Privacy Policy

1. Who We Are

This website is operated by Blossom by Olha, a handcrafted jewellery brand based in Marbella, Spain. Our website address is www.blossombyolha.com.

For any privacy-related enquiries, you can contact us at [email protected].

2. What Data We Collect

When you interact with our website or place an order, we may collect the following personal data:

• Identity data: first name, last name
• Contact data: email address, phone number
• Shipping data: delivery address
• Transaction data: order details and payment confirmation (payment card data is processed directly by Stripe and never stored on our servers)
• Usage data: how you use our website (via Google Analytics)
• Marketing data: your preferences for receiving marketing communications

3. How We Use Your Data

We use your personal data to:

• Process and fulfil your orders
• Send you order confirmations, shipping updates, and invoices
• Respond to customer service enquiries
• Send you marketing emails if you have opted in (you may unsubscribe at any time)
• Prevent fraud and maintain the security of our website
• Comply with legal obligations

4. Legal Basis for Processing

Under the GDPR (EU General Data Protection Regulation), we process your data on the following legal bases:

• Contract performance: processing your order and delivering your purchase
• Legitimate interest: fraud prevention, website improvement
• Consent: marketing communications and newsletter subscriptions
• Legal obligation: tax records and financial compliance

5. Third-Party Services

We share your data only with trusted service providers who help us operate our business:

• Stripe — payment processing (their privacy policy applies to card data)
• Resend — transactional and marketing emails
• Google Analytics — anonymous website usage statistics
• Cloudflare — content delivery and DDoS protection

We do not sell your personal data to any third party.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected:

• Order and transaction records: 7 years (legal and tax requirements)
• Customer account data: until you request deletion
• Marketing consent: until you unsubscribe

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: request deletion of your data ("right to be forgotten")
• Portability: receive your data in a portable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: unsubscribe from marketing at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Cookies

Our website uses cookies to improve your browsing experience and analyse site traffic. These include:

• Essential cookies: required for the shopping cart and account functionality
• Analytics cookies: Google Analytics (anonymous usage statistics)

You can control cookies through your browser settings. Disabling cookies may affect some website functionality.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. Continued use of our website after changes constitutes acceptance of the updated policy.

10. Contact

For any questions about this Privacy Policy or how we handle your data: