Privacy policy

Controller and privacy contact

The actual business is responsible for processing personal data. Its full identity and contact details must be confirmed in the legal notice. You can currently use Contact for a data-protection enquiry.

Which data is processed and why

• Website and security: Technical access information, such as an IP address, time, requested address and status, may be processed for delivery, abuse prevention and troubleshooting. The basis is the legitimate interest in secure operation, Article 6(1)(f) GDPR.
• Enquiries: Your name, email, subject and message are stored to handle your enquiry. Depending on its purpose, Article 6(1)(b) or (f) GDPR applies. Share only information needed for your enquiry.
• Account and bag: Sign-in information, saved details and your selection support the account functions you request and preparation of an order. Credentials are protected; earlier orders are associated only after any required email verification.
• Your images and contributions: Uploaded files support the requested preview or handling. An upload does not grant general permission to publish it. Customer contributions are reviewed before publication; the relevant consent and statutory rights remain applicable.
• Orders: Where orders are offered and processed, contact, billing, delivery and order data are required to perform the contract. Statutory retention is based on Article 6(1)(c) GDPR.

Cookies and optional services

Storage required for a requested function is separate from optional preferences, statistics, marketing and external media. Optional services are activated only with a valid choice where they are actually available. See Cookies & services for current categories, providers and durations.

You can change or withdraw your choice through “Privacy settings” in the footer. Withdrawal does not affect the lawfulness of earlier processing covered by valid consent.

Recipients and transfers

Technical service providers may receive necessary data for operation and security. Optional services use the providers and purposes listed for those services. The current service declaration contains available provider information. A transfer outside the European Economic Area requires a suitable data-protection basis; further recipient and safeguard details will be added with the confirmed business profile.

Retention

Data is retained only as long as required by its purpose and applicable retention duties. Account functions govern account data; handling and any necessary evidence govern enquiries; statutory periods govern orders. Temporary preview files are time-limited. The current service declaration lists browser-storage durations. Erasure requests are assessed alongside any remaining legal obligations.

Your rights

• Within the applicable legal conditions, you can request access, correction, erasure or restriction of processing.
• You have a right to data portability where its legal conditions apply.
• You can object to processing based on legitimate interests and withdraw optional consent for the future.
• You can complain to a competent data-protection authority. Contacting Walluro first is not a condition of that right.

A proportionate identity check may be needed to handle a rights request. Do not send identity-document copies or sensitive information without being asked.

Further information

See the General Data Protection Regulation and current cookie and service information. These notices are updated when actual processing changes.