Privacy policy

1. Data controller

The controller of your personal data is:

2. Categories of data we collect

We collect and process the following categories of personal data:

2.1 Data you provide

• Account data: name, email address, password (hashed), phone number
• Order data: shipping address, billing address, payment information
• Communication data: messages submitted through our contact form, customer-service requests
• Review data: reviews and ratings of products you submit

2.2 Data collected automatically

• Technical data: IP address, browser type and version, device type, operating system
• Usage data: pages visited, time spent, click patterns, search queries
• Location data: country and city (derived from IP address)
• Referral data: the website that referred you to us

2.3 Data from third parties

• Payment providers: transaction confirmations and fraud-prevention signals
• Social networks: profile information if you connect your social accounts
• Address verification: address validation through postal services

3. Purposes of processing

We process your personal data for the following purposes:

4. Retention periods

• Order data: 10 years (statutory retention of commercial and tax records)
• Account data: until you delete your account, plus 30 days for backups
• Newsletter data: until you unsubscribe
• Analytics data: 26 months maximum
• Server logs: 7 days
• Customer-support tickets: 3 years

5. Your rights

Under the GDPR you have the following rights with regard to your personal data:

5.1 Right of access (Art. 15)

You may obtain confirmation as to whether we process your personal data and, if so, request a copy of that data.

5.2 Right to rectification (Art. 16)

You may request the correction of inaccurate personal data and the completion of incomplete data.

5.3 Right to erasure (Art. 17)

You may request the deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected.

5.4 Right to restriction of processing (Art. 18)

You may request the restriction of processing in certain circumstances, for example while we verify the accuracy of your data.

5.5 Right to data portability (Art. 20)

You may receive your personal data in a structured, commonly used and machine-readable format, and transmit it to another controller.

5.6 Right to object (Art. 21)

You may object at any time to processing based on legitimate interest, including profiling and direct marketing.

5.7 Right to withdraw consent (Art. 7(3))

Where processing is based on consent, you may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

5.8 Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the alleged infringement. The competent authority for us is:

To exercise any of these rights, please contact us at: privacy@mellra.com

6. Cookies

Our website uses cookies and similar technologies. Cookies are small text files stored on your device that help us deliver and improve our services.

6.1 Cookie categories

6.2 Cookie management

You can manage your cookie preferences through our cookie settings panel, accessible via the cookie icon at the bottom left of the website. You may also configure your browser to block or delete cookies.

7. Third-party services

We use the following third-party services which may process your personal data:

7.1 Payment providers

• Stripe (USA) — card payment processing. Privacy policy: stripe.com/privacy
• PayPal (Luxembourg) — PayPal payments. Privacy policy: paypal.com/privacy
• Klarna (Sweden) — deferred payment. Privacy policy: klarna.com/privacy

7.2 Shipping partners

• Chronopost (France) — domestic and EU shipping
• DHL (Germany) — EU and international shipping
• UPS (USA) — international express

7.3 Analytics and marketing

• Google Analytics (USA) — website analytics, IP anonymisation enabled
• Meta Pixel (USA) — advert measurement (with consent only)
• Mailchimp (USA) — email marketing (newsletter subscribers)

7.4 International data transfers

Some of our processors are located outside the European Economic Area (EEA). We rely on appropriate safeguards, including:

• EU-US Data Privacy Framework certification
• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules

8. Data security

We apply appropriate technical and organisational measures to protect your personal data, including:

• SSL/TLS encryption for all data transmissions
• Encrypted storage of sensitive data
• Regular security audits and penetration testing
• Access controls and employee training
• Secure data centres within the EU

9. Protection of minors

Our website and services are not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn that we have collected such data, we will take prompt steps to delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or by a prominent notice on our website. Please review this policy regularly.

11. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us: