Privacy Policy

Controller: SERENE — Timeless Home & Body. For any privacy question, email privacy@serene.example or write to the address listed at checkout. Our Data Protection Officer can be reached at the same address.

If you are in the EU/EEA, you may also contact your local supervisory authority. We cooperate fully with all data-protection authorities.

• Contract — to process orders, payments, delivery and returns.
• Legitimate interests — to keep the store secure and prevent fraud (security_storage, always granted).
• Consent — for analytics, marketing and preferences cookies (Consent Mode v2 signals below). Withdraw anytime via Cookie preferences.
• Legal obligation — to retain invoices and meet accounting requirements.

• Account & orders: name, email, address, phone, order history — from Shopify checkout.
• Device & usage: IP, user agent, pages viewed, products viewed, cart actions — only if you consent to Statistics/Marketing.
• Marketing: email engagement and on-site behavior via Klaviyo — only if you grant Marketing consent (script serene-klaviyo-script).
• Preferences: language/region choices — only if you grant Preferences consent.
• Consent record: your choices plus timestamp/version in cookie serene_consent (see Cookie Policy).

To fulfill orders, provide customer support, improve the site, personalize content (if consented), send marketing you opted into, secure the store, and meet legal obligations. We do not sell your data. Automated decision-making is not used for legal or similarly significant effects.

We share only with processors listed under Attributions and with payment/shipping providers needed to complete your order. International transfers rely on adequacy decisions or Standard Contractual Clauses.

• Order & invoice data — as required by law (typically 6–10 years depending on jurisdiction).
• Consent record serene_consent — 1 year (then re-prompt).
• Analytics/marketing cookies — up to 2 years only while consent is granted; deleted on withdrawal.
• Session/cart cookies — session to 30 days.

You have the right to access, rectify, erase, restrict, object, port, and withdraw consent. To exercise any right, email privacy@serene.example. We respond within 30 days. Withdrawing consent does not affect prior lawful processing. You also have the right to lodge a complaint with your supervisory authority.

We use four categories: Strictly Necessary (always on, security_storage: granted), Preferences, Statistics and Marketing. Google Consent Mode v2 signals are sent in denied mode until you decide. See our Cookie Policy for the full table, purposes and durations.

Email privacy@serene.example for any request. If you are unsatisfied with our response, you may lodge a complaint with your national data-protection authority. EU residents may also use the platform at ec.europa.eu/consumers/odr .