Last updated: 28 September 2026
This policy explains what personal data WinterDrops collects when you visit this website or buy from us, why, and what rights you have under the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.
1. Who is responsible
The controller of your personal data is the business operating WinterDrops, identified with its full name and address in our Legal Notice. You can reach us about privacy at any time at support@winterdrops.com or through our contact form.
2. What we collect and why
- Your order details (name, email, shipping and billing address, phone if you give it, items, gift message): to process, ship and support your order, including returns and warranty claims. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Invoices and order records: for accounting and tax obligations. Legal basis: legal obligation (Art. 6(1)(c)).
- Messages you send us (name, email, order number, message): to answer your question. Legal basis: our legitimate interest in replying to you (Art. 6(1)(f)), or contract if it is about an order.
- Newsletter email address: to send gift ideas, offers and Christmas delivery reminders. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw any time with the unsubscribe link.
- Device and browsing data from cookies: to run the shop (necessary cookies) and, only if you agree, for statistics. Legal basis: necessary cookies – legitimate interest / ePrivacy exemption; statistics – your consent.
- Payment data: to take payment. We never see or store your full card details; the payment provider handles them. Legal basis: contract.
We only ask for what we need. Fields marked optional can be left empty.
3. Who we share it with
- Shopify (Shopify International Limited, Ireland), which hosts our shop and processes data on our behalf. Shopify may transfer data to Canada and the United States under adequacy decisions or Standard Contractual Clauses.
- Our manufacturer and fulfilment partner, which packs and ships your order. We share only what is needed to deliver it: your name, shipping address, phone number if given, the items ordered and any gift message. For customers in the EU, this transfer outside the EU is necessary to perform your contract (Art. 49(1)(b) GDPR).
- Delivery carriers, to deliver your parcel and provide tracking.
- Payment providers (such as Shopify Payments and PayPal), to process your payment and prevent fraud.
- Email, chat, review and tracking services we use to send order emails, answer your messages, send the newsletter (if you subscribed), review requests and tracking updates.
- Authorities, where the law requires it.
We never sell your personal data.
4. How long we keep it
- Order and invoice records: 10 years, as required by Luxembourg commercial and tax law.
- Customer service messages: up to 3 years after our last contact.
- Newsletter: until you unsubscribe.
- Cookies: see our Cookie Policy.
5. Your rights
You have the right to access, correct or delete your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting earlier processing. To use these rights, email support@winterdrops.com or use the contact form. We reply within one month.
You can also complain to a data protection authority, in particular in the country where you live. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), cnpd.public.lu.
US residents: depending on your state, you may have similar rights to know, correct and delete your data and to opt out of targeted advertising. Use the Your Privacy Choices page or contact us.
6. Security
Our shop and checkout run on Shopify with encrypted (HTTPS) connections and PCI DSS-compliant payment processing.
7. Children
Our shop is not intended for children under 16 and we do not knowingly collect their data.
8. Changes
We will update this page if our practices change and show the date of the latest version at the top.