Privacy Policy
What we collect when you visit, order or write to us, why we need it, who receives it and how long we keep it. In plain English, with your rights in your country.
1Who is responsible
Velvinci is a trading name of Parafresh LLC, a Wyoming limited liability company. Parafresh LLC decides how your personal data is used on velvinci.com and is responsible for it.
| Company | Parafresh LLC, trading as Velvinci |
|---|---|
| Email for privacy | [email protected] |
| Our atelier | Marrakech, Morocco |
This policy covers velvinci.com, our emails and your orders.
2What we collect and why
We only collect what you give us or what the shop needs to work and stay safe. Here it is, situation by situation.
When you order
- What
- Name, email, phone, delivery and billing address, the bags you order and the amounts. The shop also records the internet address (IP) and browser used to place the order.
- Why
- To make, ship and support your order, send order emails, handle returns, and spot fraud.
- Legal basis
- Our contract with you; tax and accounting law for the records; our legitimate interest in preventing fraud.
When you pay
- What
- Your card details go straight to Stripe. We never see or store your full card number. Stripe tells us the card type, the last four digits and whether the payment worked.
- Why
- To take the payment, refund it and protect it from fraud. Stripe may run automatic fraud checks on the payment.
When you create an account
- What
- Email, name, your password in scrambled form (we cannot read it), saved addresses and wishlist. For your safety we also note your last and previous sign-in: date, browser, type of device and country, but not your IP address. A coded device ID lets us email you if someone signs in from a new device.
- Why
- To run your account, show your orders and keep the account safe.
- Legal basis
- Our contract with you; our legitimate interest in account security.
When you sign in with Google
- What
- Google sends us your name, email and a Google account number. We do not receive your Google password, and we do not keep your photo or any Google access key.
- Why
- So you can sign in without a new password. You can disconnect Google in Account & security.
When you join the Atelier List
- What
- Your email address only.
- Why
- To send your welcome code and news from the atelier.
- Legal basis
- Your consent. You can unsubscribe at any time.
When you write to us
- What
- Name, email, topic, order number if you give one, and your message.
- Why
- To answer you and keep a record of what we promised.
When you browse
- What
- Your bag and a wishlist saved as a guest are kept in your browser. Our security systems see your IP address and browser, and record them only when a visit looks like an attack or a sign-in attempt.
- Why
- To keep your bag between pages and protect the shop and your account.
- Legal basis
- Our legitimate interest in a working, secure shop.
5Where your data is stored
Our web server is in France. Parafresh LLC is a US company, our atelier is in Morocco and some of our service providers work in other countries, so your data may be handled outside your own country.
When data from the EU, Norway or Switzerland goes to another country, we rely on the safeguards the law allows. Examples are the EU–US Data Privacy Framework, or the European Commission’s standard contractual clauses in our providers’ terms.
6How long we keep it
| Orders and invoices | As long as tax law requires, up to 10 years |
|---|---|
| Your account | Until you delete it |
| Atelier List | Until you unsubscribe |
| Messages to us | 2 years |
| Security records | Up to 30 days |
| Backup copies | Up to 30 days |
7How we protect it
- Every page is encrypted (HTTPS).
- Card numbers never reach our servers.
- Passwords are stored scrambled, so nobody can read them, not even us.
- A firewall, sign-in limits and alerts protect the shop and your account.
- You can turn on two-step sign-in for your own account.
If a breach ever put your data at risk, we would tell you and the authorities as the law requires.
8Your rights
Wherever you live, you can ask us what we hold about you, and ask us to correct or delete it. Signed in, go to Account & security → Your data to download or delete your data, or write to [email protected]. We answer within 30 days. We may ask you to confirm it is you.
Choose your country to see your main rights:
European Union (GDPR)
- Your rights
- See, correct or delete your data; limit or object to how we use it; get it in a file to take elsewhere; withdraw consent at any time, for example for the Atelier List.
- Legal bases
- Our contract with you (orders, account), the law (tax records), our legitimate interests (security, fraud prevention) and your consent (Atelier List).
- Complaints
- You can complain to the data protection authority in your country. We would like the chance to help first.
Norway (GDPR)
- Your rights
- The same as in the EU: see, correct, delete, limit, object, take your data elsewhere, withdraw consent.
- Complaints
- You can complain to Datatilsynet, the Norwegian data protection authority.
Switzerland
- Your rights
- Under the Swiss Federal Act on Data Protection you can see, correct and delete your data, and object to how it is used.
- Complaints
- You can contact the Federal Data Protection and Information Commissioner (FDPIC).
United States
- No sale, no sharing
- We do not sell your personal information or share it for targeted advertising, so there is nothing to opt out of.
- Your rights
- Depending on your state, for example California, you can ask to know, see, correct or delete the personal information we hold. We will not treat you differently for asking.
Canada
- Your rights
- You can see and correct the personal information we hold, and withdraw consent where you gave it.
- Complaints
- You can contact the Office of the Privacy Commissioner of Canada.
Australia
- Your rights
- Under the Australian Privacy Principles you can see and correct the personal information we hold.
- Complaints
- If our answer does not satisfy you, you can contact the Office of the Australian Information Commissioner (OAIC).
Singapore
- Your rights
- Under the PDPA you can see and correct your personal data, and withdraw consent.
- Complaints
- You can contact the Personal Data Protection Commission (PDPC).
United Arab Emirates
- Your rights
- Under the UAE data protection law you can see, correct and delete your personal data, and object to how it is used.
Hong Kong
- Your rights
- Under the Personal Data (Privacy) Ordinance you can ask to see and correct your personal data.
- Complaints
- You can contact the Office of the Privacy Commissioner for Personal Data (PCPD).
A short summary, not legal advice. Where it differs from the law of your country, the law wins.
9Emails from us
We send order and account emails because they are part of your order. We send news only if you joined the Atelier List or ticked the box at checkout. You can stop news at any time with the unsubscribe link in each email, or by writing to us.
10Children
Velvinci is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.
11Changes to this policy
We may update this policy. The date at the top shows the last change. If a change matters for you, we will tell you by email or on the site.
A question about your data?
Write to us and a real person answers. Email: [email protected]