Privacy Policy

We collect only what we need to sell and deliver your order and to answer you. We do not sell or share your personal information, and we do not use advertising or analytics cookies.

Last updated: 12 October 2026

1. Who is responsible

SIESTA LLC (trading as SCULPTAVI), 1320 Stirling Road, Suite 5A, Dania Beach, FL 33004, United States, is responsible for your personal data (“controller”). Contact: support@sculptavi.shop, +1 8525654215.

2. What we collect and why

Data	Purpose	Legal basis (EU/UK)
Name, billing and delivery address, email, phone, order contents, order language and currency	Processing, delivering and supporting your order; sending order and shipping emails	Contract (Art. 6(1)(b) GDPR)
Payment status and transaction reference (not your card number)	Taking payment, refunds, fraud prevention	Contract; legitimate interest in preventing fraud (Art. 6(1)(f))
Order and invoice records	Tax and accounting obligations	Legal obligation (Art. 6(1)(c))
Account details (email, password hash, addresses) if you create an account	Letting you see orders and save addresses	Contract
Messages you send us, contact form and withdrawal declarations	Answering you, handling returns and withdrawals, keeping evidence of them	Contract; legal obligation; legitimate interest
Technical data: IP address, browser, pages requested, in server logs	Security and keeping the site running	Legitimate interest
Cookies needed for the bag, checkout, login, language and currency	Making the shop work	Strictly necessary (no consent required); see Cookies

You do not have to give us your data, but we cannot process an order without the details marked as required at checkout. We do not make decisions about you based solely on automated processing; our payment providers may use automated fraud checks that can lead to a payment being declined, and you can contact us to have a person review it.

3. Who receives your data

• Payment providers (Stripe and PayPal, when you choose them) to take payment and prevent fraud. They act as independent controllers for some processing; see their privacy notices.
• Our hosting provider (Hostinger), which runs this website, and our email service provider.
• Carriers who deliver your parcel receive your name, address, phone number and, for international parcels, the information needed for customs.
• Professional advisers and authorities where the law requires it.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

4. International transfers

We are based in the United States, so data from customers in the EU, EEA, UK and Switzerland is transferred to the United States. Where the recipient is not certified under the EU-U.S. Data Privacy Framework (or its UK and Swiss extensions), we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) together with additional safeguards. You can ask us for a copy.

5. How long we keep it

• Order and invoice records: 7 years, for tax and accounting.
• Withdrawal declarations and return records: 3 years after the return is closed.
• Customer account: until you delete it or ask us to; orders inside it as above.
• Emails and contact form messages: up to 24 months after the conversation ends.
• Server logs: up to 30 days.

6. Your rights

Everyone can ask us to access, correct or delete their personal data, or to stop sending them anything other than order emails.

EU, EEA, UK and Swiss residents have the right of access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection authority, in particular in the country where you live (for example the Danish Datatilsynet or your German state’s data protection authority).

California and other US state residents (including Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have the right to know what personal information we collect, use and disclose; to access and receive a copy of it; to correct it; to delete it; and to opt out of its sale or sharing and of targeted advertising, although we do not sell or share it. You may designate an authorised agent. If we refuse a request you can appeal by replying to our answer.

How to make a request: email support@sculptavi.shop or use the contact form (choose “privacy request”). You do not need an account. We may ask for information to verify your identity, such as the email address and an order number. We answer within one month (EU/UK) or 45 days (US states), and tell you if we need more time. We will never charge you more, give you a different level of service or otherwise penalise you for exercising a right.

7. Global Privacy Control

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information. Because we do not sell or share it, nothing on the site needs to change, but the signal is honoured. See Do Not Sell or Share My Personal Information.

8. Children

Our shop is not directed at children under 16 and we do not knowingly collect their personal information.

9. Security

The site uses encrypted HTTPS connections. Card payments are handled on PCI DSS certified forms of our payment providers. Access to customer data is limited to people who need it. If a data breach is likely to put your rights at risk, we will inform you and the relevant authorities as the law requires.

10. Changes

We will update this policy when our processing changes and show the date at the top.