Privacy & Data Protection Policy

1. Information We Collect

When you visit our digital atelier or acquire an Éclat creation, we collect information necessary to fulfill your order and provide an exceptional client concierge experience:

• Personal Contact Information: Name, physical shipping address, billing address, email address, and telephone number (mandatory for courier adult signature verification).
• Payment Details: Encrypted payment authorization tokens. Raw card details are processed exclusively through PCI-DSS Level 1 certified gateways; our servers never retain raw card credentials.
• Order History & Bespoke Records: Ring sizing specifications, bespoke engraving inscriptions, and acquisition receipts for lifetime warranty maintenance records.
• Device & Interaction Telemetry: IP address, browser type, time zone, and navigational cookies used to preserve your saved shortlist (wishlist) and shopping bag contents.

2. How We Use Your Information

We use collected data solely for legitimate, authorized commercial purposes:

• To process transactions, generate invoices, and execute armored insured courier dispatch.
• To communicate real-time courier tracking telemetry and deliver gemological certification dossiers.
• To screen for prospective fraudulent activity and protect legitimate cardholders.
• With your explicit permission, to send invitations to private salon showings, new limited gemstone drops, or atelier announcements. You may opt-out at any time via the one-click unsubscribe link in any correspondence.

3. Zero Sale of Personal Information (CCPA / CPRA)

We do NOT sell, rent, or trade your personal information to any third party for financial or commercial gain. Under the California Consumer Privacy Act (CCPA), you retain the permanent right to know, access, delete, or opt out of any data sharing.

4. European & UK Resident Rights (GDPR Compliance)

If you reside in the European Economic Area (EEA) or the United Kingdom, you possess statutory rights under the General Data Protection Regulation (GDPR), including:

• The right to access the personal information we hold about you.
• The right to rectify incomplete or inaccurate records.
• The right to erasure ("Right to be Forgotten"), subject to mandatory financial and tax compliance retention laws.
• The right to restrict or object to the processing of your personal data.
• The right to data portability in a structured, machine-readable format.

5. Third-Party Service Providers

We only share minimal, strictly necessary data with trusted operational partners:

• Armored Logistics: FedEx Priority, UPS Express, and DHL Express receive your recipient name, address, and phone number exclusively for delivery fulfillment and signature confirmation.
• Certified Financial Gateways: Shopify Payments, Stripe, Apple Pay, and PayPal to process tokenized transactions securely.

6. Data Retention & Security Architecture

We implement stringent administrative, technical, and physical safeguards—including SSL encryption, automated network firewalls, and multi-factor authentication—to protect your personal records from unauthorized access, alteration, or disclosure. Order records are retained for statutory accounting and warranty verification periods, after which they are securely expunged.

7. Contact Our Data Protection Officer

To exercise your data privacy rights, request an export of your information, or ask questions concerning our privacy practices: