This notice describes how Blanche Verène (the operator named on our Legal Notice) processes personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the Latvian Personal Data Processing Law.
Data Controller
The data controller is the self-employed person operating Blanche Verène, contactable at hello@blancheverene.com.
What we collect
- Order data — name, shipping address, email, phone, items purchased. Collected when you place an order. Legal basis: contract performance (Art. 6(1)(b) GDPR).
- Payment data — card / payment-method data is handled directly by our payment processor (Shopify Payments / Stripe). We never see or store full card numbers.
- Newsletter — email address, if you subscribe. Legal basis: your consent (Art. 6(1)(a)). You may withdraw at any time via the unsubscribe link.
- Technical data — IP, browser, device, pages viewed. Collected via cookies and similar (see below). Legal basis: legitimate interest in operating and securing the site (Art. 6(1)(f)) and, for analytics / marketing cookies, your consent.
Why we process it
- To fulfil and ship your order.
- To answer enquiries you send us.
- To meet our accounting and tax obligations.
- To send marketing emails (only if you have opted in).
- To detect fraud and keep the site secure.
Who receives your data
Personal data is shared only with processors strictly required to operate the service:
- Shopify Inc. — storefront, checkout and order data hosting.
- The payment provider you choose at checkout.
- The shipping carrier handling your delivery.
- Email-marketing provider (only for newsletter subscribers).
Some of these processors may be located outside the EU/EEA. When that is the case, transfers are governed by the European Commission’s Standard Contractual Clauses or an adequacy decision.
How long we keep it
- Order records: 5 years (Latvian accounting law).
- Newsletter: until you unsubscribe.
- Support correspondence: up to 2 years.
Your rights
Under the GDPR you have the right to:
- Access the data we hold about you.
- Rectify inaccurate data.
- Erase your data (where no legal duty obliges us to keep it).
- Restrict or object to processing.
- Receive your data in a portable format.
- Withdraw consent at any time.
- Lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050 — dvi.gov.lv.
Cookies
We use strictly necessary cookies to run the cart and checkout. We use analytics and marketing cookies only after you accept them via the consent banner. You may withdraw consent at any time by clearing cookies in your browser.
Last updated: 21 May 2026.