1. Data Controller

VINTORA is a trading name of Zalaan's Wearhouse Limited, registered at 51 Bracken Road, Sandyford, Dublin D18 CV48, Ireland.

Contact: hello@vintora.eu

2. What We Collect

• Order information: Name, email, shipping address, phone number (optional), payment method type (we never store full card details)
• Browsing data: Pages visited, products viewed, session duration (via cookies, where consented)
• Communication: Email correspondence, customer support queries, return requests
• Marketing: Email address and engagement data if you subscribe to our newsletter

3. How We Use Your Data

• Fulfil orders: Process payment, arrange shipping, send order confirmation and tracking
• Customer service: Respond to enquiries, process returns and refunds
• Marketing: Send newsletters, new arrivals, and promotional emails (only with your consent, via Klaviyo)
• Improve our service: Analyse site performance and shopping behaviour to improve the customer experience
• Legal compliance: Tax reporting, fraud prevention, legal obligations

4. Third-Party Services

• Shopify: E-commerce platform — processes orders and hosts the website
• Shopify Payments / Stripe: Payment processing — PCI-DSS compliant
• Klarna: Buy now, pay later payment option
• Klaviyo: Email marketing — manages subscriber lists and campaigns
• Packlink Pro: Shipping label generation and carrier integration
• AfterShip: Order tracking notifications
• ReturnGO: Returns management portal
• Google Analytics (GA4): Anonymous website analytics
• Meta Pixel: Advertising performance tracking (with consent)
• eBay / Depop / Vinted / Vestiaire Collective: Marketplace platforms — process orders and buyer data under their own privacy policies

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

5. International Data Transfers

Some of our service providers (e.g. Shopify, Stripe, Klaviyo) process data outside the EU/EEA. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission, or the service provider's participation in recognised data protection frameworks.

6. Data Retention

• Order data: Retained for 6 years from the date of transaction (Irish Revenue requirement)
• Marketing data: Retained until you unsubscribe or request deletion
• Customer support correspondence: Retained for 2 years from the date of last contact
• Analytics data: Anonymised and retained as aggregated statistics

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access: Request a copy of the data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data (subject to legal retention requirements)
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interest or direct marketing
• Right to withdraw consent: Withdraw marketing consent at any time via the unsubscribe link in any email or by contacting us

To exercise any of these rights, contact us at hello@vintora.eu. We will respond within 30 days.

8. Cookies

Our website uses cookies for essential site functionality, analytics, and marketing. When you first visit vintora.eu, you will be presented with a cookie consent banner. You may accept or decline non-essential cookies.

• Essential cookies: Required for the website to function (e.g. cart, checkout, session). Cannot be disabled.
• Analytics cookies: Google Analytics (GA4) — help us understand how visitors use the site. Can be declined.
• Marketing cookies: Meta Pixel, Klaviyo tracking — used for retargeting and email automation. Can be declined.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (SSL/TLS), secure payment processing, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Children's Data

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

11. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC):

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
Website: dataprotection.ie
Email: info@dataprotection.ie

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date.

Last updated: June 2026