Privacy Policy

1. Data Controller

The data controller is PopMods, an independent aftermarket accessories project.
Email: hello@royalpop.store

2. Data collected and purposes

We collect the following categories of data:

• Browsing data — IP address, browser type, pages visited, access times. Collected automatically to ensure site operation and security.
• Voluntarily provided data — name, email address, shipping address entered during checkout. Used solely to fulfil orders.
• Payment data — processed entirely by Stripe, Inc. PopMods does not store or access credit card numbers or banking details.

3. Legal basis for processing

• Contract performance (Art. 6(1)(b) GDPR) — order processing and shipment management.
• Consent (Art. 6(1)(a) GDPR) — marketing communications, where applicable and with explicit consent.
• Legitimate interest (Art. 6(1)(f) GDPR) — website security and fraud prevention.
• Legal obligation (Art. 6(1)(c) GDPR) — retention of fiscal data under Italian law.

4. Data retention

• Order data — retained for 10 years to comply with Italian fiscal obligations (D.P.R. 633/1972).
• Browsing data — retained for the session duration only, or until consent is withdrawn where applicable.
• Marketing data — retained until consent is withdrawn.

5. Data subject rights (Arts. 15–22 GDPR)

You have the right to:

• Access — obtain confirmation of processing and a copy of your data (Art. 15).
• Rectification — correct inaccurate or incomplete data (Art. 16).
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal obligations (Art. 17).
• Restriction — restrict processing in certain circumstances (Art. 18).
• Portability — receive your data in a structured, machine-readable format (Art. 20).
• Objection — object to processing based on legitimate interest (Art. 21).

To exercise your rights: hello@royalpop.store

6. Cookies

• Technical cookies — necessary for site operation. No consent required.
• Font — typefaces are served from the site’s own domain: to load them the site does not contact Google Fonts and does not transfer your IP address to third parties.
• Statistics — Microsoft Clarity and Google Analytics — with consent to the “Statistics” category. Microsoft Clarity collects masked interactions, clicks and scrolling to analyse usability and the purchase journey; input-field content is not recorded. Google Analytics measures site usage and, for purchases, may receive the transaction identifier, order value and purchased products.
• Marketing — Meta Pixel and Google Ads — with consent to the “Marketing” category, to measure campaigns, attribute conversions and show you products you viewed; this involves advertising profiling. For purchases, Google and Meta may receive a transaction identifier, order value, purchased products and normalised SHA-256-hashed contact data to improve attribution; clear-text data is not sent by the site. Meta may also receive this data server-side through the Conversions API, only when “Marketing” consent has been accepted.

You can change or withdraw your choice at any time through “Cookie preferences” in the footer.

7. Transfers outside the EU

With your consent, Google (Analytics and Ads), Meta and Microsoft (Clarity) may process data on servers located in the United States. These transfers are covered by the EU–US Data Privacy Framework (adequacy decision under Art. 45 GDPR), which ensures a level of protection equivalent to that in Europe.

Stripe, Inc. is certified under the same framework and operates in compliance with GDPR for payment data transfers.

8. Contact for exercising rights

For any request relating to the processing of your personal data, write to: hello@royalpop.store

You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

9. Updates to this policy

This Privacy Policy may be updated periodically to reflect legal or operational changes. The date of the last update is shown at the top of this page.