Privacy & Cookie Policy

The data controller responsible for your personal data is:
EcomData S.à r.l.-S (brand: Shenvo)
Luxembourg, Grand Duchy of Luxembourg
RCS Luxembourg: B296346
Email: contact@shenvo.lu

Shenvo is committed to protecting your personal data in accordance with the GDPR (Regulation (EU) 2016/679).

Shenvo collects the following categories of data:

• Identification data: name, first name, email address, phone number
• Delivery and billing data: full postal address
• Payment data: processed securely via Stripe/PayPal
• Browsing data: IP address, browser type, pages visited
• Account data: order history, preferences, wishlist

Shenvo processes your personal data for the following purposes:

• Order processing and delivery management
• Customer account management and commercial relationship
• Payment processing and fraud prevention
• Sending order confirmations and notifications
• Website improvement and experience personalisation
• Sending marketing communications (with your consent)

The processing of your data is based on the following legal grounds (GDPR Art. 6):

• Contract performance (Art. 6.1.b): order processing, delivery, payment
• Legal obligation (Art. 6.1.c): invoicing, accounting
• Legitimate interest (Art. 6.1.f): fraud prevention, website security
• Consent (Art. 6.1.a): newsletter, non-essential cookies

Shenvo retains your personal data for the following periods:

• Customer account data: duration of the commercial relationship + 3 years
• Order and invoice data: 10 years (legal accounting obligation)
• Browsing data and cookies: maximum 13 months
• Marketing data (newsletter): until unsubscription
• Fraud data: 5 years

After these periods, your data is deleted or anonymised.

Shenvo may share your personal data with the following third parties, strictly as necessary for service delivery:

- Payment providers: Stripe, Inc. (USA) and PayPal Holdings, Inc. (USA) — secure payment processing (PCI-DSS Level 1)
- Carrier: POST Luxembourg S.A. — for delivery of your orders
- Hosting provider: Render Services, Inc. (USA, San Francisco) — application and data hosting
- Media storage: Cloudinary Ltd (USA) — product image hosting
- Authentication: Google LLC (USA) — Google OAuth sign-in (optional)

Transfers to third countries (USA) are governed by Standard Contractual Clauses (SCCs) in accordance with GDPR Article 46.

Shenvo never sells your personal data to third parties.

In accordance with the GDPR, you have the following rights:

• Right of access (Art. 15)
• Right of rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction (Art. 18)
• Right to portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time

To exercise these rights: contact@shenvo.com (response within 30 days).
You can also lodge a complaint with the CNPD: cnpd.public.lu

A cookie is a small text file stored on your device. Shenvo uses the following categories:

🔒 Essential cookies (always active)
Necessary for the website: cart, session, security, language.

📊 Analytics cookies (with consent)
Audience analysis and site improvement. Anonymised data.

📣 Marketing cookies (with consent)
Personalised advertising and campaign measurement.

Manage your preferences via the cookie banner. Maximum storage: 13 months.

Shenvo implements technical and organisational measures to protect your personal data:

- SSL/TLS encryption of data in transit (HTTPS enforced)
- Secure hosting via Render Services, Inc. (San Francisco, USA)
- Media storage via Cloudinary Ltd with encryption at rest
- Internal access controls (strong authentication)
- Regular security audits
- Payments processed by Stripe and PayPal, PCI-DSS Level 1 certified
- No bank card data stored by Shenvo

For any questions relating to the protection of your personal data or to exercise your rights, contact us:

Email: contact@shenvo.lu
Subject: [Data Protection]

We respond within a maximum of 30 days in accordance with GDPR Article 12.

You may also lodge a complaint with the Luxembourg supervisory authority:
Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz — L-4370 Belvaux
https://cnpd.public.lu