Last updated: 2026-09-05
At pandora we take the protection of your personal data very seriously. This Policy explains what data we collect, for what purposes, who we share it with and what rights you have. It complies with Regulation (EU) 2016/679 (GDPR).
1. Data controller
- Controller: pandora
- Address: {{ADDRESS}}
- VAT number: {{VAT_ID}}
- Contact address: [email protected]
2. Data we collect
We collect the following data depending on the activity concerned:
| Activity | Data | Legal basis |
|---|---|---|
| Product purchase | First and last name, delivery address, email, phone, payment data (tokenised) | Performance of the contract (art. 6(1)(b) GDPR) |
| User account | Email, password (hashed), order history | Performance of the contract |
| Contact / form | Name, email, message, WhatsApp (optional) | Consent |
| Newsletter | Email, first name (optional), preferences | Consent |
| Browsing and analytics | IP address, technical and statistical cookies | Legitimate interest / consent |
| Fraud prevention | IP, devices, purchase patterns | Legitimate interest |
We do not process any special categories of personal data (health, opinions, origin, etc.).
3. Purposes of processing
The data is used to:
- Process, ship and invoice orders.
- Manage your account and customer service.
- Comply with legal obligations (tax, accounting).
- Send commercial communications where you have expressly consented.
- Improve the site through aggregated and anonymous analysis.
- Prevent fraud and abuse.
4. Retention period
- Order data: for the duration of the contractual relationship and then 5 years after the last transaction, to meet accounting and tax obligations.
- Account data: until you request deletion.
- Marketing data: until you withdraw your consent.
- Access logs: 12 months maximum.
5. Recipients and processors
Data may be disclosed to:
- Carriers and logistics providers (DHL, local agents) for delivery.
- Payment service providers (PCI-DSS certified).
- Transactional email and SMTP providers.
- Hosting providers (server located in the EU).
- Competent authorities where required by law.
All processors have signed a data processing agreement. We make no international transfers outside the European Economic Area, except to providers covered by the standard contractual clauses approved by the European Commission.
6. Your rights
You may exercise the following rights at any time by writing to [email protected]:
- Access: obtain a copy of your data.
- Rectification: correct inaccurate data.
- Erasure («right to be forgotten»).
- Objection to processing.
- Restriction of processing.
- Portability: receive your data in a structured format.
- Withdrawal of consent at any time, without retroactive effect.
You also have the right to lodge a complaint with a supervisory authority — the competent authority is the data protection authority of your country of residence. A directory of European authorities is available at
7. Security
We apply appropriate technical and organisational measures: TLS encryption on all pages, password hashing (bcrypt), role-based access restrictions, periodic backups, a web application firewall and dependency auditing.
8. Cookies
The use of cookies is governed by our Cookie Policy.
9. Minors
The site is intended for adults. If we detect that a minor has provided their data, we will delete it unless parental consent has been given in accordance with applicable law.
10. Changes
This Policy may be updated. The date of the last change appears at the top of the document. Substantial changes will be communicated by email to registered users.
11. Contact
For any question about this Policy or the processing of your data:
- Email: [email protected]
- WhatsApp: {{WHATSAPP}}