Privacy policy

Lullabud ("we", "us", "our") is operated by Andrew Barbero Ropero, Breitwies 15, 8532 Warth-Weiningen, Switzerland. We operate this store and website, including all related information, content, features, tools, products and services (the "Services"). Lullabud is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described here.

Personal Information We Collect or Process
"Personal information" means information that identifies or can reasonably be linked to you or another person. It does not include information that is collected anonymously or that has been de-identified. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process:

- Contact details: your name, billing address, shipping address, phone number, and email address.
- Payment information: transaction details, form of payment, and payment confirmation. Card payments are processed securely by Shopify and our payment providers; we do not see or store your full card number.
- Account information: your username, password, preferences and settings, if you create an account.
- Transaction information: the items you view, add to your cart, purchase, return, exchange or cancel, and your past orders.
- Communications with us: the information you include when you contact us, for example in a customer support email.
- Device information: information about your device, browser, network connection, IP address, and other unique identifiers.
- Usage information: how and when you interact with or navigate the Services.

Personal Information Sources
We may collect personal information:
- Directly from you, when you place an order, create an account, use the Services, or contact us;
- Automatically through the Services, from your device and through cookies and similar technologies;
- From our service providers, when they collect or process personal information on our behalf;
- From our partners or other third parties, such as advertising platforms.

How We Use Your Personal Information
- Provide and improve the Services: to process your payments, fulfill and ship your orders, process returns, exchanges and guarantee claims, manage your account, send order-related notifications, allow you to post reviews, and improve our store.
- Marketing and advertising: to send you marketing communications by email or text message where you have agreed to receive them or where permitted by law, and to show you online advertisements based on your activity on our store. You can opt out at any time.
- Security and fraud prevention: to protect your account and payments, and to detect, investigate or prevent fraudulent, illegal, unsafe or malicious activity.
- Communicating with you: to provide customer support and respond to your requests.
- Legal reasons: to comply with applicable law, respond to valid legal requests, and enforce or investigate potential violations of our terms and policies.

How We Disclose Personal Information
We may share your personal information with third parties for legitimate purposes, including:
- Shopify and service providers who perform services on our behalf, such as IT, payment processing, analytics, customer support, cloud storage, order fulfillment and shipping. In particular, your name, shipping address, phone number and order details are shared with our fulfillment partners and suppliers, which may be located outside your country, so that your order can be prepared and delivered.
- Shipping carriers and customs authorities, to deliver your order.
- Business and marketing partners, to provide marketing services and advertising, for example through Shopify and advertising platforms such as Meta, TikTok or Google. These partners use your information in accordance with their own privacy notices. Depending on where you live, you may have the right to ask us not to share your information for targeted advertising.
- When you ask us to or consent to it.
- In connection with a business transaction such as a sale or reorganization of our business, to comply with legal obligations, to enforce our terms or policies, and to protect our rights and the rights of our customers or others.
We do not sell your personal information for money.

Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit to the Services will be transmitted to and shared with Shopify and third parties that may be located in other countries. We also use certain Shopify features that use data from your interactions with our store, other merchants and Shopify. In these cases, Shopify is responsible for that processing, including responding to your rights requests. To learn more, visit the Shopify Consumer Privacy Policy (https://www.shopify.com/legal/privacy/app-users). Depending on where you live, you may exercise certain rights at the Shopify Privacy Portal (https://privacy.shopify.com/en).

Third-Party Websites and Links
The Services may contain links to websites or platforms operated by third parties. We are not responsible for their privacy or security practices, and we encourage you to review their policies. Information you share on public platforms, including social media, may be viewable by others.

Children's Data
Our products are designed for children, but our Services are intended for use by adults only. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it. We do not knowingly "share" or "sell" personal information of individuals under 16 years of age.

Security and Retention
We take reasonable measures to protect your personal information, but no security measure is perfect, and we cannot guarantee absolute security. Information sent over the internet may not be secure while in transit, so please do not send sensitive information to us by unsecured channels.
We keep your personal information only as long as necessary for the purposes described in this policy, for example to fulfill your orders, handle returns and guarantee claims, and comply with legal obligations such as tax and accounting rules, which may require us to keep order records for up to 10 years.

Your Rights and Choices
Depending on where you live, including under the Swiss Federal Act on Data Protection (FADP) and the EU/UK General Data Protection Regulation (GDPR), you may have the right to:
- Access: request access to the personal information we hold about you.
- Deletion: request that we delete your personal information.
- Correction: request that we correct inaccurate personal information.
- Portability: receive a copy of your personal information and request its transfer to a third party.
- Objection and restriction: ask us to stop or restrict certain processing.
- Withdrawal of consent: withdraw your consent at any time, without affecting processing that took place before.
- Marketing preferences: opt out of marketing emails at any time using the unsubscribe link. We may still send you non-promotional emails about your orders.
These rights are not absolute and may be limited by law. To exercise them, contact us by email. We may need to verify your identity before processing your request, and we will respond within the time required by applicable law. We will not discriminate against you for exercising your rights. You may designate an authorized agent to make requests on your behalf, with proof of authorization.

Complaints
If you have a complaint about how we process your personal information, please contact us first by email. Depending on where you live, you may also lodge a complaint with your local data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). For the EEA, you can find the list of data protection authorities at https://edpb.europa.eu/about-edpb/about-edpb/members.

International Transfers
We may transfer, store and process your personal information outside the country where you live, including in Switzerland, the European Union, the United States, Canada and other countries where our service providers and suppliers operate. When we transfer personal information out of Switzerland, the European Economic Area or the United Kingdom to a country without an adequate level of data protection, we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page, update the "Last updated" date, and provide notice where required by law.

Contact
If you have questions about this Privacy Policy or want to exercise your rights, please email us at headrest@use.startmail.com.

Data controller:
Andrew Barbero Ropero (Lullabud)
Breitwies 15, 8532 Warth-Weiningen, Switzerland
Email: headrest@use.startmail.com

This address is for legal and administrative correspondence only. It is not a store, warehouse or returns center. Please do not send returns or visit this address in person. All privacy requests and customer service inquiries are handled by email.