Privacy Policy

1. Data controller

The Royal Watchery Ltd ("TRW", "we") is the data controller for personal data collected via this website. Contact: info@theroyalwatchery.com.

2. Data we collect

We collect the data needed to fulfil orders, run our contractual relationship and — with consent — send marketing: name, email, shipping/billing address, payment data (processed directly by Stripe, never stored on our servers).

Only if you accept them in the cookie banner, we also collect browsing and interaction data (pages and products viewed, add-to-cart actions, purchases, traffic source, device and IP address) through Google Analytics 4 (analytics) and the Meta Pixel (marketing). With marketing consent, the pixel sends Meta the contact details you enter in site forms in hashed form (SHA-256), and for each purchase we also report the order to Meta from our server, with hashed email and the IP address and browser used at checkout. Without consent this data is not collected. Finally, we count visits and key events with our own system, which uses no cookies and does not store IP addresses. Details are in our Cookie Policy.

3. Legal basis

Processing is based on (a) contract (Art. 6.1.b GDPR), (b) legal obligations (Art. 6.1.c GDPR), (c) consent (Art. 6.1.a GDPR) for the newsletter, for analytics cookies and for marketing cookies and reports to Meta, (d) legitimate interest (Art. 6.1.f GDPR) for site security and for our cookieless internal statistics. You can withdraw consent at any time from the "Cookie preferences" link at the bottom of every page, with no effect on the site or on purchases; withdrawal does not affect processing already carried out.

4. Retention

Contract data: 10 years (tax obligation). Marketing data: until consent is withdrawn. Technical logs: max 12 months.

5. Third parties

Data is shared with Stripe (payments), Printify (fulfilment), our hosting provider (dedicated server and database), transactional email providers, and, only with your consent, Google Ireland Limited (usage statistics) and Meta Platforms Ireland Limited (measurement and advertising). With Meta we act as joint controllers, limited to the data collected through the pixel and the Conversions API. We do not sell data. Some providers are outside the EEA, including in the United States: those transfers rely on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses.

6. Your rights

Access, rectify, erase, restrict, port and object to processing. Complaints: your local data protection authority. Requests: info@theroyalwatchery.com.

7. Security

End-to-end HTTPS, RLS on databases, payments handled directly by Stripe (PCI-DSS Level 1).

8. Changes

We may update this notice. The current version is always published on this page.