Privacy Policy

1. Who We Are

Gerbero Jewellery is the data controller responsible for your personal data.

2. Data We Collect

We may collect and process the following categories of personal data:

Identity data — first name, last name.
Contact data — email address, phone number, delivery and billing address.
Transaction data — details of purchases made through our store.
Technical data — IP address, browser type, device type, pages visited, time on site (via cookies and analytics tools).
Marketing preferences — your opt-in or opt-out choices for communications.
Communications data — messages sent to us via email or contact forms.

We do not collect or store payment card details. All payments are processed securely by Shopify Payments or third-party processors (e.g. PayPal, Stripe) under their own privacy policies.

3. How We Collect Your Data

Directly from you — when you place an order, create an account, contact us, or sign up to our mailing list.
Automatically — when you browse our website via cookies and similar tracking technologies.
Third parties — from payment processors and analytics providers such as Google Analytics and Meta (Facebook/Instagram) Pixel, where you have consented to their use.

4. How We Use Your Data

Purpose	Legal Basis
Processing and fulfilling your order	Performance of a contract
Sending order confirmation and shipping updates	Performance of a contract
Managing returns, refunds, and customer service	Performance of a contract / Legal obligation
Sending marketing emails (where opted in)	Consent
Improving our website and user experience	Legitimate interests
Fraud prevention and security	Legitimate interests / Legal obligation
Complying with legal and regulatory obligations	Legal obligation

5. Cookies

We use cookies to operate our website, remember your preferences, and analyse traffic. These include:

Essential cookies — required for the store to function (cart, session, checkout).
Analytics cookies — to understand how visitors use our site (e.g. Google Analytics).
Marketing cookies — to show you relevant ads on third-party platforms (e.g. Meta Pixel), only with your consent.

You can manage your cookie preferences via our cookie banner or your browser settings. Withdrawing consent for non-essential cookies will not affect the functionality of your order.

6. Sharing Your Data

We do not sell your personal data. We may share it with:

Shopify Inc. — our e-commerce platform provider (data processed under Shopify's privacy policy).
Delivery carriers — to fulfil and ship your order (name, address, contact number).
Payment processors — Stripe, PayPal, or Shopify Payments, solely to complete transactions.
Email marketing platforms — e.g. Klaviyo or Mailchimp, where you have opted in to marketing.
Analytics providers — Google Analytics, Meta, for website improvement and advertising (where consented).
Legal authorities — where required by law or to protect our legal rights.

7. International Transfers

Some of our service providers (e.g. Shopify, Google) are based outside the UK/EEA. Where we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the relevant authority.

8. Data Retention

Order and transaction data is retained for 7 years for legal and tax compliance.
Marketing data is retained until you unsubscribe or withdraw consent.
Customer account data is retained for as long as your account is active, plus a reasonable period thereafter.
Technical and analytics data is typically retained for up to 26 months.

9. Your Rights

Under UK GDPR you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure — request deletion of your data where there is no lawful reason to retain it.
Restriction — ask us to pause processing of your data in certain circumstances.
Portability — receive your data in a structured, machine-readable format.
Object — object to processing based on legitimate interests or for direct marketing.
Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at info@gerbero.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our store is hosted on Shopify, which maintains industry-standard security certifications including PCI DSS compliance.

11. Third-Party Links

Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to read their policies separately.

12. Changes to This Policy

We may update this policy from time to time. The current version will always be available on this page. We will notify you of significant changes by email where required.