Privacy Policy

Who is responsible for your data

CONSTANTINVS is responsible for the data described here. For any question about this policy, or to exercise the rights described below, use the contact form at constantinvs.com/contact and we will reply to the address you give.

What we collect

We collect only what an order or an enquiry actually requires:

• Identity and contact details — name, email address, delivery and billing address, and phone number where you give one.
• Order data — the pieces you bought, sizes, prices, currency, order and shipment status, and any note you attach to an order.
• Account data — if you create an account: your email, a hashed password held by our authentication provider, membership tier and saved wishlist.
• Enquiry data — the content of contact form messages, product enquiries and newsletter sign-ups.
• Technical data — IP address, browser and device type, and pages viewed, collected in aggregate to keep the site working and secure.
• Payment data — card details are entered directly with our payment processor and never reach our servers. We store only the last four digits, card brand and the processor’s transaction reference.

Why we use it, and on what legal basis

To perform our contract with you: taking payment, fulfilling and shipping orders, handling returns and answering order questions.

For our legitimate interests: preventing fraud and abuse of discount codes, keeping the site secure, and understanding in aggregate which pages are used.

With your consent: marketing email, non-essential cookies and analytics. You can withdraw consent at any time, and withdrawal does not affect processing already carried out.

To comply with law: keeping tax, customs and accounting records.

Cookies and analytics

Essential cookies keep your cart, session and security protections working; they cannot be switched off without breaking the site. Analytics and marketing cookies only load after you accept them in the cookie banner, and rejecting them genuinely prevents those scripts from loading rather than merely recording your preference. Our cookie policy lists each category in full.

Who we share it with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share the minimum necessary with the service providers that make the shop work:

• Payment processing — Stripe, which handles card data under its own privacy policy.
• Hosting, database and email delivery — our backend and hosting providers, acting on our instructions.
• Shipping — the carrier handling your parcel, plus the customs authorities of the destination country.
• No analytics, advertising or CRM provider is currently installed on this site. If one is added, it will be named here and in the cookie policy before it loads.

International transfers

We operate from Indonesia and use providers located in the EU and the United States, so your data may be transferred outside your country. Where data leaves the EEA or the UK, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

How long we keep it

Order and invoice records: 10 years, as required for accounting and tax purposes.

Account data: for as long as your account exists. After closure there is a 30-day grace period, after which the data is permanently erased except where the law requires us to keep it.

Contact and enquiry messages: 24 months from your last contact with us.

Marketing email is opt-in only. You can withdraw consent at any time using the unsubscribe link in every message. We keep consent records until you unsubscribe, plus a suppression record so we do not contact you again.

Your rights

Under the GDPR you may request access to your data, correction of it, erasure, restriction of processing, portability in a machine-readable format, and you may object to processing based on legitimate interests. Where processing rests on consent you may withdraw it at any time.

Under the CCPA, California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and opt out of any sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA. You will not be treated differently for exercising any right.

To exercise any right, use the contact form at constantinvs.com/contact, giving the email address on your order. We reply within one month, and will ask for enough information to confirm your identity before acting.

If you are unhappy with our response you may complain to the data protection supervisory authority in your own country.

Children

The shop is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

When this policy changes materially we will update the date above and, where the change affects how we use data you have already given us, tell you by email.