Privacy Policy

1. Introduction and Data Controller

This Privacy Policy describes how Zlexironshel ("we," "us," or "our") collects, uses, stores, and protects your personal information when you visit our website at zlexironshel.world or submit a purchase inquiry through our order form.

We are committed to protecting your privacy and handling your personal data in accordance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Personal Data We Collect

2.1 Information You Provide Directly

When you submit our order form, we collect:

• Full name
• Email address
• Phone number (if provided)
• Message or delivery notes you include in the form
• Record of your consent to this Privacy Policy and our Terms of Use

2.2 Information Collected Automatically

When you visit our website, we may automatically collect:

• IP address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages visited, time spent, and navigation paths
• Referring website or source
• Cookie identifiers (subject to your consent preferences)

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and on the following legal bases:

• Order Processing: To process and fulfill your purchase inquiry, communicate order details, and arrange delivery — Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
• Customer Communication: To respond to your inquiries and send order confirmations — Legal basis: Legitimate interest / contract performance.
• Website Analytics: To understand how visitors use our website and improve the user experience (only with your consent) — Legal basis: Consent (Article 6(1)(a) GDPR).
• Marketing: To send promotional communications about our products (only with your explicit consent) — Legal basis: Consent (Article 6(1)(a) GDPR).
• Legal Obligations: To comply with applicable laws and regulations — Legal basis: Legal obligation (Article 6(1)(c) GDPR).

4. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Order and contact form data: Retained for up to 3 years from the date of your request, in accordance with standard business record-keeping practices and applicable statute of limitations.
• Analytics data: Retained for up to 26 months from collection (subject to your consent).
• Marketing consent records: Retained until you withdraw consent, plus an additional 12 months for compliance documentation.
• Cookie data: Per the durations set out in our Cookie Policy.

Upon expiration of the applicable retention period, your data is securely deleted or anonymized.

5. Data Sharing and Transfers

We do not sell your personal data. We may share your data in the following limited circumstances:

• Service Providers: With trusted third-party providers who assist us in operating our website, processing orders, and delivering services (e.g., email delivery services, analytics platforms). These providers are bound by data processing agreements and may not use your data for their own purposes.
• Legal Requirements: When required by law, regulation, or valid legal process, or to protect the rights, property, or safety of Zlexironshel, our customers, or others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity under the same privacy protections.

All service providers operating in jurisdictions outside the United States are required to maintain data protection standards equivalent to those described in this policy.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Secure HTTPS encryption for all data transmission
• Access controls limiting data access to authorized personnel only
• Regular security assessments of our systems and practices
• Secure data storage on protected servers

While we take all reasonable precautions, no method of transmission or storage is 100% secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect any unauthorized access to your information.

7. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where it is no longer necessary for the purposes collected, or where you withdraw consent.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format and transmit it to another controller.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Restriction: Request that we limit the processing of your personal data in certain circumstances.
• Right to Withdraw Consent: Withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us using the details in Section 1. We will respond within 30 days of receipt of your request.

You also have the right to lodge a complaint with your local supervisory authority. In the US, relevant authorities include the Federal Trade Commission (FTC) and applicable state agencies.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, business purposes, and third parties with whom it is shared.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a California privacy rights request, contact us at the details in Section 1. We will verify your identity and respond within 45 days.

9. Cookies

We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please read our Cookie Policy.

10. Children's Privacy

Our website and products are intended for adults 18 years of age and older. We do not knowingly collect personal data from children under 13 years of age. If we become aware that we have inadvertently collected personal data from a child, we will take immediate steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make material changes, we will update the "Last updated" date at the top of this policy. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: