Privacy Policy

Last updated: May 2026

1. Introduction

Royal Pop Style is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Belgian data protection law. This policy explains what data we collect, why, how we use it, and what your rights are.

2. Data Controller

Brahim Korkdan — Royal Pop Style
53 Rue de Schoppach, 6700 Arlon, Belgium
Company registration (BCE): 0869.820.081
VAT number: BE0869.820.081
Email: contact@royalpopstyle.com
Phone: +33 7 56 99 67 13

3. Personal Data We Collect

Identity data: first name, last name
Contact data: email address, phone number
Delivery data: shipping and billing address
Transaction data: order details, products purchased, payment method type (we do not store card numbers — payments are processed by Shopify Payments / PayPal)
Technical data: IP address, browser type, device type, pages visited, time spent on pages (collected via cookies and analytics tools)
Marketing data: your communication preferences (only if you opt in)

4. Purpose and Legal Basis

Purpose	Legal basis (GDPR)
Processing and fulfilling your order	Art. 6(1)(b) — Contract performance
Customer support and aftersales	Art. 6(1)(b) — Contract performance
Accounting and tax compliance	Art. 6(1)(c) — Legal obligation
Fraud prevention and website security	Art. 6(1)(f) — Legitimate interest
Website analytics and improvement	Art. 6(1)(f) — Legitimate interest
Marketing emails and newsletters	Art. 6(1)(a) — Consent (withdrawable at any time)

5. Data Sharing

We share your personal data only with trusted processors strictly necessary to operate our business:

Shopify Inc. — our e-commerce platform (data processor)
Payment processors (Shopify Payments, PayPal) — to handle transactions securely
Shipping carriers — name and delivery address only, to fulfil your order
Analytics providers (Google Analytics) — anonymised traffic data

We never sell, rent, or trade your personal data to third parties.

6. Data Retention

Order data: retained for 10 years in compliance with Belgian commercial and accounting law
Marketing data: retained until you unsubscribe
Technical logs: retained for 12 months
Cookie data: see our Cookie Policy below

7. Cookies

We use the following types of cookies:

Strictly necessary cookies: required for the website to function (shopping cart, checkout). Cannot be disabled.
Analytics cookies: help us understand how visitors use the site (Google Analytics). Only placed with your consent.
Marketing cookies: used to show relevant ads on third-party platforms. Only placed with your consent.

You can manage your cookie preferences at any time via the cookie banner on our website or your browser settings.

8. Your Rights (GDPR)

Under the GDPR, you have the right to:

Access the personal data we hold about you
Rectify any inaccurate or incomplete data
Erase your data (“right to be forgotten”), subject to legal retention obligations
Restrict or object to processing in certain circumstances
Data portability — receive your data in a structured, machine-readable format
Withdraw consent at any time for consent-based processing (e.g. marketing emails)

To exercise any of these rights, contact us at contact@royalpopstyle.com. We will respond within 30 days.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the Belgian Data Protection Authority (Autoriteit voor Gegevensbescherming / Autorité de protection des données):
www.autoriteprotectiondonnees.be
Rue de la Presse 35, 1000 Brussels, Belgium
+32 (0)2 274 48 00

10. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available at royalpopstyle.com/pages/privacy-policy. Material changes will be notified by email to registered customers.

10. Third-Party Data Processors

We use the following third-party services that may process your personal data on our behalf:

Processor	Purpose	Privacy Policy
Shopify Inc. (Canada)	E-commerce platform, payment processing, order management	shopify.com/legal/privacy
Google LLC (USA)	Analytics (GA4), advertising (Google Ads) -- only with consent	policies.google.com/privacy
Tidio LLC (USA)	Live chat and customer support	tidio.com/privacy-policy

All processors are bound by GDPR-compliant data processing agreements (DPAs). Data transfers outside the EEA (Google, Tidio) are protected under Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Data Retention

Data Category	Retention Period	Legal Basis
Order and transaction records	7 years	Belgian tax law obligation
Customer account data	Until account deletion + 1 year	Contract / Legitimate interest
Marketing email list	Until unsubscribe + 3 years	Consent
Analytics data (GA4)	13 months (Google default)	Consent
Chat logs (Tidio)	12 months	Legitimate interest
Cookie consent records	12 months (localStorage)	Legal obligation (GDPR Art.7)