Data Controller
, registered at , is the data controller for personal data processed in connection with DrapVyn and drapvyn.com, except where another party acts as an independent controller under applicable law.
Privacy contact: privacy@drapvyn.com.
Personal Data We Process
Orders: name, billing and delivery details, contact details, products ordered, order status and related transaction records.
Payments: payment status, transaction identifiers and limited payment metadata required to complete or reconcile a transaction. Card payments are processed through Stripe.
Customer service: messages, support history and information you provide when contacting us about an order, return, refund, exchange or other request.
Technical information: IP address, device/browser information, timestamps, security logs and similar technical data needed to operate, secure and troubleshoot the website.
Cookies: cookie identifiers and preference data where cookies are used, enabled or consented to as described in the Cookie Policy.
Why We Process Personal Data
Contract performance: to process orders, take payment, arrange delivery, provide tracking, handle returns, refunds and exchanges, and respond to service requests.
Legal obligations: to meet accounting, tax, consumer-protection, fraud-prevention and other legal requirements that apply to us.
Legitimate interests: to operate and improve the website, prevent misuse, secure systems, investigate fraud, manage disputes and maintain business records where those interests are not overridden by your rights.
Consent: where consent is required for optional cookies or another processing activity, you may withdraw consent at any time without affecting prior lawful processing.
Data Security
We use reasonable administrative, technical and organisational safeguards designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction. Measures may include HTTPS/TLS encryption in transit, controlled account access, role-appropriate permissions, authentication controls, data minimisation, security logging, software and system updates, and service-provider access restrictions.
Access to personal data is limited to personnel and service providers who need it for legitimate business functions and who are subject to appropriate confidentiality or contractual obligations. We also review service-provider roles and restrict access to the information reasonably necessary for the service being provided.
No online system can eliminate every security risk. If we become aware of a personal-data breach that requires notification under applicable law, we will handle the assessment and notification in accordance with those legal requirements.
Payment Processing
Card payments are processed through Stripe. We do not ask you to send your full card number, CVV/CVC, PIN or other card security code through ordinary customer-service email. Payment providers may process personal data under their own legal obligations and privacy terms.
Service Providers and International Transfers
We may use service providers for hosting, payment processing, order fulfilment, delivery, customer support, security and other operational functions. They receive only the data reasonably needed for their role and are expected to handle it under appropriate contractual and legal safeguards.
Where personal data is transferred internationally, we use the transfer mechanism or safeguards required by applicable data-protection law, where required.
Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including order fulfilment, customer support, accounting, legal compliance, fraud prevention, dispute resolution and enforcement of agreements. Retention periods may differ by data category and applicable legal requirement.
Your Data Protection Rights
Access and rectification: request access to personal data and correction of inaccurate or incomplete data.
Erasure and restriction: request deletion or restriction where the legal conditions are met.
Portability: receive qualifying data in a structured, commonly used and machine-readable format where applicable.
Objection: object to certain processing based on legitimate interests or to direct marketing where applicable.
Withdrawal of consent: withdraw consent where processing relies on consent.
Complaint: lodge a complaint with an appropriate data-protection supervisory authority, subject to applicable law.
Privacy Contact
To exercise a data-protection right or ask a privacy question, contact privacy@drapvyn.com. We may request information reasonably necessary to verify identity and protect personal data before completing a request.