The Art of Curated Living

Privacy Policy

1. Introduction

LuxeBox Atelier respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your data when you visit our website, luxeboxatelier.com, and purchase our home decor gift boxes. We process personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable laws.

2. Data Controller Information

The data controller responsible for your personal data is:

LuxeBox Atelier

Calle Aribau 156, Barcelona, Spain

shop@luxeboxatelier.com

3. What Data We Collect

We may collect the following types of information:

Personal Data (collected only when necessary)

• Name

• Email address

• Phone number

• Shipping and billing address

• Payment details (handled securely by third-party processors)

Technical & Usage Data

• IP address

• Browser type and device details

• Website usage data (via cookies and analytics tools)

4. Legal Bases for Processing Data

Under GDPR, we process your personal data based on the following lawful grounds:

• Contractual necessity – To process orders and deliver services.

• Legitimate interests – To improve our services and provide customer support.

• Consent – For marketing emails (you can withdraw at any time).

• Legal obligation – To comply with tax or legal requirements.

5. How We Collect Your Data

We collect data when you:

• Place an order on our website

• Sign up for an account or newsletter

• Contact us for customer support

• Browse our website (via cookies and analytics)

6. How We Use Your Data

We use your data to:

• Process and fulfill orders

• Communicate with you about orders and support requests

• Send marketing emails (if you opt in)

• Improve website functionality and user experience

• Comply with legal obligations

7. How We Share Your Data

We do not sell or rent your data. However, we may share it with:

• Payment processors to handle secure transactions

• Shipping carriers (e.g., DHL, UPS) to deliver your orders

• Marketing and analytics providers (e.g., Google Analytics, email marketing platforms)

• Legal authorities if required by law

Any third parties processing your data are GDPR-compliant and process data only under our instructions.

8. Data Retention

We store your personal data only as long as necessary for the purposes collected:

• Order information – Kept for up to 7 years for tax and accounting purposes.

• Marketing data – Retained until you unsubscribe.

• Inactive accounts – Deleted after 2 years of inactivity.

9. Your GDPR Rights

As an EU/EEA resident, you have the following rights:

• Right to Access – Request a copy of your personal data.

• Right to Rectification – Correct inaccurate or incomplete data.

• Right to Erasure (“Right to be Forgotten”) – Request deletion of your data.

• Right to Restrict Processing – Limit how we use your data.

• Right to Data Portability – Obtain and reuse your data for other services.

• Right to Object – Opt out of certain types of data processing (e.g., direct marketing).

• Right to Withdraw Consent – If processing is based on consent, you can withdraw it anytime.

To exercise your rights, email us at shop@luxeboxatelier.com. We will respond within one month as required by GDPR.

10. Cookies & Tracking Technologies

We use cookies to enhance your experience and analyze website performance. You can manage your cookie preferences through your browser settings.

11. Security Measures

We take appropriate technical and organizational security measures, including:

• Encrypted transactions via SSL/TLS

• Secure data storage and access controls

• Regular security audits

12. Changes to This Privacy Policy

We may update this policy as needed. Any changes will be posted on this page with an updated revision date.

13. Contact Information & Complaints

If you have questions about this policy or wish to file a complaint, contact us at: shop@luxeboxatelier.com

If you believe we have mishandled your data, you have the right to lodge a complaint with your local Data Protection Authority (DPA).