Controller and scope
Corell's Custom I/S, CVR 46354990, Poulas Alle 44, 4400 Kalundborg, Denmark is responsible for the personal data described here. Contact support@corellscustom.com or +45 61 28 53 16.
This notice covers browsing, preview testing, checkout, messages and withdrawal requests. It explains processing; it does not ask you to consent to a privacy policy.
Information we collect
You provide contact and purchase information: name, email, telephone number, billing or delivery address, chosen products, prices, currency and delivery selection. Our Cloudflare Worker stores an order snapshot in Cloudflare D1 before you complete Stripe checkout, so a record can exist even if payment is never completed. We record payment status and transaction references, not full payment-card details.
Messages and withdrawal requests include the details you submit and the time of submission. Cloudflare processes connection and security information, including IP addresses and request information. Language and currency suggestions use Cloudflare's IP-based country indication, not GPS. Countries with a supported local language use that language; other known countries use English. If the country is unknown, the language follows your browser preferences. A valid URL choice or remembered choice takes priority, and you can choose a different language or currency yourself.
Purposes and legal bases
We use information needed for your requested checkout steps and, for live sales, payment, fulfilment and support under GDPR Article 6(1)(b), pre-contractual steps and contract performance. Without required contact and delivery details we cannot process the relevant order.
Consumer-rights requests and legally required accounting records are handled under Article 6(1)(c). General enquiries, security, fraud prevention, testing the preview and establishing or defending legal claims rely on Article 6(1)(f), our legitimate interests in operating a secure store, responding to people and protecting rights. We consider the impact on you and limit data to what is necessary.
Cloudflare, Stripe and email
Cloudflare provides hosting, server functions, the D1 order database, security and order confirmations, merchant order notifications and withdrawal-receipt email delivery. Stripe receives the contact, address and order information needed for its hosted checkout and processes payment details directly. Stripe also acts as a controller for certain payment, fraud-prevention and legal purposes: https://stripe.com/privacy .
Our email provider handles ordinary support correspondence. Where necessary, professional advisers and public authorities receive records for accounting, legal advice or legal obligations. Access is limited to the purpose of the disclosure.
Shipping information
Current Shipmondo lookups use country, postcode and city to obtain shipping options or pickup points. The preview does not yet create shipments or send a complete customer address to Shipmondo for shipment booking.
If shipment booking is enabled, the recipient's name, address and necessary contact and parcel details will be shared with Shipmondo and the selected carrier to deliver the order. We will update this notice to describe the enabled service. Shipmondo information: https://shipmondo.com/security/privacy-policy/ .
International processing
An EU database location does not mean every service or recipient processes data only in the EU/EEA. Cloudflare and Stripe operate internationally, including in the United States.
Cloudflare's terms provide the EU–US Data Privacy Framework and, where applicable, EU Standard Contractual Clauses: https://www.cloudflare.com/cloudflare-customer-dpa/ . Stripe's transfer terms provide the same mechanisms: https://stripe.com/legal/dta . Shipmondo's processing agreement is at https://shipmondo.com/downloads/documents/dpa_en.pdf . Ask us for information or a copy of the safeguards relevant to your data.
Retention
Order records that must be kept as accounting documentation are retained for five years from the end of the relevant financial year, where Danish bookkeeping law requires this. Other order, support and withdrawal records are retained only as needed to handle the matter and relevant claims, with periodic review.
Test checkout records, including abandoned and completed test checkouts, are deleted from our active order database after 30 days. This does not simultaneously erase providers' separate records or backup copies, which have their own retention arrangements. Records for real purchases, legal obligations and claims follow the criteria above.
To protect the withdrawal form against misuse, we keep temporary pseudonymous counters derived from the IP address and email address. The counters expire after one to two hours and are removed by a scheduled cleanup that runs every five minutes, and when new submissions are processed. These counters do not contain the original IP or email address; the email address in the withdrawal notice itself follows the retention criteria above.
Browser storage and marketing
The store uses necessary browser localStorage for your cart, a checkout-completion marker and the record of your storage choice. Remembering language and currency for future visits is optional and starts only when you accept. Your storage choice lasts 180 days; you can change or withdraw it using Cookie settings in the footer. See Cookies & storage for purposes, storage names and removal. We currently use no analytics tracking, advertising pixels or newsletter sign-up. We do not sell your personal data or use it for automated decisions with legal or similarly significant effects.
Your rights
Subject to the GDPR conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw that consent for the future. Some records cannot be erased while a legal retention duty or justified claim applies.
Send requests to support@corellscustom.com. We may request proportionate information to confirm your identity. We normally respond within one month; if the GDPR permits an extension, we will explain it within that month.
Complaints and changes
You can complain directly to Datatilsynet, the Danish Data Protection Agency: https://www.datatilsynet.dk/borger/klage . You may also contact the supervisory authority where you live or work or where an alleged infringement occurred.
We will update this notice when processing changes. The date shown on this page identifies the current version.