Privacy

Who is responsible

The controller of your personal data is Diana Gainullina, trading as Sorelia Studio, Flat 102, Gianni Ikonomidi 5, 8574 Paphos, Cyprus. Write to hello@wearsorelia.com or telephone +357 99 463994 about anything on this page.

The shop is small enough that it has no data protection officer, and is not required to appoint one.

What we collect, and why we are allowed to

Each row is a thing we hold, what we do with it, and the ground in the GDPR that lets us.

• Your orderYour name, email address, delivery address, the shades and quantities, and any note you ask us to write on a card. To make and send your bag and to write to you about it. Because it is necessary to perform our contract with you (art. 6(1)(b)).
• A telephone numberOnly if you choose a parcel locker, because the carrier texts you the code that opens it. Necessary to perform our contract (art. 6(1)(b)).
• PaymentStripe takes your card details directly and we never see or hold them. We keep what Stripe hands back: the amount, the currency, whether it succeeded, and a reference. Necessary to perform our contract (art. 6(1)(b)).
• Your order historyThe record of what you bought, kept as part of our books. Because tax and accounting law requires us to keep it (art. 6(1)(c)).
• The lettersYour email address, once you have confirmed it by clicking the link we send. On your consent (art. 6(1)(a)), which you may withdraw at any time.
• The waitlistYour email address and the shade you are waiting for. On your consent (art. 6(1)(a)), which you may withdraw at any time.
• A message to usYour name, your email address and whatever you write, so that we can reply. Because it is necessary to answer you and to keep a record of what was said (art. 6(1)(b) and (f)).
• Your countryA short code for the country you appear to be visiting from, kept in a cookie, so that prices are shown in a sensible currency and the right delivery options are offered. In our legitimate interest in showing you a shop that works (art. 6(1)(f)).
• Requests to the siteYour IP address, briefly, so that forms and checkout cannot be flooded by a script. In our legitimate interest in keeping the shop standing and free of abuse (art. 6(1)(f)).
• The studio’s own doorWhen the owner signs in to the studio admin, the sign-in and the session are recorded. In our legitimate interest in keeping your order details behind a locked door (art. 6(1)(f)).

Who else sees it

A few services handle parts of this for us, on our instructions and no-one else’s. Each is given only what it needs to do its part, and none of them may use it for anything of their own.

• StripeOur payment provider. Your card details go to Stripe directly and never touch us. Stripe also decides some things about that payment for itself, as a controller, under its own privacy policy.
• The carrierCyprus Post, or BOX NOW if you choose a locker, is given the name, address and — for a locker — the telephone number needed to deliver the parcel. Choosing a locker opens BOX NOW’s own map in your browser, which they serve and which tells them you are looking at it; we hand them the parcel’s details later, when we book it.
• Email deliveryThe service that sends our emails is given your email address and what the message says — confirmations, letters and waitlist notes.
• Hosting and storageThe providers who run the site and keep the database in which your order and any sign-up are stored.
• Security and abuse preventionA service that counts recent requests, so that forms and checkout cannot be flooded. It sees an IP address, briefly, and nothing else about you.

We do not sell your details, we do not share them for anyone else’s marketing, and nothing on this site profiles you or decides anything about you automatically.

Where it goes

Some of these services are based outside the European Economic Area, or may process data there. Where that happens, the transfer rests on the European Commission’s standard contractual clauses or on a decision that the country offers adequate protection. Write to us if you would like details of the safeguards that apply.

How long we keep it

• OrdersFor as long as tax and accounting law requires the books to be kept, and then deleted.
• The lettersUntil you unsubscribe — there is a link in every letter — and then for ninety days before the record is deleted. An address that never confirms is deleted after thirty days.
• The waitlistUntil thirty days after we have written to you, or twelve months from joining, whichever comes first, and then deleted.
• MessagesFor as long as needed to answer you and to settle anything arising from it.
• Request recordsMinutes, not days. They are counters, and they expire.

The deletions happen by themselves, nightly, rather than when someone remembers.

Cookies and what the browser keeps

There is no tracking on this site. No analytics, no advertising, no pixels, no third-party scripts watching you — so there is nothing to consent to and no banner asking you to. What is stored is what the shop needs to work, and all of it is ours.

• sorelia.localeThe language you chose. A year.
• sorelia_ccThe country you appear to be in, for prices and delivery.
• sorelia_ccyThe currency to show.
• sorelia.receiptsA signed token proving this browser is the one that paid, so that only it can see your receipt. Thirty days.
• Your bag, and your countryKept in the browser’s own storage, on your device. They never reach us.
• The studio’s sign-inA session cookie, set only when the owner signs in to the admin.

Your rights

You may, at any time, ask us for:

• AccessA copy of what we hold about you.
• RectificationA correction, if something is wrong or out of date.
• ErasureDeletion, where we are not required to keep it.
• RestrictionThat we hold it but stop using it, while something is settled.
• PortabilityWhat you gave us, in a form you can take elsewhere.
• ObjectionThat we stop relying on our legitimate interest for a given purpose.
• Withdrawing consentFor the letters and the waitlist, at any time, without affecting what was lawful before.

Write to hello@wearsorelia.com. We answer within a month, and it costs you nothing.

If you think we have handled your details wrongly, you may complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority of the country you live in.