Privacy Policy
How we collect, use, and protect your information. We keep only what we need and never sell your data.
Last updated: 26 Oct 2025
1Who we are
Heraldic Studio (“we”, “us”, “our”) operates heraldic-studio.com (the “Website”) and sells heraldry-related products.
Email: support@heraldic-studio.com (orders: orders@heraldic-studio.com)
Postal address: Posavska 61 O, 71000 Sarajevo, Bosnia and Herzegovina.
We are the controller of the personal data described below.
2What this policy covers
This Policy explains what personal data we collect when you visit the Website, create an account, place an order, contact us, or interact with us; how we use and share that data; and your rights.
3The data we collect
- Account & profile: name, email, password (hashed), billing and shipping addresses, phone.
- Order details: items purchased, order notes, totals, currency, tax, chosen shipping method, IP (for fraud prevention).
- Payments: payment method, transaction IDs and status. Card details are processed by our payment provider(s) and are not stored on our servers.
- Messages & support: emails, contact-form content, attachments.
- Reviews & user content: ratings, text, photos you submit.
- Technical data: IP address, device/browser type, pages viewed, referral source, cookies and similar technologies (see “Cookies”).
- Marketing preferences: newsletter/opt-in choices.
4Why we use your data (legal bases)
- To run the store and fulfil orders (create your account, take payment, deliver goods, handle returns) — Contract.
- Customer support and notifications (order updates, replies to your messages) — Contract / Legitimate Interests.
- Fraud and abuse prevention, security, debugging — Legitimate Interests.
- Legal compliance (tax, accounting, consumer requests) — Legal Obligation.
- Marketing with your consent (e.g., newsletters). You can withdraw consent anytime.
We do not sell your personal data.
6How long we keep data
- Orders & invoices: typically 6 years (tax/audit obligations).
- Accounts: while active; or delete on verified request (we may retain order records for legal duties).
- Support emails/forms: up to 24 months after last contact.
- Marketing lists: until you unsubscribe/withdraw consent.
- Logs/technical data: typically 12 months (security/diagnostics).
7Cookies & similar technologies
We use cookies to make the store work, remember your cart, and (if enabled) measure performance. You can manage choices in our cookie banner and/or your browser.
Examples used by WooCommerce:
- woocommerce_cart_hash, woocommerce_items_in_cart – remember cart contents (session).
- wp_woocommerce_session_ – anonymous unique code to link you to your cart (up to 2 days).
Other cookies may support login sessions, preferences, or analytics/marketing you’ve opted into.
Blocking some cookies may break site functions (cart, checkout, login).
8Your rights
Subject to local law, you may have the right to:
- access a copy of your data;
- correct inaccurate data;
- delete your data (where we’re not required to keep it);
- restrict or object to certain processing;
- data portability;
- withdraw consent (for consent-based processing);
- lodge a complaint with your supervisory authority.
To exercise any right, email support@heraldic-studio.com. We may request proof of identity.
9Security
We use reasonable technical and organisational measures (HTTPS, access controls, backups, least-privilege accounts, etc.). No system is 100% secure; please keep your account password confidential.
10Children
Our Website is not directed to children under 16. We do not knowingly collect data from children.
11Third-party links
Our Website may link to other sites. Those sites have their own privacy policies and we are not responsible for their practices.
12Changes to this Policy
We may update this Policy from time to time. The “Last updated” date shows the latest version. Significant changes will be announced on the Website.
13Contact
Questions or requests about privacy?
Email: privacy@heraldic-studio.com (or support@heraldic-studio.com)
Postal address: Posavska 61 O, 71000 Sarajevo, Bosnia and Herzegovina.
If you are in the EEA/UK, you can also contact your local data protection authority.