Privacy Policy

1. Controller

STEVAN MASAL PR BEOGRAD, Kneza Mihaila 3, 11158 Belgrade, Serbia, Tax ID 115862967, Reg. no. 68699606. For any question about your data: info@vesperrituals.com, [PHONE — TO BE FILLED].

2. What data we process

• — Orders: full name, email, phone, delivery address, items ordered, personalization text (initials or a date), payment method and status.
• — You enter your card details on the bank’s page. We never see or store them. The bank only tells us whether the payment succeeded.
• — Contact form: name, email and message.
• — “Notify me” list: email address, language and the time you gave consent.
• — Newsletter: email address, language and the time you gave consent.
• — Analytics and advertising, only with your consent in the cookie banner: pages visited, products viewed, cart, checkouts started and purchases completed (order number, amount, products), cookie identifiers, IP address and browser and device details. When you buy, with consent to marketing cookies, also your encrypted (hashed) email, phone and country.
• — Visit statistics without cookies: the page visited, the page you came from, country and type of device and browser. Nothing is stored on your device and visits are not linked to you.
• — Technical data: IP address and browser details, in system logs and error reports.

3. Purposes and legal basis

• — Delivering your order and communicating about it: performance of the contract.
• — Fiscal receipts, accounting, withdrawals and claims: legal obligation.
• — Notifying you when the store opens: your consent.
• — Newsletter, news about new collections: your consent.
• — Site usage statistics (Google Analytics): your consent.
• — Measuring how well our ads on Instagram and Facebook work (Meta): your consent.
• — Total number of visits (Vercel Web Analytics), without cookies and without consent: our legitimate interest in knowing how the site is used.
• — Replying to a contact form message: our legitimate interest in answering you.
• — Site security and fixing errors: legitimate interest.

Order data is necessary to conclude and perform the contract. Without it, we cannot deliver your order. Everything else is voluntary.

4. Marketing

We send promotional messages only if you have separately and voluntarily signed up for them: on the “Notify me” list or for the newsletter. After you sign up, you receive one email confirming it. Buying from us or using the site does not mean you consent to marketing. You can withdraw your consent at any time, with no consequences: via the unsubscribe link in every email, on the unsubscribe page, or by writing to info@vesperrituals.com. Unsubscribing applies to both lists.

Ads: if you accept marketing cookies in the banner, Meta (Facebook, Instagram) receives data about your visits and purchases, so that we can measure how well our ads work. When you buy, we send Meta the order number, amount and products, as well as your encrypted (hashed) email, phone and country, both from your browser and from our server; Meta combines them into a single purchase. Without that consent, we send none of this. You can withdraw consent under “Cookie Settings” in the site footer, and after that nothing is sent, either from your browser or from our server.

We and Meta Platforms Ireland Ltd. are joint controllers for collecting these data and sending them to Meta (Meta Pixel and Conversions API), under Meta’s Controller Addendum. For any further processing, Meta is an independent controller under its own privacy policy (facebook.com/privacy/policy). You can exercise your rights regarding this processing with us or with Meta.

5. Who we share data with

• — The courier: name, address, phone and the cash-on-delivery amount.
• — The bank for card payments: order number and amount.
• — Our accountant: the data needed for the business books.
• — Technical services for the site: hosting, database, email delivery, error monitoring, issuing fiscal receipts and cookie-free visit counting (Vercel). They process data only on our instructions.
• — Our email delivery service (Resend): the email address and language from the “Notify me” list and the newsletter are also kept as a contact, so that we can send you the opening notice or our news.
• — Meta Platforms Ireland Ltd. (Facebook, Instagram), only with consent to marketing cookies: the data described in section 4. Meta also processes it under its own privacy policy.
• — Google Ireland Ltd. (Google Analytics), only with consent to analytics cookies: pages visited, products viewed, cart and purchases (order number, amount, products), IP address and device details. Google signals and ad personalization are turned off.
• — Public authorities, where the law requires it.

6. Transfers outside Serbia

Some technical services process data in European Union countries and in the USA. Transfers to the EU rely on an adequate level of protection, and transfers to the USA on standard contractual clauses. This also applies to Meta and Google, when you have given consent for them.

7. How long we keep data

• — Orders: 2 years from delivery, the period of liability for non-conformity. Data that accounting and tax rules require us to keep is kept for as long as those rules require.
• — Claims: 2 years from submission, as the law requires for the register of claims.
• — Contact form messages: 12 months from the last exchange.
• — “Notify me” list: until the opening notice is sent, and no longer than 12 months from sign-up. After you unsubscribe, we delete your address within one day.
• — Newsletter: until you unsubscribe. After you unsubscribe, we delete your address within one day. Our email delivery service (Resend) keeps only a record that the address has unsubscribed, so that we do not email you again.
• — System logs and error reports: up to 90 days.
• — Purchase measurement data we keep with the order (IP address, browser details, Meta cookies): deleted as soon as we report the purchase to Meta, and no later than 8 days.
• — Google Analytics: 14 months.

8. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect processing before withdrawal. Send your request to info@vesperrituals.com. We reply within 30 days.

You can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs.

9. Cookies

Necessary cookies and browser storage (language, cart, your cookie choice) work without consent. Analytics and marketing cookies load only once you accept them in the banner. You can change your choice under “Cookie Settings” in the site footer. We also count visits without cookies (Vercel Web Analytics), and nothing is stored on your device for that. Details are on the Cookies page.