This Privacy Policy describes how powderpuffnest (“we”, “us”, or “our”), operating the website www.powderpuffnest.com, collects, uses, and discloses personal information when users (“you”) visit or make a purchase from the website, with operations based in Mexico and commercial activities directed to customers within Europe.
As the data controller, powderpuffnest determines the purposes and means of processing personal data collected through the website.
—
1. PERSONAL DATA COLLECTED
When visiting the website or executing a transaction, the following categories of personal information may be collected:
Contact & Order Information: Full name, billing address, shipping address, email address, and order transaction details.
Technical Information: IP address, browser type, operating system, and general device identifiers gathered via cookies and similar standard tracking tools.
—
2. LAWFUL BASIS AND PURPOSES OF PROCESSING
Personal data is collected and processed under the following lawful bases pursuant to European Data Protection Regulation (GDPR) standards:
Contractual Performance: Processing is necessary to process orders, fulfill shipments, and deliver customer support related to purchases.
Legal Obligation: Processing is necessary to comply with relevant tax, accounting, and statutory regulatory duties.
Legitimate Interests: Processing is conducted to maintain website integrity, prevent fraudulent activity, and ensure reliable server functionality.
—
3. PAYMENT PROCESSING
All monetary transactions are processed securely through our third-party payment service provider, Stripe.
When placing an order, payment card details (such as credit or debit card numbers, expiration dates, and security codes) are transmitted directly to Stripe’s secure infrastructure. powderpuffnest does not collect, store, or process raw payment card credentials on its servers. Stripe manages personal payment data in accordance with strict international standards, including PCI-DSS compliance and applicable privacy laws.
—
4. THIRD-PARTY DISCLOSURES
Personal data is disclosed only to third-party service providers performing operational functions on our behalf, including:
Hosting, website maintenance, and backend system providers.
Logistics and courier partners for physical order delivery.
Payment processing networks (Stripe).
Data is not sold, rented, or transferred to unauthorized third parties.
—
5. INTERNATIONAL DATA TRANSFERS
Because our operations are situated in Mexico and order fulfillment serves customers in Europe, personal data may be transferred, stored, and processed outside the European Economic Area (EEA). Where cross-border data transfers occur, appropriate safeguards are utilized—including Standard Contractual Clauses approved by relevant supervisory authorities—to maintain standard data protections.
—
6. DATA RETENTION
Personal data is retained only for as long as necessary to fulfill the purposes set out in this policy, including satisfying accounting, legal, and reporting requirements under applicable European and Mexican legislation.
Transactional & Financial Data: Retained for up to 10 years following transaction completion to satisfy tax and commercial book-keeping mandates.
General Customer Communication Data: Retained for up to 3 years after the final customer interaction.
Technical & Analytics Logs: Retained for up to 12 months.
Upon expiry of applicable retention thresholds, data is securely erased or anonymized.
—
7. YOUR DATA PROTECTION RIGHTS
Under applicable data protection laws, individuals located in Europe possess specific rights regarding personal data:
Right of Access: Request a copy of the personal data currently held.
Right to Rectification: Request correction of inaccurate or incomplete details.
Right to Erasure (“Right to be Forgotten”): Request deletion of data, subject to statutory record-keeping constraints.
Right to Restrict or Object: Limit or object to specific processing operations.
Right to Data Portability: Request transfer of data to another operational entity where technically feasible.
To exercise these rights, submit a written inquiry to sales@powderpuffnest.com.
—
8. DATA SECURITY MEASURES
Appropriate technical, administrative, and physical security measures are maintained to guard personal data against unauthorized access, loss, alteration, or disclosure. System controls, encrypted communications protocols, and access limitations are routinely monitored.
—
9. AMENDMENTS
This Privacy Policy may be updated periodically to reflect operational, legal, or regulatory adjustments. Revisions become effective immediately upon publication on the website.
—
10. CONTACT INFORMATION
For inquiries or formal communications regarding personal data handling:
powderpuffnest
Website: www.powderpuffnest.com
Email: sales@powderpuffnest.com