1. Data controller
COSMI WORLD SRL acts as the data controller for the personal data collected on the shotys.com website, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Belgian law.
DPO contact: hello@shotys.com
2. Data collected
We collect the following categories of data:
- Order data: last name, first name, delivery address, email, phone number.
- Payment data: processed exclusively by our payment provider (Stripe). We never store complete bank card details.
- Browsing data: IP address, browser type, pages visited (via technical cookies).
- Contact form: name, email, message.
- Age verification: confirmation cookie (no identity data is stored).
3. Purposes of processing
- Processing and management of orders
- Transactional communication (order confirmation, tracking)
- Responding to contact requests
- Legal compliance (age verification, accounting obligations)
- Service improvement (anonymised statistics)
4. Legal basis for processing
- Performance of the contract: processing of orders and deliveries.
- Legal obligation: retention of accounting records (7 years).
- Consent: non-essential cookies (marketing).
- Legitimate interest: website security, fraud prevention.
5. Retention period
- Order data: 7 years (Belgian accounting obligations).
- Contact data: 3 years after the last contact.
- Technical cookies: 13 months maximum.
- Age verification: 30 days (session cookie).
6. Data sharing
Your data may be shared with the following data processors, strictly within the scope of their assignments:
- Stripe, Inc. (payment processing): Dublin, Ireland (European entity)
- Vercel Inc. (hosting and audience measurement): Data processed in the EU
- Supabase Inc. (database): Data processed in the EU
- Resend, Inc. (transactional email delivery): Ireland, eu-west-1 region. Receives your email address, your name and your delivery address, as contained in the message
- Upstash, Inc. (rate limiting, abuse protection): Frankfurt, Germany. Only your IP address passes through it, and for a few minutes at most
- CARTO (map tiles on the Stockists page): your IP address is sent to them when the map is displayed. Hosting possibly outside the European Union
We never sell your data to third parties for commercial purposes.
7. Your rights
In accordance with the GDPR, you have the following rights regarding your personal data:
- Right of access: obtain a copy of your data.
- Right to rectification: correct inaccurate data.
- Right to erasure: request the deletion of your data.
- Right to data portability: receive your data in a structured format.
- Right to object: object to processing based on legitimate interests.
- Right to restriction of processing: request the suspension of processing.
To exercise your rights, contact us at hello@shotys.com. You also have the right to lodge a complaint with the Belgian Data Protection Authority (DPA).
8. Cookies
The website uses technical cookies that are essential to its operation (age verification, cart session). It sets no advertising cookies and no audience measurement cookies.
You are not asked to make any cookie choice: only essential cookies are set. The store locator map is the exception and asks for your explicit agreement before it is displayed, because it passes your IP address to its provider.
Audience measurement for the website is provided by Vercel. It sets no cookie and cannot identify you: it counts pages viewed, with no profiling and no tracking from one website to another. As such, it falls under the exemption for anonymous audience measurement and does not require your consent.