Privacy Policy

XVI Jewellery — Jacky Brown (sole trader)
[Street and number], [Postcode] [City], France
Email: hello@xvi-jewels.com
VAT: [VAT / TVA number] · Registration: [Company / SIRET number]

• Account data — email address and authentication details when you create an account or sign in.
• Order data — name, delivery and billing address, email, the items and configuration you ordered, order status and history.
• Payment data — handled by our payment provider. We receive only the payment status and limited details (such as the last digits of the card or the payment method used). We never store full card numbers.
• Consultation data — email address and the information you share during a booked session.
• Waiting list data — email address if you join the Canvas & Carats list.
• Technical data — IP address, device and browser information, and server logs, generated automatically when you visit.

• To perform a contract with you — processing orders, payments, delivery, returns and consultations (Art. 6(1)(b) GDPR).
• To comply with legal obligations — tax, accounting and invoicing records (Art. 6(1)(c) GDPR).
• For our legitimate interests — securing the site, preventing fraud, and answering your enquiries (Art. 6(1)(f) GDPR).
• With your consent — non-essential cookies, analytics and marketing emails (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

We share data only with processors who help us run the business, under data processing agreements: our hosting and database provider, our payment provider (Stripe), our email delivery provider, and — if enabled and consented to — our analytics provider. Some of these providers may process data outside the EEA; where that happens, transfers are covered by the EU Standard Contractual Clauses or an adequacy decision.

Order and invoice records are kept for the statutory retention period (up to 10 years for accounting purposes). Account data is kept until you delete your account. Waiting list and marketing data is kept until you unsubscribe. Server logs are kept for a short period for security purposes.

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Write to hello@xvi-jewels.com and we will respond within one month. You also have the right to lodge a complaint with your local data protection authority.

Details of the cookies we use, and how to change your choices, are in our Cookie Policy.

We may update this policy as the business or the law changes. The current version is always published on this page.