Privacy Policy

1. Overview and Data Controller Identification
   
   www.trunkandtuck.com (“we”, “our”, or “us”) operates as the data controller responsible for the processing of your personal data collected through www.trunkandtuck.com. We are committed to safeguarding your privacy in strict compliance with the General Data Protection Regulation (GDPR) and applicable German data protection laws, including the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). This Privacy Policy outlines how we collect, use, store, and protect your personal information when you visit our website or purchase our foldable trunk storage boxes.
   
2. Personal Data We Collect
   
   We collect and process only the personal data strictly necessary to fulfill our contractual obligations, process transactions, and comply with legal requirements. Depending on your interaction with www.trunkandtuck.com, we may collect:

Identity and Contact Data: Full name, billing address, shipping address, email address, and telephone number provided during checkout or account creation.

Transaction and Payment Data: Details regarding orders placed, products purchased, and financial transaction summaries. All payment card processing is securely managed by our third-party payment processor, Stripe. We do not store or retain complete credit card numbers or sensitive authentication data on our servers.

Technical and Usage Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform data collected automatically through cookies and server logs when you browse www.trunkandtuck.com.

3. Purpose and Legal Basis for Processing
   
   We process your personal data in accordance with the GDPR under the following lawful bases:

Performance of a Contract (Article 6(1)(b) GDPR): Processing is necessary for the execution of the sales contract for our foldable trunk storage boxes, including order fulfillment, shipment arrangement, and customer service management.

Legal Compliance (Article 6(1)(c) GDPR): Processing is required to fulfill our statutory obligations, including German commercial and tax record-keeping requirements (Handelsgesetzbuch – HGB, and Abgabenordnung – AO).

Legitimate Interests (Article 6(1)(f) GDPR): Processing is conducted to maintain website functionality, secure our systems against unauthorized access, and optimize user experience, provided such interests are not overridden by your fundamental rights and freedoms.

4. Payment Processing via Stripe
   
   To securely process payments for orders placed on www.trunkandtuck.com, we utilize Stripe as our primary payment service provider. When you make a purchase, your payment details (such as credit card information, billing address, and transaction amount) are transmitted directly to Stripe.

Stripe processes your payment data as an independent data controller or processor in accordance with its own privacy policy and strict financial security standards (PCI-DSS compliance). We do not collect or store full payment card details on our local systems. For further information regarding how Stripe handles your personal data, please refer to the Stripe Privacy Policy available on their official website.

5. Data Retention Periods
   
   We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. In compliance with German statutory retention obligations:

Commercial and Accounting Records: Financial records, invoices, and relevant transaction contracts are retained for 10 years in accordance with Section 147 of the German Fiscal Code (Abgabenordnung – AO) and Section 257 of the German Commercial Code (Handelsgesetzbuch – HGB).

Contractual and Correspondence Data: Customer service communications, order fulfillment details, and general account records are retained for 6 years in compliance with commercial retention duties under German law.

Technical and Log Data: Website server logs and temporary technical identifiers are automatically deleted or anonymized within 30 days, unless an ongoing security incident or legal investigation requires extended retention.

6. Disclosure and Sharing of Data
   
   We treat your personal data with strict confidentiality and do not sell, rent, or trade your information to unauthorized third parties. Personal data may be shared exclusively with trusted service providers who assist us in operating our business and delivering our products:

Payment Service Providers: Stripe, for secure transaction processing.

Logistics and Fulfillment Partners: Couriers and delivery operators required to dispatch and deliver your ordered items to your designated address.

Hosting and IT Infrastructure Providers: Technical service providers hosting www.trunkandtuck.com under strict data processing agreements pursuant to Article 28 GDPR.

Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are implemented, such as European Commission-approved Standard Contractual Clauses (SCCs), to maintain an adequate level of data protection.

7. Your Data Protection Rights
   
   Under the GDPR, you hold specific rights regarding your personal data processed by www.trunkandtuck.com:

Right of Access (Article 15 GDPR): You have the right to request confirmation as to whether your personal data is being processed, and to access a copy of such data.

Right to Rectification (Article 16 GDPR): You have the right to request the correction of inaccurate personal data or the completion of incomplete data.

Right to Erasure (Article 17 GDPR): You have the right to request the deletion of your personal data under specific circumstances, provided there is no overriding statutory retention obligation requiring continued storage.

Right to Restriction of Processing (Article 18 GDPR): You have the right to request the restriction of processing of your personal data.

Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to Object (Article 21 GDPR): You have the right to object to the processing of your personal data based on legitimate interests.

Right to Withdraw Consent (Article 7(3) GDPR): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at promo@trunkandtuck.com. Furthermore, you have the right to lodge a complaint with a competent supervisory data protection authority in Germany or your habitual place of residence.

8. Cookies and Tracking Technologies
   
   www.trunkandtuck.com utilizes essential cookies and similar technologies to ensure core website functionality, secure checkout operations, and user session management. Non-essential analytical or marketing cookies are deployed only upon obtaining your explicit prior consent via our cookie banner, in compliance with European ePrivacy regulations and the GDPR.
   
9. Updates to This Privacy Policy
   
   We reserve the right to modify or update this Privacy Policy at any time to reflect changes in our business practices, technological advancements, or regulatory requirements. Any revisions will be published directly on www.trunkandtuck.com with an updated effective date. We encourage you to review this policy periodically.