Privacy Policy — Ars Onirika

Last updated: Sept 2025

1. Data controller

Owner: ARS ONIRIKA
Trading name: Ars Onirika
Privacy contact: arsonirika@gmail.com

Ars Onirika is the controller for data processed on this site. Shopify Inc. acts as our ecommerce provider and processor for certain operations.

2. Data we process

Order & account data: name, email, billing/shipping address*, purchased items, order ID and totals. (*Shipping address is not required for digital goods.)
Payments: handled securely by payment gateways (Shopify Payments, PayPal, etc.). We do not store full card numbers.
Communications: messages sent via contact forms, email or social media.
Newsletter (Brevo): name, email, engagement metrics.
Digital delivery & support: download logs and re‑delivery records.
Site usage & cookies: IP addresses (potentially truncated), device IDs, visited pages, cart status, language/currency preferences. See Cookies.

3. Purposes & legal bases (GDPR/UK GDPR)

Order processing & service delivery (sending digital files, after‑sales support).
Legal basis: performance of a contract (Art. 6(1)(b)).
Transactional communications (confirmations, downloads, incident notices).
Legal basis: contract / legitimate interest (Art. 6(1)(b)(f)).
Customer support.
Legal basis: contract / legitimate interest.
Newsletter & marketing (only if you subscribe/consent).
Legal basis: consent (Art. 6(1)(a)).
Fraud prevention & security.
Legal basis: legitimate interest / legal obligation.
Analytics & site improvement.
Legal basis: legitimate interest or consent, depending on cookies.

4. Sharing & processors

We share data with service providers acting on our behalf:

Shopify (commerce platform, hosting, basic analytics).
Payment gateways (Shopify Payments, PayPal, etc.).
Brevo (email marketing).
Shopify apps required for digital downloads, reviews or support. We only share what is necessary for each purpose.

5. International transfers

Some providers (including Shopify) may process data in Canada and the United States or other non‑EEA/UK locations. We rely on Standard Contractual Clauses and comparable safeguards. Contact us at arsonirika@gmail.com for more details.

6. Retention

Orders & invoicing: retained for statutory accounting/tax periods.
Support/downloads: for the time needed to handle incidents.
Newsletter: until you unsubscribe or we cleanse inactive lists.
Cookies/analytics: as per your cookie settings and tool lifetimes.

7. Your rights

You may request access, rectification, erasure, restriction, portability, and objection by emailing arsonirika@gmail.com from the address associated with your order/subscription. If you are not satisfied you can lodge a complaint with your local data protection authority.

For marketing emails, use the unsubscribe link at the bottom of each message.

8. Cookies & similar tech

We use cookies for essential functions (cart, checkout), analytics and—where applicable—marketing. A cookie banner lets you accept, refuse or configure categories at any time via Cookie preferences (footer link).

9. Children

This website is intended for users 16+. If we learn we have collected data from a minor without consent, we will delete it.

10. Changes to this policy

We may update this notice to reflect legal or service changes. We will post the new version with the effective date above.

11. Contact

For privacy matters: arsonirika@gmail.com

12. California Residents — CCPA/CPRA

Scope: this section applies only to California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Personal information covered: as defined by California law (e.g., identifiers like name, email, IP address; commercial information about orders; site usage data, etc.).

12.1 Your California privacy rights

As a California resident, you may request:

Right to know/access the categories and specific pieces of personal information we collect, the sources, purposes, and categories of third parties to whom we disclose it.
Right to correct inaccurate personal information.
Right to delete personal information, subject to exceptions (e.g., legal obligations, fraud prevention, warranties/accounting).
Right to opt out of the “sale” or “sharing” of personal information for cross‑context behavioral advertising.
Right to limit the use/disclosure of sensitive personal information, if processed for non‑exempt purposes.
Right to non‑discrimination for exercising these rights.

12.2 Sale or sharing

We do not sell your personal information for money. We may “share” (as defined by CPRA) online identifiers for interest‑based advertising if you consent to marketing cookies. You can opt‑out of sale/sharing at any time via:

Do Not Sell or Share My Personal Information (footer link) or the Cookie Preferences panel.

12.3 How to exercise your rights

Send a request to arsonirika@gmail.com with subject “CCPA Request” or use our contact form. Specify which right you wish to exercise.

Verification: to protect your data we may require additional information (e.g., confirming the email address associated with your order) before fulfilling your request.

Authorized agents: if you submit through an agent, we require written authorization or power of attorney, and we will verify your identity directly.

Minors: our store is not directed to children under 16. We do not knowingly sell or share personal information of minors.

Response time: we aim to respond within 45 days (extendable as permitted by law).

Retention: we retain personal information as described in this policy and in accordance with applicable legal requirements.