Privacy Policy

MOODSTORIES runs this online store. We decide what personal data is collected here and how it is used, which under the General Data Protection Regulation makes us the controller of that data.

For anything in this policy — questions, requests, complaints — write to order@moodstories.com. We reply within one month, and usually much sooner.

When you place an order: your name, email address, phone number and delivery address, the items and sizes you chose, the amount paid, and the language you shopped in.

When you subscribe to our emails: your email address and the discount code issued with it.

When you simply browse: your IP address, browser and device type, the pages you opened and the time of the visit. Our server records this to keep the site running and secure.

We never receive your full card number. Card details are entered in the payment provider's own window and stay with them — we learn only whether the payment succeeded and the last digits of the card.

To accept, ship and support your order and to handle returns and refunds. This is processing necessary to perform our contract with you — Article 6(1)(b) GDPR.

To send marketing emails and discount codes. Only with your consent — Article 6(1)(a) — which you may withdraw at any time through the unsubscribe link in any email.

To keep records of sales for as long as accounting and tax rules require. This is a legal obligation — Article 6(1)(c).

To keep the shop secure, prevent fraud and improve how it works. This is our legitimate interest — Article 6(1)(f).

Payment providers — Stripe and PayPal — receive what they need to take your payment and issue a refund. They act as independent controllers under their own privacy policies.

The delivery company receives your name, address and phone number so the parcel reaches you and the courier can call ahead.

Our email provider sends order confirmations, dispatch notices and, if you asked for them, newsletters.

Our hosting provider stores the site and the order database on our behalf, under a data processing agreement.

We do not sell your data, and we do not pass it to advertising networks or data brokers.

Our servers and the internal system that processes orders are located outside the European Economic Area. Where data leaves the EEA we rely on the safeguards of Article 46 GDPR — standard contractual clauses with the providers involved — and transfer only what an order genuinely requires.

You can ask us for details of those safeguards at order@moodstories.com.

Order and payment records: for as long as accounting and tax law requires, counted from the end of the year in which the order was placed.

Newsletter subscriptions: until you unsubscribe. After that we keep only the fact of the unsubscribe, so that we do not email you again by mistake.

Server logs and technical data: a short period, normally no longer than twelve months.

You may ask for a copy of the data we hold about you, have mistakes corrected, have data erased, ask us to restrict a particular use, object to processing based on our legitimate interest, and receive your data in a portable, machine-readable form.

You may withdraw consent to marketing at any time. This does not affect emails we lawfully sent before you withdrew it.

Write to order@moodstories.com to exercise any of these rights. We do not charge for it.

If you believe we have handled your data wrongly, you have the right to complain to the data protection supervisory authority of the country where you live or work.

The site runs over an encrypted connection, access to the order system is limited to named staff accounts with individual passwords, and payment pages are served by the payment provider rather than by us.

No system is perfect. If a breach ever put your rights at serious risk, we would notify you and the supervisory authority as the GDPR requires.

If we change how we handle personal data we update this page and the date above it. Changes that materially affect your rights are also announced by email to subscribers.