents have the following additional rights:

• Know: Request disclosure of personal information collected, used, and shared
• Delete: Request deletion of personal information
• Opt-Out: Opt-out of the sale or sharing of personal information (we do not sell your data)
• Non-Discrimination: Equal service regardless of exercising privacy rights
• Correct: Request correction of inaccurate personal information
• Limit Use: Limit use of sensitive personal information

To exercise your CCPA rights, email us at [email protected] or call +1 (234) 567-890.

9. Data Security

We implement comprehensive security measures to protect your personal data:

• TLS/SSL encryption for all data transmission
• PCI DSS compliant payment processing
• Regular security assessments and penetration testing
• Access controls and employee training
• Secure data centers with physical security measures
• Incident response procedures for data breaches

10. Children's Privacy

Our website is not intended for individuals under 16 years of age (or 13 in the US). We do not knowingly collect personal information from children. If you believe we have collected data from a minor, please contact us immediately at [email protected].

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

12. Changes to This Policy

We may update this privacy policy periodically. We will notify you of material changes by posting a notice on our website or sending you an email. Your continued use of our services after changes indicates acceptance of the updated policy.

14. Supervisory Authorities

If you are located in the EEA or UK and wish to file a complaint, you may contact your local data protection authority. A list of EEA data protection authorities is available at:

European Data Protection Board - Members