Privacy Policy

1. Data Controller

The data controller is PopMods, an independent aftermarket accessories project.
Email: hello@royalpop.store

2. Data collected and purposes

We collect the following categories of data:

• Browsing data — IP address, browser type, pages visited, access times. Collected automatically to ensure site operation and security.
• Voluntarily provided data — name, email address, shipping address entered during checkout. Used solely to fulfil orders.
• Payment data — processed entirely by Stripe, Inc. PopMods does not store or access credit card numbers or banking details.

3. Legal basis for processing

• Contract performance (Art. 6(1)(b) GDPR) — order processing and shipment management.
• Consent (Art. 6(1)(a) GDPR) — marketing communications, where applicable and with explicit consent.
• Legitimate interest (Art. 6(1)(f) GDPR) — website security and fraud prevention.
• Legal obligation (Art. 6(1)(c) GDPR) — retention of fiscal data under Italian law.

4. Data retention

• Order data — retained for 10 years to comply with Italian fiscal obligations (D.P.R. 633/1972).
• Browsing data — retained for the session duration only, or until consent is withdrawn where applicable.
• Marketing data — retained until consent is withdrawn.

5. Data subject rights (Arts. 15–22 GDPR)

You have the right to:

• Access — obtain confirmation of processing and a copy of your data (Art. 15).
• Rectification — correct inaccurate or incomplete data (Art. 16).
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal obligations (Art. 17).
• Restriction — restrict processing in certain circumstances (Art. 18).
• Portability — receive your data in a structured, machine-readable format (Art. 20).
• Objection — object to processing based on legitimate interest (Art. 21).

To exercise your rights: hello@royalpop.store

6. Cookies

• Technical cookies — necessary for site operation. No consent required.
• Google Fonts — the site loads fonts via Google servers, which involves transferring your IP address to Google Inc. No profiling cookies are set by this operation.
• Profiling cookies — not currently in use.

7. Transfers outside the EU

Google Fonts operates on servers located in the United States. The transfer is covered by the EU–US Data Privacy Framework (adequacy decision under Art. 45 GDPR), which ensures a level of protection equivalent to that in Europe.

Stripe, Inc. is certified under the same framework and operates in compliance with GDPR for payment data transfers.

8. Contact for exercising rights

For any request relating to the processing of your personal data, write to: hello@royalpop.store

You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

9. Updates to this policy

This Privacy Policy may be updated periodically to reflect legal or operational changes. The date of the last update is shown at the top of this page.