Privacy policy

1. Controller

Sunset & Sheets BV, Belgium, trading as Sunset & Sheets, runs this storefront and decides what happens to the data described below. Questions and requests go to hello@sunsetandsheets.com.

2. The short version

Your basket, your saved pieces, a discount code you typed and your cookie choice live in your browser's local storage, on your device. None of it is sent to us and we cannot see it. The only data that reaches us is what you type into a checkout form on the live store, or into an email.

3. What, why, on what basis, for how long

Data	Purpose	Legal basis	Retention
Basket, saved items, discount code, cookie choice	Keeping your basket between visits	Strictly necessary	In your browser only; never transmitted
Name, delivery address, email, phone	Fulfilling and delivering an order	Contract	7 years (Belgian accounting law)
What you ordered and paid	Order handling, the sleep trial, the 300-wash guarantee	Contract	7 years, then anonymised
Payment confirmation (never card numbers)	Knowing the order is paid	Contract	7 years
Email address on its own	The newsletter, if you asked for it	Consent	Until you unsubscribe
Aggregate page views	Seeing which pages are read	Consent	13 months, aggregated

Card details are entered directly with the payment provider. They never reach us. On the demonstration version of this storefront no payment is taken and the checkout form is not transmitted anywhere.

4. Cookies and local storage

• Strictly necessary. The basket, the saved list, the discount code and your cookie choice, all held in local storage on your device. Always set, because the shop does not function without them, and never sent to us.
• Measurement. Aggregate counts of pages and products viewed. Set only if you press “That is fine” on the cookie bar, and not set at all if you choose “Basket only”.

No advertising cookies, no cross-site pixels, no sale or sharing of data for advertising. Clearing your site data removes everything in the first category.

5. Who else sees it

Only the processors needed to run the shop, each under a data processing agreement and each receiving only what its task needs:

• The payment provider — name, email, amount
• The carrier — name, delivery address, phone number for delivery notifications
• The email service — email address, for order mail and the newsletter
• The hosting provider — server logs including IP addresses, kept 30 days

6. Transfers outside the EEA

Our processors are inside the European Economic Area wherever we have a choice. Where one is not, the transfer is made under the European Commission's Standard Contractual Clauses.

7. Your rights

Under the GDPR you may ask for a copy of your data, have it corrected or erased, restrict its processing, receive it in a portable format, object to processing based on legitimate interests, and withdraw consent at any time without affecting what was done before. Write to hello@sunsetandsheets.com; we reply within 30 days and usually within a few. Where accounting law obliges us to keep a record, we will say so and delete it when the period ends.

8. Complaints

You may complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) in Brussels, or to the supervisory authority of the country where you live. We would be grateful for the chance to put it right first.

9. Changes

If this policy changes in a way that matters, the date at the top changes and a note here says what moved. Earlier versions are available on request.

Terms & conditions